CVE-2025-9373

The PeproDev Branches Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to injec...

CVE-2025-9373 PeproDev Branches Map <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The PeproDev Branches Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to injec...

CVE-2025-9373

The PeproDev Branches Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.0.1 . The root cause is insufficient input sanitization and output escaping, which allows authenticated attackers with Contributor-level access or higher to inject a...

EUVD-2025-211087

The PeproDev Branches Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to injec...

CVE-2026-85345

The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side...

CVE-2026-106469

The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into the page in the browser, allowing authenticated users with Contributor-level access and above to store malicious SVG that executes JavaScript in th...

CVE-2026-107178

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes ...

CVE-2026-104644

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that execute...

CVE-2026-85345

The FV Flowplayer Video Player WordPress plugin (versions before 7.5.55.7212 ) is vulnerable to Server-Side Request Forgery (SSRF) . The flaw exists because the plugin fails to properly validate user-supplied URLs during a server-side fetch via the retrieve_video_data function, and current host-b...

CVE-2026-86797 Pricing Table Block 1.0.7 - 2.1.4 - Contributor+ Stored XSS via Pricing Link

The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of its blocks before rendering it, allowing users with contributor-level access and above to store malicious scripts that execute when another user views and interacts with the affect...

CVE-2026-86797

The Pricing Table WordPress plugin, in versions 1.0.7 through 2.1.4 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to validate the scheme of a user-supplied link value within one of its blocks before rendering. This allows users with contributor-level access or...

EUVD-2026-100854

The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of its blocks before rendering it, allowing users with contributor-level access and above to store malicious scripts that execute when another user views and interacts with the affect...

EUVD-2026-100852

The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side...

CVE-2026-107178

The Image Photo Gallery Final Tiles Grid WordPress plugin, versions prior to 3.6.16 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to escape gallery lightbox configuration values before they are printed into an inline script on pages embedding the gallery. Th...

EUVD-2026-100889

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes ...

CVE-2026-106469

The Gutenverse Form WordPress plugin (versions before 3.0.11 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to sanitize SVG icon markup stored within form blocks before it is decoded and rendered in a browser. This allows authenticated users with Contributor-le...

CVE-2026-106469 Gutenverse Form < 3.0.11 - Contributor+ Stored XSS via SVG Icon

The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into the page in the browser, allowing authenticated users with Contributor-level access and above to store malicious SVG that executes JavaScript in th...

EUVD-2026-100884

The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into the page in the browser, allowing authenticated users with Contributor-level access and above to store malicious SVG that executes JavaScript in th...

EUVD-2026-100876

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that execute...

CVE-2026-16495

The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirecturl' Shortcode Attribute in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...