Lucene search
+L

3245 matches found

CVE
CVE
added 2026/09/17 1:24 p.m.18 views

CVE-2026-66576

CVE-2026-66576 is a Contributor-level Cross Site Scripting (XSS) vulnerability in the JetBlocks For Elementor WordPress plugin, affecting versions 1.5.2 and earlier . The flaw was discovered by nh4tvd (reported via Patchstack). The vulnerability carries a CVSS 3.1 base score of 6.5 (MEDIUM) with ...

6.5CVSS5.7AI score0.00161EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/17 6:00 a.m.11 views

EUVD-2026-81358

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

4.9CVSS5.8AI score0.00222EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/09/17 6:00 a.m.12 views

CVE-2026-91019 Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

5.8AI score0.00222EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/09/16 6:00 a.m.8 views

CVE-2026-76558 WP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS via Custom Field Names

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the...

5.8AI score0.00395EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/15 1:16 p.m.9 views

CVE-2026-15609

The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circleline' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS0.0019EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/09/15 12:00 a.m.17 views

PT-2026-91870

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn shedule objective' schedule slot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output...

6.4CVSS5.9AI score0.0025EPSS
SaveExploits0References17
Patchstack
Patchstack
added 2026/09/14 5:23 p.m.7 views

WordPress Eventin plugin <= 4.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'etnsheduleobjective' scheduleslot Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP Event Solution versions = 4.1.23...

6.4CVSS5.7AI score0.0025EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
added 2026/09/12 6:00 a.m.15 views

WordPress WP Highlight Box plugin <= 1.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Pablo González and Francisco José Ramírez in WordPress Plugin WP Highlight Box versions = 1.0...

5.7AI score0.00235EPSS
SaveExploits0References1Affected Software1
Snyk
Snyk
added 2026/09/11 7:07 p.m.4 views

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated .projen/tasks.json without escaping shell metacharacters, affecting properties including extraArgs,...

8.4CVSS6AI score0.00157EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/11 7:39 a.m.44 views

CVE-2026-6640 Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlalinkattributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS0.00241EPSS
SaveExploits0References10
Patchstack
Patchstack
added 2026/09/11 6:00 a.m.8 views

WordPress AI Builder plugin 2.4.1-2.7.7 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by md. minaruzzaman shovon in WordPress Plugin AI Builder versions 2.4.1-2.7.7...

6.8CVSS5.7AI score0.00235EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/09/11 3:39 a.m.28 views

CVE-2026-7438

The Bold Timeline Lite WordPress plugin (all versions up to and including 1.2.8 ) is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the supertitle and subtitle attributes of the bold_timeline_item shortcode. The root cause is insufficient input sanitization and output escaping o...

6.4CVSS5.9AI score0.00206EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/09/11 12:00 a.m.12 views

PT-2026-90036

Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.1 versions...

6.5CVSS5.7AI score0.0013EPSS
SaveExploits0References1
Patchstack
Patchstack
added 2026/09/10 1:50 p.m.10 views

WordPress Quran Live Multilanguage plugin <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Gilang - DJ in WordPress Plugin Quran Live Multilanguage versions = 1.0.3...

6.4CVSS5.7AI score0.00378EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
added 2026/09/10 1:49 p.m.11 views

WordPress Slider Bootstrap Carousel plugin <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Gilang - DJ in WordPress Plugin Slider Bootstrap Carousel versions = 1.0.7...

6.4CVSS5.7AI score0.00378EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
added 2026/09/10 1:49 p.m.12 views

WordPress Switch CTA Box plugin <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Switch CTA Box versions = 1.1...

6.4CVSS5.7AI score0.00354EPSS
SaveExploits0References1Affected Software1
Vulnrichment
Vulnrichment
added 2026/09/10 3:40 a.m.8 views

CVE-2026-15820 Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting

The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Photo Module 'attributes' Setting in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS5.9AI score0.00201EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/09/10 3:40 a.m.48 views

CVE-2026-15796 Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting

The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bgvideoserviceurl' Setting in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS0.00193EPSS
SaveExploits0References5
Patchstack
Patchstack
added 2026/09/09 1:24 p.m.5 views

WordPress Gutentools plugin <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Gutentools versions = 1.1.3...

6.4CVSS5.7AI score0.0024EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
added 2026/09/08 4:48 p.m.13 views

WordPress WP Recipe Maker plugin <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Recipe Ownership Takeover and Unpublishing vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Recipe Maker versions = 10.8.0...

4.3CVSS5.7AI score0.00274EPSS
SaveExploits0References1Affected Software1
Rows per page
Query Builder