CVE-2026-112111

The Bootstrap Shortcodes plugin for WordPress (versions before 3.4.6 ) is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The root cause is located in the bs_tcontent() handler within inc/bs_tabs.php, which emits the id attribute into an unquoted HTML attribute. Whil...

PT-2026-117162

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bs tcontent shortcode. The bs tcontent shortcode handler in inc/bs tabs.php emits the id attribute value into an unquoted HTML attribute. esc attr is applied, but it does not encode...

CVE-2026-104122

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks...

CVE-2026-91074

The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator...

CVE-2026-104122 Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks...

CVE-2026-104122

The Ukr-To-Lat WordPress plugin, in versions through 1.3.5 , is vulnerable to SQL injection due to a failure to sanitize and escape a term name before utilizing it in a SQL query. This flaw allows users with Contributor-level access and above to execute unauthorized SQL commands. No specific reme...

EUVD-2026-103254

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks...

CVE-2026-104122 Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks...

CVE-2026-109985

The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-111726 Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-leve...

CVE-2026-111726 Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-leve...

CVE-2026-109985

The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.4.2 . The root cause is insufficient input sanitization and output escaping involving the 'content' parameter . This a...

CVE-2026-109985 xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' Parameter

The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-103220

The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-109985 xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' Parameter

The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-116367

Name of the Vulnerable Software and Affected Versions Ukr-To-Lat versions prior to 1.3.6 Description Users with Contributor-level access and above can perform SQL injection attacks because the plugin fails to sanitize and escape a term name before incorporating it into a SQL query. Recommendation...

PT-2026-116358

Name of the Vulnerable Software and Affected Versions xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN versions prior to 1.4.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored...

PT-2026-116373

Name of the Vulnerable Software and Affected Versions BSK PDF Manager versions prior to 3.8.2 Description Authenticated users with contributor-level access and above can perform SQL injection attacks due to improper sanitization and escaping of a parameter used in a SQL statement. This issue occu...

CVE-2026-111628

10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which setmeta in includes/utils.php unserializes on the...

EUVD-2026-103053

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manageoptions users. Attackers can call dtverifyexternalconnection with a chosen endpointId and url to send stored connection...