EUVD-2026-102659

The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-93535

The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iconlight' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2026-77829

The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cooked-timer Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-102610

The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cooked-timer Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-77829 Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content

The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cooked-timer Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-102609

The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iconlight' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2026-77829

The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.16.1 . The root cause is insufficient input sanitization and output escaping within the [cooked-timer] shortcode content . This allows authenticated attacke...

CVE-2026-93535 WP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute

The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iconlight' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2026-93535

The WP Dark Mode – Improve Accessibility with AI Powered Dark Theme WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.3.17 . The root cause is insufficient input sanitization and output escaping within the 'icon_light' Shortcode Attribute . ...

PT-2026-115500

Name of the Vulnerable Software and Affected Versions Wp Map Block versions prior to 3.0.1 Description The software contains a flaw allowing unauthorized data modification due to missing capability checks within the set status and bulk functions of the Maps Controller REST controller. The can edi...

PT-2026-115534

Name of the Vulnerable Software and Affected Versions Name Directory versions prior to 1.34.3 Description The Name Directory plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated attackers with...

PT-2026-115455

Name of the Vulnerable Software and Affected Versions Quick PayPal Payments: Payment Button & Form versions prior to 6.0.5 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can...

PT-2026-116030

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage options users. Attackers can call dt verify external connection with a chosen endpointId and url to send stored connection...

PT-2026-116027

10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set meta in includes/utils.php unserializes on the...

CVE-2026-78087

The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-78001

The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-78087

The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.126.1 . The flaw exists in the Group Block 'linkToPost' feature due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-...

EUVD-2026-101848

The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-78087 VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature

The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-78001

The Post and Page Builder by BoldGrid (Visual Drag and Drop Editor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.27.13 . The flaw exists in the Table Designer 'data-label' Attribute due to insufficient input sanitization and output esca...