7484 matches found
CVE-2026-84752 WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability
Contributor PHP Object Injection in RTMKit = 2.1.5 versions...
CVE-2026-84752
CVE-2026-84752 affects the WordPress RTMKit plugin (Rometheme for Elementor) in versions 2.1.5 and earlier . The vulnerability is a PHP Object Injection that can be exploited by a user with Contributor privileges, resulting in high impact on confidentiality, integrity, and availability (CVSS 8.8 ...
EUVD-2026-70590
Contributor PHP Object Injection in RTMKit = 2.1.5 versions...
CVE-2026-2573
The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘postBodyCss’ parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This mak...
CVE-2024-3293-Poc
CVE-2024-3293-Poc rtMedia for WordPress, BuddyPress and bbPress get \buddypress-media\app\helper\RTMediaModel.php:61 RTMediaModel-getmedia \buddypress-media\app\helper\RTMediaModel.php:227 RTMediaQuery-populatemedia \buddypress-media\app\main\routers\query\RTMediaQuery.php:869...
CVE-2026-3852 Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the skypeurl shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6. This is due to a three-part sanitization failure: 1 the skypeurl field is not included in the $urloptions...
CVE-2024-3105-PoC
CVE-2024-3105 PoC Плагин Woody Code Snippets – Insert Header Footer Code, AdSense Ads для WordPress уязвим к удаленному выполнению кода во всех версиях до 2.5.0 включительно через шорткод 'insertphp'. Это связано с тем, что плагин не ограничивает использование этой функциональности только для...
CVE-2026-2573 GutenKit <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss'
The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘postBodyCss’ parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This mak...
CVE-2026-2573
The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the postBodyCss parameter in all versions up to and including 2.4.4 . The root cause is insufficient input sanitization and output escapin...
EUVD-2026-70316
The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘postBodyCss’ parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This mak...
CVE-2026-2600-POC
CVE-2026-2600 ElementsKit Elementor Addons = 3.7.9 — 인증된Contributor+ 저장형 교차 사이트 스크립팅Stored Cross-Site Scripting...
CVE-2026-28134
CVE-2026-28134 エクスプロイト報告書 JetEngine = 3.7.2 — Twig SSTI による認証済み（Contributor+）リモートコード実行 日付: 2026年3月11日 CVSSスコア: 8.8（高） CVSSベクター: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 影響を受けるプラグイン: JetEngine = 3.7.2 プラグインスラッグ: jet-engine CVE: CVE-2026-28134 ステータス: 非公開 テスト済みWordPressバージョン: 最新 エグゼクティブサマリー...
WordPress Divi theme <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Theme Divi versions = 4.27.6...
CVE-2026-83547
Xpro Addons (WordPress plugin) versions 1.6.0 through 1.7.3 are vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is that certain widget settings are not properly escaped before being rendered within HTML attributes . An attacker with the Contributor role or higher can inject malic...
CVE-2026-83547 Xpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple Widgets
The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2026-84781
Contributor Cross Site Scripting XSS in Gallery PhotoBlocks = 1.3.4 versions...
EUVD-2026-69934
Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...
CVE-2026-83562 WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...
CVE-2026-84781
CVE-2026-84781 is a Contributor-level Cross Site Scripting (XSS) vulnerability in the WordPress Gallery PhotoBlocks plugin, affecting versions ≤ 1.3.4 . The flaw was discovered by V1T via Patchstack. An attacker with at least Contributor privileges can inject malicious scripts that execute in ano...