16410 matches found
EUVD-2026-59588
The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...
PT-2026-72881
Name of the Vulnerable Software and Affected Versions Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! versions prior to 3.7.2 Description Authenticated attackers with contributor-level access and above can achieve remote code execution via the fetc...
WordPress Embed Google Photos Album Easily plugin <= 2.2.1 - Contributor+ Stored XSS via link Shortcode Attribute vulnerability
Contributor+ Stored XSS via link Shortcode Attribute vulnerability discovered by testoun in WordPress Plugin Embed Google Photos album versions = 2.2.1...
WordPress Royal Elementor Addons plugin < 1.7.1065 - Contributor+ Stored XSS via Icon Box Widget vulnerability
Contributor+ Stored XSS via Icon Box Widget vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Royal Elementor Addons versions 1.7.1065...
CVE-2026-14290
The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including...
EUVD-2026-58595
The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including...
CVE-2026-14290 Embed Google Photos Album Easily <= 2.2.1 - Contributor+ Stored XSS via link Shortcode Attribute
The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including...
CVE-2026-14290
CVE-2026-14290 concerns the WordPress plugin “Embed Google Photos album” (versions
CVE-2026-14290
The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including...
Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL
Description The theme does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post. Po...
Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL
Description The theme does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post...
CVE-2026-73340
Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...
EUVD-2026-57909
Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...
CVE-2026-73340 WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...
CVE-2026-73340
The CVE covers a Cross Site Scripting (XSS) vulnerability in the WordPress plugin Featured Image from URL , affecting versions
CVE-2026-3639
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...
CVE-2026-3639 PPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...
CVE-2026-3639 PPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...
WordPress Eventin plugin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR vulnerability
Contributor+ Order Information Disclosure via IDOR vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.20...