CVE-2026-114741

The WPVR WordPress plugin versions prior to 9.0.3 is vulnerable to an Insecure Direct Object Reference (IDOR) . The software fails to perform object-level authorization checks when reading or updating virtual tours. This flaw allows users with contributor-level access or higher to unauthorizedly ...

CVE-2026-114742

The WPVR WordPress plugin (versions 8.3.0 - 9.0.2 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The software fails to perform object-level ownership checks when updating virtual tours. This allows users with contributor-level access and above to modify, reconfigure, and publ...

EUVD-2026-109265

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the /ablocks/v1/form-builder/registration REST endpoint. The vulnerability exists...

CVE-2026-110018

The aBlocks plugin for WordPress (versions up to and including 2.17.0 ) is vulnerable to Privilege Escalation via the /ablocks/v1/form-builder/registration REST endpoint. The flaw stems from the endpoint using permission_callback => __return_true and failing to verify that the block's formType...

CVE-2026-109933

The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including...

CVE-2026-109933 Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes

The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including...

EUVD-2026-108586

The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including...

CVE-2026-109933

The Otter Blocks WordPress plugin, in versions prior to 3.2.8 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the insufficient sanitization and escaping of user-supplied block styling values before they are written into an inline stylesheet . This allows users with ...

PT-2026-121759

The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including...

CVE-2026-114570

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts i...

CVE-2026-114570 WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts i...

EUVD-2026-108007

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts i...

CVE-2026-114570 WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts i...

CVE-2026-114570

WordPress Core versions up to and including 7.0.2 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the insufficient escaping of user display names within the Quick Edit functionality. An authenticated attacker with Contributor-level access or higher can inject arbitra...

PT-2026-121274

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts i...

EUVD-2026-104011

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bstcontent shortcode. The bstcontent shortcode handler in inc/bstabs.php emits the id attribute value into an unquoted HTML attribute. escattr is applied, but it does not encode spac...

CVE-2026-112111

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bstcontent shortcode. The bstcontent shortcode handler in inc/bstabs.php emits the id attribute value into an unquoted HTML attribute. escattr is applied, but it does not encode spac...

CVE-2026-112111

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bstcontent shortcode. The bstcontent shortcode handler in inc/bstabs.php emits the id attribute value into an unquoted HTML attribute. escattr is applied, but it does not encode spac...

CVE-2026-112111

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bstcontent shortcode. The bstcontent shortcode handler in inc/bstabs.php emits the id attribute value into an unquoted HTML attribute. escattr is applied, but it does not encode spac...

CVE-2026-112111

The Bootstrap Shortcodes plugin for WordPress (versions before 3.4.6 ) is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The root cause is located in the bs_tcontent() handler within inc/bs_tabs.php, which emits the id attribute into an unquoted HTML attribute. Whil...