CVE-2026-118438

The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affecte...

CVE-2026-118438

The Firelight Lightbox WordPress plugin, in versions before 2.3.24 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly escape image attribute values (specifically the src attribute) before processing them in the browser. This flaw allows users with con...

EUVD-2026-114586

The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affecte...

CVE-2026-118438: Unknown Firelight Lightbox: The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing…

The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affecte...

CVE-2026-118698

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-118500

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'elementordata.formfields.customid' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-118634

The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acces...

EUVD-2026-113716

The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts function in versions up to, and including, 12.0.0. The handler verifies a static nonce 'contenteggmetabox' and the generic 'editposts'...

CVE-2026-118500 Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'elementordata.formfields.customid' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-118634 Events Made Easy <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute

The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acces...

CVE-2026-118500

The Cool FormKit Lite – Advanced Form Builder for Elementor WordPress plugin (versions ≤ 2.7.9 ) is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the _elementor_data.form_fields[].custom_id parameter. An attack...

CVE-2026-118634

The Events Made Easy plugin for WordPress (versions up to and including 3.3.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw stems from insufficient input sanitization and output escaping related to the 'width' shortcode attribute . An authenticated attacker with Contributor-leve...

CVE-2026-118500 Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'elementordata.formfields.customid' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. Thi...

EUVD-2026-113714

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'elementordata.formfields.customid' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-118634 Events Made Easy <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute

The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acces...

EUVD-2026-113715

The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acces...

CVE-2026-118698 JoomSport <= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-118698

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress (versions up to and including 5.7.14 ) is vulnerable to a SQL Injection flaw. The root cause is insufficient escaping of the user-supplied pgroup parameter and a lack of proper preparation on the existing SQL ...

CVE-2026-118192

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'teamid' parameter in all versions up to, and including, 5.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-104727

The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...