CVE-2026-110290: Improper Neutralization of Input During Web Page Generation

The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'otherattributes parsed to inject instanceid + undeclared iswidget' parameter in all versions up to, and including, 4.5.2 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-93535: Improper Neutralization of Input During Web Page Generation

The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iconlight' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2026-110017: Improper Neutralization of Input During Web Page Generation

The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

PT-2026-115500

Name of the Vulnerable Software and Affected Versions Wp Map Block versions prior to 3.0.1 Description The software contains a flaw allowing unauthorized data modification due to missing capability checks within the set status and bulk functions of the Maps Controller REST controller. The can edi...

CVE-2026-111631: Missing Authorization

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manageoptions users. Attackers can call dtverifyexternalconnection with a chosen endpointId and url to send stored connection...

PT-2026-116030

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage options users. Attackers can call dt verify external connection with a chosen endpointId and url to send stored connection...

CVE-2026-104726: Improper Neutralization of Input During Web Page Generation

The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

PT-2026-116027

10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set meta in includes/utils.php unserializes on the...

PT-2026-115455

Name of the Vulnerable Software and Affected Versions Quick PayPal Payments: Payment Button & Form versions prior to 6.0.5 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can...

PT-2026-115534

Name of the Vulnerable Software and Affected Versions Name Directory versions prior to 1.34.3 Description The Name Directory plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated attackers with...

CVE-2026-77829: Improper Neutralization of Input During Web Page Generation

The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cooked-timer Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-103480: Improper Neutralization of Input During Web Page Generation

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-78087

The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-78001

The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insufficient input sanitization and output escaping. This makes ...

EUVD-2026-101848

The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-78087 VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature

The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-78087

The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.126.1 . The flaw exists in the Group Block 'linkToPost' feature due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-...

EUVD-2026-101838

The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-78001

The Post and Page Builder by BoldGrid (Visual Drag and Drop Editor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.27.13 . The flaw exists in the Table Designer 'data-label' Attribute due to insufficient input sanitization and output esca...

CVE-2026-78087: Improper Neutralization of Input During Web Page Generation

The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...