CVE-2025-68999-POC

CVE-2025-68999 Happy Addons for Elementor prepare, pero luego inserta $entry-metakey directamente en la cadena SQL sin escaparla: root@kitploit: $records = " $duplicatedpostid, '$entry-metakey', '$value' "; // ... $wpdb-query $query ; Dado que metakey proviene de la base de datos, el código lo...

CVE-2026-84028

The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...

CVE-2026-84927

The EmbedPress WordPress plugin (versions 4.6.0–4.6.3 ) contains an insufficient authorization check on a Google Reviews REST API route . Users with the Contributor role or higher can modify the site-wide store, deleting entries configured by an administrator and injecting their own , which are r...

WordPress King Addons for Elementor plugin < 51.1.77 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin King Addons for Elementor versions 51.1.77...

CVE-2026-84022 Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes

The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...

CVE-2026-84021

The Bold Page Builder WordPress plugin versions prior to 5.9.8 contain a stored XSS vulnerability. The root cause is improper validation of a link URL before output in an HTML attribute, relying on a filter that can be evaded. The vulnerable components are the bt_bb_button , bt_bb_headline , and ...

CVE-2026-84021 Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL

The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the...

EUVD-2026-71850

The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata...

CVE-2026-82884 All in One SEO < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant Block

The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privilege...

CVE-2026-82884

The All in One SEO WordPress plugin before 5.0.0.1 fails to sanitise and escape content stored in the ai-assistant Block within posts before rendering it in the post editor. This allows users with the contributor role or higher to inject a Stored Cross-Site Scripting (XSS) payload that executes w...

CVE-2026-82884 All in One SEO < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant Block

The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privilege...

WordPress Live Composer plugin <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via dslcmoduleprojectsoutput Shortcode vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Page Builder: Live Composer versions = 2.1.19...

CVE-2026-14835

CVE-2026-14835 is a Stored XSS vulnerability in the SOGO Add Script to Individual Pages Header Footer WordPress plugin (versions ≤ 3.9 ). The plugin fails to sanitise or escape custom header/footer script values saved from its post metabox and does not restrict input to users with the unfiltered_...

CVE-2026-76546

The User Profile Builder WordPress plugin before 4.0.1 is vulnerable to a Stored XSS via its optional Format Date Shortcode , which fails to escape its output. An attacker with at least the contributor role can inject script that executes when any user—including administrators —views the affected...

CVE-2026-81284 WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

CVE-2026-79615 Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure via IDOR

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other...

WordPress Quiz and Survey Master (QSM) plugin < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure vulnerability

Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Quiz And Survey Master versions 11.2.4...

CVE-2026-19226 Royal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect Settings

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress Betheme plugin <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'iconbox2' Shortcode vulnerability discovered by João Pedro Soares de Alcântara - Kinorth in WordPress Theme Betheme versions = 28.4...

CVE-2026-76613 Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40

Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...