PT-2026-103053

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-6170: Improper Neutralization of Input During Web Page Generation

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's btbbcssimagegrid shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This...

PT-2026-103060

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title attribute of the bt bb service shortcode in all versions up to, and including, 5.7.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2026-14876: Improper Neutralization of Input During Web Page Generation

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-6172: Improper Neutralization of Input During Web Page Generation

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of the plugin's btbbimage shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it...

WordPress Smart Slider 3 plugin <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Smart Slider 3 versions = 3.5.1.38...

WordPress HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by kiemtiendinhau in WordPress Plugin HT Mega versions = 3.1.1...

WordPress Bold Page Builder plugin <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Bold Page Builder versions = 5.7.2...

WordPress Bold Page Builder plugin <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Lucas torres Rooting in WordPress Plugin Bold Page Builder versions = 5.7.2...

WordPress Bold Page Builder plugin <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Lucas torres Rooting in WordPress Plugin Bold Page Builder versions = 5.7.2...

WordPress Bold Page Builder plugin <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Lucas torres Rooting in WordPress Plugin Bold Page Builder versions = 5.7.2...

CVE-2026-97319

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-89006

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-89003

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the...

CVE-2026-89001

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to another account, allowing users with contributor-level access and above to publish posts live and set any registered user,...

CVE-2026-85002

The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post...

CVE-2026-97319 PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress PowerPress Podcasting plugin by Blubrry plugin < 11.17.2 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin PowerPress Podcasting versions 11.17.2...

EUVD-2026-87903

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-97319

The PowerPress Podcasting plugin by Blubrry for WordPress, in versions prior to 11.17.2 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitize and escape a block attribute before it is outputted on a page. This flaw allows users with the contributo...