21720 matches found
CVE-2026-84151 The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening
The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...
CVE-2026-84151
The Post Grid WordPress plugin versions prior to 7.9.5 is vulnerable to HTML injection due to an improper limitation of the WordPress allowed-HTML list. Specifically, the plugin fails to restrict the expansion of this list to its own markup, applying it site-wide. This allows users with the Contr...
EUVD-2026-85800
The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...
WordPress The Post Grid plugin < 7.9.5 - Contributor+ Stored HTML/iframe Injection vulnerability
Contributor+ Stored HTML/iframe Injection vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin The Post Grid versions 7.9.5...
CVE-2026-16302: Exposure of Sensitive Information to an Unauthorized Actor
The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editorassets function, which exposes the uaginstalinkedaccounts option through the uagbblocksinfo object without a capability check. This...
PT-2026-97716
Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.8.26 Description The plugin fails to sanitize and escape content retrieved from a user-supplied source before rendering it. This allows users with contributor-level permissions or higher to execut...
PT-2026-97712
Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description Insufficient validation of a display-style setting allows users with the Contributor role and above to perform Local File Inclusion LFI, which is a technique used to trick a...
PT-2026-97718
Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.8.26 Description The plugin fails to sanitize and escape a campaign configuration field when a specific feature is enabled. This allows users with the Contributor role or higher to perform Stored...
CVE-2026-15731: Improper Neutralization of Input During Web Page Generation
The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post content in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...
CVE-2026-88843: Improper Limitation of a Pathname to a Restricted Directory
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path w...
CVE-2026-89004: Authorization Bypass Through User-Controlled Key
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and run log, allowing users with contributor-level access and above to read the configuration and execution logs of campaigns created by othe...
PT-2026-97717
Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.8.26 Description The plugin fails to verify ownership or authorization before returning a campaign's stored configuration and run log. This allows users with contributor-level access and above to...
CVE-2026-89005: Improper Neutralization of Input During Web Page Generation
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the session ...
WordPress WP Multilang – Translation and Multilingual Plugin plugin <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin WP Multilang versions = 2.4.31...
CVE-2026-94682
Contributor Cross Site Scripting XSS in Podcast Importer SecondLine = 1.5.6 versions...
CVE-2026-94671
Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...
CVE-2026-94684
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False positive detection...
CVE-2026-94500
Contributor Cross Site Scripting XSS in ElementsKit Elementor addons Lite = 4.0.5 versions...