CVE-2026-88788

The Text Styler WordPress plugin (versions through 1.1.1 ) contains a Stored XSS vulnerability. The root cause is a failure to sanitize and escape user-supplied styling values before they are outputted within a front-end style block, combined with a lack of verification regarding a user's permiss...

WordPress Text Styler plugin <= 1.1.1 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin Text Styler versions = 1.1.1...

CVE-2026-88788 Text Styler <= 1.1.1 - Contributor+ Stored XSS

The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does not verify that a user may edit the target post, allowing users with contributor-level access or above to store JavaScript that...

PT-2026-96674

Name of the Vulnerable Software and Affected Versions WP-CRM System – Manage Clients and Projects versions prior to 3.4.7 Description Authenticated attackers with contributor-level access and above can extract sensitive data from arbitrary CRM contact records. This is achieved by enumerating the...

CVE-2026-88788: Improper Neutralization of Input During Web Page Generation

The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does not verify that a user may edit the target post, allowing users with contributor-level access or above to store JavaScript that...

CVE-2026-16778: Improper Neutralization of Input During Web Page Generation

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslcmoduledownloadsoutput' Shortcode Content in all versions up to, and including, 2.1.21 due to insufficient input sanitization and output escaping. This makes it possible fo...

PT-2026-96661

Name of the Vulnerable Software and Affected Versions Live Composer – Free WordPress Website Builder versions prior to 2.1.22 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the dslc module downloads output shortcode content...

PT-2026-96684

Name of the Vulnerable Software and Affected Versions WP Travel Engine – Tour Booking Plugin – Tour Operator Software versions prior to 6.8.1 Description The plugin contains a Local File Inclusion flaw, which occurs when an application includes a file without properly validating the input, allowi...

CVE-2026-9004: Exposure of Sensitive Information to an Unauthorized Actor

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contactid' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract...

WordPress WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion vulnerability

Authenticated Contributor+ Local File Inclusion vulnerability discovered by 0xQRx in WordPress Plugin WP Travel Engine versions = 6.8.0...

WordPress WP-CRM System – Manage Clients and Projects plugin <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information vulnerability

Authenticated Contributor+ Exposure of Sensitive Information vulnerability discovered by Teerachai Somprasong in WordPress Plugin WP-CRM System versions = 3.4.7...

CVE-2026-81652

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in...

CVE-2026-14844

The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script context, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when the...

EUVD-2026-83660

The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script context, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when the...

CVE-2026-14844

The Master Slider WordPress plugin (versions through 3.11.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitize and escape certain shortcode attributes before they are output in an inline script context . This allows users with Contributor roles or hig...

EUVD-2026-83664

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in...

CVE-2026-14844 Master Slider <= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode Attributes

The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script context, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when the...

CVE-2026-14844 Master Slider <= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode Attributes

The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script context, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when the...

WordPress Photo Gallery, Sliders, Proofing and Themes plugin < 4.5.0 - Contributor+ Image Metadata Disclosure vulnerability

Contributor+ Image Metadata Disclosure vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin NextGEN Gallery versions 4.5.0...

CVE-2026-81652

The NextGEN Gallery (Photo Gallery, Sliders, Proofing and Themes) WordPress plugin before version 4.5.0 is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The application fails to verify if a requesting user is entitled to a specific image record before returning it. This allows us...