21908 matches found
CVE-2025-9878 Password Protect WordPress Lite <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppwp' shortcode in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied...
CVE-2025-9878 Password Protect WordPress Lite <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppwp' shortcode in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied...
WordPress PPWP – Password Protect Pages plugin <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin PPWP versions = 1.9.21...
CVE-2025-9878
PPWP – Password Protect WordPress (a WordPress plugin) is vulnerable to Stored Cross-Site Scripting (XSS) via the plugin's ppwp shortcode in all versions up to and including 1.9.21 . The root cause is insufficient input sanitization and output escaping on user-supplied shortcode attributes. An au...
CVE-2026-15023 Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'metakey' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of...
WordPress Events Manager – Calendar, Bookings, Tickets, and more! plugin <= 7.4.0 - Authenticated (Contributor+) SQL Injection vulnerability
Authenticated Contributor+ SQL Injection vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Events Manager versions = 7.4.0...
PT-2026-81162
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insufficient input sanitization and output...
CVE-2026-75019: Improper Neutralization of Input During Web Page Generation
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insufficient input sanitization and output...
PT-2026-81160
The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppwp' shortcode in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied...
PT-2026-81167
The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-18100: Improper Neutralization of Input During Web Page Generation
The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mfformid' Widget Setting in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output escaping. This makes it...
PT-2026-81188
The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mf form id' Widget Setting in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-76128: Improper Neutralization of Input During Web Page Generation
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-78290
Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.6 versions...
CVE-2026-78269
Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...
CVE-2026-78290
CVE-2026-78290 is a Contributor-level Cross-Site Scripting (XSS) vulnerability in the WordPress Magazine Blocks plugin , affecting versions ≤ 1.8.6 . The vulnerability requires a user with Contributor privileges and user interaction, with a Changed Scope impact (CVSS 3.1 base score 6.5 MEDIUM ). ...
EUVD-2026-64788
Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.6 versions...
CVE-2026-78290 WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.6 versions...