1125416 matches found
CVE-2026-14234 WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF
The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in...
EUVD-2026-50120
The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in...
CVE-2026-14234
This entry describes a stored XSS vulnerability in the WOLF WordPress plugin before version 1.1.0. The issue arises because an AJAX action does not perform a nonce or capability check, allowing an unauthenticated attacker to trick a logged-in administrator into posting arbitrary content, includin...
CVE-2026-13605
The vulnerability CVE-2026-13605 affects the PhotoSwipe WordPress plugin up to version 4.1.1.1. The root cause is that the plugin uses the title attribute from author-provided link markup as a lightbox caption and writes it into the DOM without escaping. Because the title survives post-content sa...
CVE-2026-13605 Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute
The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfilteredhtml...
CVE-2026-15735
The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapiformfield' Post Meta in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-17161
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filterMobileText' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible fo...
CVE-2026-12939
The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the postthumbnail and newsletterspostthumbnail shortcodes in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postthumbnai...
CVE-2026-17162
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-17161
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filterMobileText' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible fo...
CVE-2026-17161
The CVE-2026-17161 entry documents a Stored Cross-Site Scripting vulnerability in the WowStore – Store Builder & Product Blocks for WordPress plugin. Affected: WordPress plugin WowStore (Product Blocks) up to version 4.4.24. Vulnerable component: the filterMobileText Block Attribute; root cause i...
CVE-2026-17161 WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filterMobileText' Block Attribute
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filterMobileText' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible fo...
CVE-2026-17162 WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-17162
The CVE concerns WowStore – Store Builder & Product Blocks for WooCommerce (WordPress). It describes a Stored Cross-Site Scripting vulnerability via the currentPostId Block Attribute, affecting all versions up to and including 4.4.24 due to insufficient input sanitization and output escaping. Exp...
CVE-2026-17162
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-50099
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-50100
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filterMobileText' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible fo...
CVE-2026-12939
The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the postthumbnail and newsletterspostthumbnail shortcodes in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postthumbnai...
CVE-2026-12939 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute
The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the postthumbnail and newsletterspostthumbnail shortcodes in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postthumbnai...
EUVD-2026-50096
The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the postthumbnail and newsletterspostthumbnail shortcodes in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postthumbnai...