CVE-2026-119097

The Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 4.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

CVE-2026-119097 Author Image <= 4.9.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter

The Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 4.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

CVE-2026-119097

The Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.9.3 . The root cause is insufficient input sanitization and output escaping related to the 'display_name' parameter . An authenticated attacker with subscriber-level acce...

EUVD-2026-123364

The Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 4.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

CVE-2026-119097: denis-de-bernardy Author Image: The Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in…

The Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 4.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

CVE-2026-119165

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname / nickname' parameter in all versions up to, and including, 9.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-119165

The WPBakery Page Builder plugin for WordPress (versions up to and including 9.0.1 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is insufficient input sanitization and output escaping of the 'display_name / nickname' parameter. An authenticated attacker with Subscrib...

CVE-2026-119165 WPBakery Page Builder <= 9.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display Name

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname / nickname' parameter in all versions up to, and including, 9.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-118564

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname / nickname' parameter in all versions up to, and including, 9.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-116551

The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 8.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-116551 WP Customer Area <= 8.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter

The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 8.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

EUVD-2026-118192

The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 8.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-116551

The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 8.4.0 . The flaw stems from insufficient input sanitization and output escaping of the display_name parameter. An authenticated attacker with subscriber-level access or...

CVE-2026-120550

The WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name REST users endpoint - wpusers.displayname' parameter in all versions up to, and including, 2.10.2 due to insufficient input...

CVE-2026-120550

The WP User Manager plugin for WordPress (versions up to and including 2.10.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping in the name parameter of the REST users endpoint (wp_users.display_name). This allows authenti...

CVE-2026-116551: aguilatechnologies WP Customer Area: The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter…

The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 8.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-121432

AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay displayname values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and...

CVE-2026-121432 AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist

AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay displayname values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and...

CVE-2026-121432 AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist

AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay displayname values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and...

CVE-2026-121432

AzuraCast versions prior to 0.24.0 are vulnerable to a CRLF injection vulnerability. The issue exists because the application fails to properly neutralize CR/LF sequences within mount or remote relay display_name values. Low-privilege station users possessing Station:MountPoints or Station:Remote...