CVE-2026-112111

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bstcontent shortcode. The bstcontent shortcode handler in inc/bstabs.php emits the id attribute value into an unquoted HTML attribute. escattr is applied, but it does not encode spac...

PT-2026-117162

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bs tcontent shortcode. The bs tcontent shortcode handler in inc/bs tabs.php emits the id attribute value into an unquoted HTML attribute. esc attr is applied, but it does not encode...

CVE-2026-103425

The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.7.29 . The flaw stems from insufficient input sanitization and output escaping regarding the 'id' parameter (specifically via a shortcode attribute). This allows authentic...

CVE-2026-14877

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and including, 1.12.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-14877

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.12.03 . The root cause is insufficient input sanitization and output escaping within the id attribute of the table component. This flaw allows authe...

EUVD-2026-96111

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and including, 1.12.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-14877: Improper Neutralization of Input During Web Page Generation

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and including, 1.12.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-75980

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-75980 BetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-75980 BetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-75980: Improper Neutralization of Input During Web Page Generation

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...

PT-2026-84117

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...

WordPress BetterDocs plugin <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin BetterDocs versions = 4.8.1...

EUVD-2026-65460

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support DOM Gadget via id Attribute in all versions up to, and including, 2.12....

CVE-2026-18547 Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support DOM Gadget via id Attribute in all versions up to, and including, 2.12....

CVE-2026-18547: Improper Neutralization of Input During Web Page Generation

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support DOM Gadget via id Attribute in all versions up to, and including, 2.12....

PT-2026-81267

Name of the Vulnerable Software and Affected Versions The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin versions prior to 2.12.2 Description Stored Cross-Site Scripting occurs via the Textarea Profile Field with HTML Support due to...

CVE-2026-59710

Showdown (the Showdown library) contains a stored XSS flaw in parseHeaders (src/subParsers/makehtml/tables.js) where table header ID attributes are not properly escaped. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in Markdown table headers...

CVE-2026-59710 showdown - Stored XSS via Unescaped Table Header ID Attribute Injection

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdo...

PT-2026-55958

The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page id' shortcode attribute of the fbrev shortcode in versions up to and including 2.7.3. This is due to insufficient input sanitization and output escaping in the Feed...