CVE-2026-2422

WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 1.0.5 . The flaw resides in the pbwp_raw_shortcode shortcode handler, which decodes Base64-encoded content and outputs it directly without sanitization or e...

EUVD-2026-71844

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-16654

The Avada (Fusion) Builder WordPress plugin is vulnerable to Stored Cross-Site Scripting via its 'size' shortcode attribute in all versions up to and including 3.15.6 . The root cause is insufficient input sanitization and output escaping: because the injected payload resides entirely within a sh...

PT-2026-60406

The RPB Chessboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 8.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

EUVD-2026-35995

The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'memo' parameter in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above,...

WordPress Cross-Site Scripting Vulnerability (CNVD-2015-05009)

WordPress is a blogging platform developed using the PHP language. Versions of Wordpress prior to 4.2.3 have a cross-site scripting vulnerability in the implementation that allows users with Contributor or Author privileges to exploit this vulnerability to embed well-constructed HTML, JavaScript,...