CVE-2026-16654

The Avada (Fusion) Builder WordPress plugin is vulnerable to Stored Cross-Site Scripting via its 'size' shortcode attribute in all versions up to and including 3.15.6 . The root cause is insufficient input sanitization and output escaping: because the injected payload resides entirely within a sh...

EUVD-2026-35995

The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'memo' parameter in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above,...

WordPress Cross-Site Scripting Vulnerability (CNVD-2015-05009)

WordPress is a blogging platform developed using the PHP language. Versions of Wordpress prior to 4.2.3 have a cross-site scripting vulnerability in the implementation that allows users with Contributor or Author privileges to exploit this vulnerability to embed well-constructed HTML, JavaScript,...