CVE-2026-19775

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 1.1.7 . The root cause is the plugin's failure to properly verify user authorization before performing certain actions. This flaw a...

CVE-2026-96766 GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businesshours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This make...

CVE-2026-96766

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress are vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.8.183 . The root cause is insufficient input sanitization and output escaping within the business_hours ...

EUVD-2026-86541

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businesshours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This make...

CVE-2026-96766 GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businesshours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This make...

CVE-2026-93899

The Better Messages plugin for WordPress (all versions up to and including 3.0.4 ) is vulnerable to a generic SQL Injection via the 'group_id' Message Meta Parameter. The root cause is insufficient escaping of the user-supplied parameter and a lack of sufficient preparation on the existing SQL qu...

CVE-2026-93899 Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'groupid' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of...

EUVD-2026-86537

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'groupid' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-93899 Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'groupid' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-93897

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress are vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.8.181 . The root cause is insufficient input sanitization and output escaping when processing text-type ...

CVE-2026-93897 GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field e.g., 'phone' in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. Th...

EUVD-2026-86533

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field e.g., 'phone' in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. Th...

CVE-2026-93897 GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field e.g., 'phone' in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. Th...

EUVD-2026-86528

The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including...

CVE-2025-14814

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-14814 CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-14814

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 12.0.6 . The root cause is insufficient input sanitization and output escaping on user-supplied attributes within the cjtoolbox shortcode . This allows authenti...

CVE-2025-14814 CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

EUVD-2025-211000

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2026-98348

Name of the Vulnerable Software and Affected Versions CSS & JavaScript Toolbox versions prior to 12.0.7 Description Stored Cross-Site Scripting occurs via the cjtoolbox shortcode due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with...