CVE-2026-122222

The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slug' parameter in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level acces...

EUVD-2026-118024

The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slug' parameter in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level acces...

CVE-2026-122222

The Permalink Manager Lite plugin for WordPress (versions ¢= 2.6.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the 'slug' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with Author-level access or higher can submit a p...

CVE-2026-122222 Permalink Manager Lite <= 2.6.1 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug

The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slug' parameter in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level acces...

WordPress Permalink Manager Lite plugin <= 2.6.1 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Permalink Manager Lite versions = 2.6.1...

WordPress Frontend Post Submission Manager Lite 1.2.7 Open Redirect

WordPress Frontend Post Submission Manager Lite versions through 1.2.7 contain an unauthenticated open redirect through the requestedpage POST parameter. A proof of concept is included. https://packetstorm.news/download/238055...

Exploit for CVE-2026-1296

CVE-2026-1296 — Frontend Post Submission Manager Lite Proof...

CVE-2026-97239

Subscriber Broken Access Control in MCP Content Manager Lite = 1.1.0 versions...

CVE-2026-97239 WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in MCP Content Manager Lite = 1.1.0 versions...

CVE-2026-97239 WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in MCP Content Manager Lite = 1.1.0 versions...

EUVD-2026-89903

Subscriber Broken Access Control in MCP Content Manager Lite = 1.1.0 versions...

CVE-2026-97239

The WordPress MCP Content Manager Lite plugin (versions

WordPress Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms plugin <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin Frontend Post Submission Manager Lite versions = 1.3.4...

CVE-2026-96649

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via postcontent Parameter data-label DOM Sink in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output...

CVE-2026-96649

The Frontend Post Submission Manager Lite WordPress plugin is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in versions up to and including 1.3.4 . The flaw stems from insufficient input sanitization and output escaping of the post_content parameter, specifically utilizing a data-labe...

CVE-2026-96649 Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via postcontent Parameter data-label DOM Sink in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output...

EUVD-2026-89577

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via postcontent Parameter data-label DOM Sink in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output...

CVE-2026-96649 Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via postcontent Parameter data-label DOM Sink in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output...

CVE-2026-97239: Missing Authorization

Subscriber Broken Access Control in MCP Content Manager Lite = 1.1.0 versions...

CVE-2026-96649: Improper Neutralization of Input During Web Page Generation

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via postcontent Parameter data-label DOM Sink in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output...