WordPress 12 Step Meeting List Plugin <= 3.14.33 - Cross-Site Scripting

Code for Recovery 12 Step Meeting List versions up to 3.14.33 contain a reflected cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in users' browsers, exploit requires attacker to craft a malicious URL. id:...

CVE-2026-4792 Bread <= 2.9.12 - Missing Authorization to Unauthenticated Information Exposure

The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due to the lack of authentication and authorization checks on the settings export functionality downloadsettings function which is registered on the pluginsloaded hook and explicit...

CVE-2026-4792 Bread <= 2.9.12 - Missing Authorization to Unauthenticated Information Exposure

The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due to the lack of authentication and authorization checks on the settings export functionality downloadsettings function which is registered on the pluginsloaded hook and explicit...

PT-2026-95788

Name of the Vulnerable Software and Affected Versions Bread plugin for WordPress versions prior to 2.9.13 Description Information exposure occurs due to missing authentication and authorization checks in the settings export functionality. The download settings function, registered on the plugins...

WordPress 12 Step Meeting List plugin 3.17-3.19.16 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Huseyn in WordPress Plugin 12 Step Meeting List versions 3.17-3.19.16...

CVE-2026-78333 12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high...

EUVD-2026-66885

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high...

CVE-2026-78333

The 12 Step Meeting List WordPress plugin (versions 3.17-3.19.16 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitize and escape values submitted by unauthenticated users before storing them in the activity log and subsequently outputting them in the ad...

PT-2026-82431

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high...

CVE-2026-78333: Improper Neutralization of Input During Web Page Generation

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high...

12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log

Description The plugin does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin. PoC...

CVE-2026-66584

Unauthenticated Cross Site Scripting XSS in 12 Step Meeting List = 3.19.16 versions...

CVE-2026-66584

An unauthenticated Cross-Site Scripting (XSS) vulnerability affects the WordPress plugin 12 Step Meeting List in versions 3.19.16 and earlier , as reported by researcher V1T via PatchStack. The CVSS 3.1 base score is 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating a ne...

EUVD-2026-64830

Unauthenticated Cross Site Scripting XSS in 12 Step Meeting List = 3.19.16 versions...

CVE-2026-66584 WordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in 12 Step Meeting List = 3.19.16 versions...

CVE-2026-66584: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in 12 Step Meeting List = 3.19.16 versions...

12 Step Meeting List < 3.19.17 - Unauthenticated Stored Cross-Site Scripting

Description The 12 Step Meeting List plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.19.16. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2026-80805

Unauthenticated Cross Site Scripting XSS in 12 Step Meeting List = 3.19.16 versions...

WordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin 12 Step Meeting List versions = 3.19.16...

CVE-2026-39569

Missing Authorization vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 12 Step Meeting List: from n/a through = 3.19.9...