CVE-2026-88997

CVE-2026-88997 JSM Show Post Metadata 4.9.1 — Contributor+ Stored XSS via Custom Field Meta Key | ---|--- CVE ID| CVE-2026-88997 Status| PUBLISHED CNA| WPScan Published| 2026-09-23 Updated| 2026-09-23 CWE| CWE-79: Cross-Site Scripting XSS Description The JSM Show Post Metadata WordPress plugin...

CVE-2026-110031 Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key

The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site...

CVE-2026-110031 Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key

The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site...

CVE-2026-110031

The Salon Booking System WordPress plugin versions 10.17 through 10.31.10 is vulnerable to a privilege escalation flaw. Users with the custom salon staff role can assign arbitrary capabilities to other accounts while editing a customer. This vulnerability, caused by a case-insensitive user meta k...

CVE-2026-88997 JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key

The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the...

CVE-2026-88997

The JSM Show Post Metadata WordPress plugin versions before 4.9.1 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the improper escaping of a post meta key before it is outputted into an inline event-handler attribute within an admin-facing meta box. This allows users ...

CVE-2026-88997 JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key

The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the...

EUVD-2026-85052

The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the...

PT-2026-97189

Name of the Vulnerable Software and Affected Versions JSM Show Post Metadata WordPress plugin versions prior to 4.9.1 Description Insufficient escaping of a post meta key before it is output into an inline event-handler attribute within an admin-facing meta box allows users with contributor-level...

PT-2026-81122

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'meta key' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of...

WordPress SmartCrawl plugin < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration vulnerability

Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration vulnerability discovered by Ezekiel Victor in WordPress Plugin SmartCrawl versions 3.16.3...

CVE-2026-16979

The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin, versions before 3.16.3 , contains an authorization bypass vulnerability. The plugin fails to perform capability checks on two of its AJAX actions , which allows users with at least the Subscriber role to read the titles of private...

CVE-2026-16092 Improved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter

The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'metakey' Custom Field via 'Save and Duplicate' Action in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-16092 Improved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter

The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'metakey' Custom Field via 'Save and Duplicate' Action in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

EUVD-2026-50951

The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'metakey' Custom Field via 'Save and Duplicate' Action in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

PT-2026-66347

The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'meta key' Custom Field via 'Save and Duplicate' Action in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-10089 Insert Pages <= 3.11.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Keys (Meta Key Names)

The Insert Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post custom field keys meta key names in all versions up to, and including, 3.11.4. This is due to insufficient output escaping in the themeta function: while the custom field VALUE is sanitized with wpksespost...

EUVD-2026-41249

The Insert Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post custom field keys meta key names in all versions up to, and including, 3.11.4. This is due to insufficient output escaping in the themeta function: while the custom field VALUE is sanitized with wpksespost...

CVE-2026-10089 Insert Pages <= 3.11.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Keys (Meta Key Names)

The Insert Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post custom field keys meta key names in all versions up to, and including, 3.11.4. This is due to insufficient output escaping in the themeta function: while the custom field VALUE is sanitized with wpksespost...

CVE-2026-10089: Improper Neutralization of Input During Web Page Generation

The Insert Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post custom field keys meta key names in all versions up to, and including, 3.11.4. This is due to insufficient output escaping in the themeta function: while the custom field VALUE is sanitized with wpksespost...