Membership Database <= 1.0 - Cross-Site Scripting

Membership Database before 1.0 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker t...

wpForo Forum <= 2.1.8 - Cross-Site Scripting

The wpForo Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpforodebug’ function in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting

The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.4.6. The issue arises due to insufficient input sanitization and output escaping in the rendercontent method of class-search-result-title.php, which outputs...

CVE-2024-10793

CVE-2024-10793 CVE-2024-10793 poc exploit CVE-2024-10793.yaml script is needed to search for a plugin. CVE-2024-10793.sh script is the exploit itself. For post-exploitation, you can use beef-xss. Google dork: inurl:wp-content/plugins/wp-security-audit-log The WP Activity Log plugin for WordPress ...

CVE-2025-0924-different

Other Vulnerabilities Discovered During CVE-2025-0924 Analysis 01. Overview of Stored XSS and WordPress, WP Activity Log 1 Overview of Stored XSS and WordPress, WP Activity Log Stored XSS is a type of vulnerability where a malicious script is stored on the server and later automatically executed...

CVE-2026-2002-poc

Sumary The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the formname parameter in all versions up to, and including, 1.50.2 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2024-4439

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ CVE-2024-4439...

CVE-2024-52318

CVE-2024-52318 🚨🚨CVE-2024-52318 - Apache Tomcat XSS Vulnerability in Generated JSPs🚨🚨 Overview CVE-2024-52318 is a crosssite scripting XSS vulnerability in Apache Tomcat, which arises from improperly released resources in generated JavaServer Pages JSPs. This issue, introduced by a prior...

rcno-reviews

Recencio Book Reviews A WordPress plugin for managing and displaying book reviews. Custom post type, 7 taxonomies, 13 shortcodes, 7 widgets, 6 templates, 5 extensions. All data stored in standard WordPress post meta — no custom tables. Background Recencio Book Reviews was created by Kemory Grubb...

EUVD-2026-103215

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tokenid' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-116365

Name of the Vulnerable Software and Affected Versions User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress versions prior to 5.2.9 Description Stored Cross-Site Scripting occurs du...

CVE-2026-107648

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action also function, plugin, posttype, poststatus, ids, loggedout, and POST posttitle' parameter in all versions up to, and including, 1.1.5 due to insufficient input...

EUVD-2026-102843

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action also function, plugin, posttype, poststatus, ids, loggedout, and POST posttitle' parameter in all versions up to, and including, 1.1.5 due to insufficient input...

CVE-2026-107648 WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action also function, plugin, posttype, poststatus, ids, loggedout, and POST posttitle' parameter in all versions up to, and including, 1.1.5 due to insufficient input...

CVE-2026-87111

The User Registration PRO WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.2.9 . The flaw exists in the premium build of the plugin due to insufficient input sanitization and output escaping when handling the HTTP Referer Header . Unauthent...

CVE-2026-109193

The HivePress – Business Directory, Listings & Classified Ads Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.7.32 . The root cause is insufficient input sanitization and output escaping of the parameter (e.g., hp_custom_link). An unauthe...

CVE-2026-110701

The CP Multi View Events Calendar plugin for WordPress (versions up to and including 1.4.42 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'CalendarTitle' parameter. The root cause is insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitra...

CVE-2026-89051

The WP Ghost Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to, and including, 7.0.12 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-111122

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-96570 Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswpreviewtext' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...