569 matches found
CVE-2026-97342
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible...
EUVD-2026-91250
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible...
CVE-2026-97342
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.6.5.4 . The root cause is insufficient input sanitization and output escaping within the 'choice' Post Meta via the Insert/Update Post Act...
CVE-2026-96567 MW WP Form <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter (via stored form-submitted post meta)
The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postid' parameter in all versions up to, and including, 5.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...
WordPress Motors plugin < 1.4.124 - Subscriber+ Cross-User Post Meta Modification vulnerability
Subscriber+ Cross-User Post Meta Modification vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Motors versions 1.4.124...
PT-2026-104150
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible...
CVE-2026-91051
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
EUVD-2026-89618
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
CVE-2026-91051 EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
CVE-2026-91051
The EWWW Image Optimizer WordPress plugin versions before 8.8.0 (specifically versions 8.6.0 - 8.7.7 ) is vulnerable to PHP Object Injection . Authenticated users with author-level permissions can store a serialized value in a post meta field (specifically 'eio_page_settings' ). When the post is ...
CVE-2026-91051 EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
CVE-2026-87071 Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their...
CVE-2026-87071 Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their...
WordPress Forminator Forms plugin < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts vulnerability
Unauthenticated Post Meta Injection on Submitted Posts vulnerability discovered by Dion Mulaj in WordPress Plugin Forminator versions 1.57.2.1...
CVE-2026-93508
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...
CVE-2026-93508
The WC Fields Factory WordPress plugin, in versions prior to 4.1.11 , is vulnerable to unauthorized access because it fails to properly restrict its field-management AJAX action . This flaw allows authenticated users with Subscriber-level access or higher to perform unauthorized actions, includin...
CVE-2026-93508 WC Fields Factory < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation via AJAX
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...
WordPress WC Fields Factory plugin < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation vulnerability
Subscriber+ Arbitrary Post Meta Manipulation vulnerability discovered by Farid Narimanov in WordPress Plugin WC Fields Factory versions 4.1.11...
EUVD-2026-85061
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...
CVE-2026-93508 WC Fields Factory < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation via AJAX
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...