CVE-2026-5116 Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page...

CVE-2026-17532

Summary: CVE-2026-17532 affects the Seraphinite Accelerator WordPress plugin (≤ 2.29.15). It allows unauthenticated users to perform a reflected XSS via the seraph_accel_prep parameter. Root cause per the CVE description: a loose PHP comparison in CacheExtractPreparePageParams() (using != against...

CVE-2026-5116

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page...

CVE-2026-5108

The CVE concerns the WordPress plugin Super Progressive Web Apps (versions

CVE-2026-5108

The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the superpwasettingsofflinemessagetxt setting in all versions up to, and including, 2.2.43. This is due to insufficient input sanitization and output escaping. The offline message value is stored...

CVE-2026-5108 Super Progressive Web Apps <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting

The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the superpwasettingsofflinemessagetxt setting in all versions up to, and including, 2.2.43. This is due to insufficient input sanitization and output escaping. The offline message value is stored...

CVE-2026-5108 Super Progressive Web Apps <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting

The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the superpwasettingsofflinemessagetxt setting in all versions up to, and including, 2.2.43. This is due to insufficient input sanitization and output escaping. The offline message value is stored...

EUVD-2026-53169

The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the superpwasettingsofflinemessagetxt setting in all versions up to, and including, 2.2.43. This is due to insufficient input sanitization and output escaping. The offline message value is stored...

CVE-2026-8790

The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the shouttext POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce...

CVE-2026-16143

The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the...

CVE-2025-15677

The GeoDirectory WordPress plugin versions before 2.8.110 is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to properly sanitise and escape the place-category setting before rendering it on an admin page. This allows high-privilege users, such as editor...

CVE-2025-15677 GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories

The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

EUVD-2025-210616

The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

CVE-2025-15677 GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories

The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

CVE-2026-16942

The WP Custom HTML Page WordPress plugin, in versions up to and including 0.6.2 , is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to sanitize HTML stored through one of its custom page handlers and does not restrict unfiltered HTML submission to autho...

CVE-2026-16942 WP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for...

EUVD-2026-53102

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability Author and above by default, without the...

CVE-2026-16573

The Bit Form WordPress plugin, in versions prior to 3.2.0 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to sanitize uploaded signature images before storage, which allows unauthenticated attackers to upload a crafted SVG file containing malicious JavaScript . ...

CVE-2026-16583 Orbit Fox by ThemeIsle < 3.0.8 - Author+ Stored XSS via SVG Upload

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability Author and above by default, without the...

CVE-2026-16583 Orbit Fox by ThemeIsle < 3.0.8 - Author+ Stored XSS via SVG Upload

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability Author and above by default, without the...