EUVD-2026-59898

The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acce...

CVE-2026-16758

CVE-2026-16758 affects the WordPress plug-in “Snippet Shortcodes” up to version 5.2.0. It enables a Stored Cross-Site Scripting attack via Shortcode Attributes, allowing an authenticated attacker with contributor-level access or higher to inject and trigger scripts when users visit affected pages...

WordPress PPWP - Password Protect Pages plugin <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability

WordPress PPWP - Password Protect Pages plugin = 1.9.21 - Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Attributes vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin PPWP versions = 1.9.21...

CVE-2026-3639

CVE-2026-3639 : The PPWP – Password Protect Pages plugin for WordPress is vulnerable toStored Cross-Site Scripting via the plugin’s ppwp shortcode attributes in all versions up to and including 1.9.21, due to insufficient input sanitization and output escaping on user-supplied attributes. Authent...

CVE-2026-3639

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

EUVD-2026-57741

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2026-3639 PPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2026-3639 PPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2026-15047

The CVE concerns the s2Member WordPress plugin prior to 260805, where several shortcode attributes are not escaped before being placed in an inline script. This allows stored XSS: contributor-level users can inject JavaScript that runs when a viewer opens the post. No specific exploitation status...

EUVD-2026-54995

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post stored XSS...

CVE-2026-15047 s2Member < 260805 - Contributor+ Stored XSS via Shortcode

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post stored XSS...

CVE-2026-15047

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post stored XSS...

CVE-2026-18395

The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-18395

The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-18395

The CVE refers to the WordPress plugin Child Pages Card, affected before version 1.09. The flaw is improper sanitisation/escaping of shortcode attributes, enabling Stored XSS for users with the contributor role and above when rendering pages. No exploit details or patches are provided in the conn...

CVE-2026-18395 Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes

The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

EUVD-2026-53732

The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-15649

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

EUVD-2026-51764

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

CVE-2026-15649

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...