Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

52 matches found

CVE
CVE•added 2026/05/27 5:31 a.m.•9 views

CVE-2026-8847

The CVE-2026-8847 entry concerns the WordPress Dideo plugin (version 1.0) with a Stored XSS flaw in the dideo shortcode. The root cause is insufficient input sanitization and output escaping on the id attribute, which is inserted into an iframe src without escaping in the dideo() handler. Attacke...

6.4CVSS6AI score0.00032EPSS
Exploits0References3
CNNVD
CNNVD•added 2026/05/27 12:0 a.m.•2 views

WordPress plugin Dideo 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The Dide...

6.4CVSS5.8AI score0.00032EPSS
Exploits0References3
EUVD
EUVD•added 2026/05/08 12:31 p.m.•3 views

EUVD-2026-28544

The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the e2pdf-download shortcode in all versions up to, and including, 1.32.17. This is due to insufficient input sanitization and output escaping on the shortcode...

6.4CVSS6AI score0.00013EPSS
Exploits0References7
Cvelist
Cvelist•added 2026/05/08 9:26 a.m.•23 views

CVE-2026-7650 E2Pdf – Export Pdf Tool for WordPress <= 1.32.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the e2pdf-download shortcode in all versions up to, and including, 1.32.17. This is due to insufficient input sanitization and output escaping on the shortcode...

6.4CVSS0.00013EPSS
Exploits0References6
Vulnrichment
Vulnrichment•added 2026/04/22 7:45 a.m.•1 views

CVE-2026-4353 CI HUB Connector <= 1.2.106 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

The CI HUB Connector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the cihubmetadata shortcode in all versions up to, and including, 1.2.106 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

6.4CVSS5.9AI score0.00012EPSS
Exploits0References3
CVE
CVE•added 2026/04/22 7:45 a.m.•3 views

CVE-2026-4089

CVE-2026-4089 affects the WordPress plugin Twittee Text Tweet (≤ 1.0.8). The vulnerability is a Stored Cross-Site Scripting flaw in the ttt_twittee_tweeter() function where shortcode attributes (notably id, tweet, content, balloon, theme) are extracted and concatenated into HTML/inline JavaScript...

6.4CVSS5.9AI score0.00014EPSS
Exploits0References5
RedhatCVE
RedhatCVE•added 2026/04/20 7:22 p.m.•1 views

CVE-2026-1838

The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcodeid' parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

6.1CVSS5.9AI score0.00155EPSS
Exploits0References1
Patchstack
Patchstack•added 2026/04/20 9:39 a.m.•3 views

WordPress Hostel plugin <= 1.1.6 - Reflected Cross-Site Scripting via 'shortcode_id' Parameter vulnerability

Reflected Cross-Site Scripting via 'shortcodeid' Parameter vulnerability discovered by Bee - FPT University in WordPress Plugin Hostel versions = 1.1.6...

6.1CVSS5.8AI score0.00155EPSS
Exploits0References1Affected Software1
NVD
NVD•added 2026/04/18 2:16 a.m.•0 views

CVE-2026-1838

The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcodeid' parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

6.1CVSS0.00155EPSS
Exploits0References9
ATTACKERKB
ATTACKERKB•added 2026/04/18 1:26 a.m.•0 views

CVE-2026-1838

The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcodeid' parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

6.1CVSS5.9AI score0.00155EPSS
Exploits0References10
Vulnrichment
Vulnrichment•added 2026/04/18 1:26 a.m.•0 views

CVE-2026-1838 Hostel <= 1.1.6 - Reflected Cross-Site Scripting via 'shortcode_id' Parameter

The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcodeid' parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

6.1CVSS5.9AI score0.00155EPSS
Exploits0References9
Cvelist
Cvelist•added 2026/04/18 1:26 a.m.•27 views

CVE-2026-1838 Hostel <= 1.1.6 - Reflected Cross-Site Scripting via 'shortcode_id' Parameter

The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcodeid' parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

6.1CVSS0.00155EPSS
Exploits0References9
Positive Technologies
Positive Technologies•added 2026/04/18 12:0 a.m.•1 views

PT-2026-33580

The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode id' parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

6.1CVSS5.9AI score0.00155EPSS
Exploits0References10
NVD
NVD•added 2026/04/15 9:16 a.m.•0 views

CVE-2026-4011

The Power Charts Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the pc shortcode in all versions up to, and including, 0.1.0. This is due to insufficient input sanitization and output escaping on the 'id' shortcode attribute. Specifically, in the...

6.4CVSS0.00042EPSS
Exploits0References5
Cvelist
Cvelist•added 2026/04/15 8:28 a.m.•22 views

CVE-2026-4011 Power Charts <= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

The Power Charts Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the pc shortcode in all versions up to, and including, 0.1.0. This is due to insufficient input sanitization and output escaping on the 'id' shortcode attribute. Specifically, in the...

6.4CVSS0.00042EPSS
Exploits0References5
ATTACKERKB
ATTACKERKB•added 2026/04/15 8:28 a.m.•1 views

CVE-2026-4011

The Power Charts Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the pc shortcode in all versions up to, and including, 0.1.0. This is due to insufficient input sanitization and output escaping on the 'id' shortcode attribute. Specifically, in the...

6.4CVSS6AI score0.00042EPSS
Exploits0References6
Cvelist
Cvelist•added 2026/04/15 8:28 a.m.•26 views

CVE-2026-3659 WP Circliful <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

The WP Circliful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the circliful shortcode and via multiple shortcode attributes of the circlifuldirect shortcode in all versions up to and including 1.2. This is due to insufficient input...

6.4CVSS0.00073EPSS
Exploits0References9
Positive Technologies
Positive Technologies•added 2026/04/15 12:0 a.m.•1 views

PT-2026-33026

The Power Charts Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the pc shortcode in all versions up to, and including, 0.1.0. This is due to insufficient input sanitization and output escaping on the 'id' shortcode attribute. Specifically, in the ...

6.4CVSS6AI score0.00042EPSS
Exploits0References7
Vulnrichment
Vulnrichment•added 2026/04/08 6:43 a.m.•0 views

CVE-2026-3618 Columns by BestWebSoft <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'columns' Shortcode 'id' Attribute

The Columns by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the printclmns shortcode in all versions up to and including 1.0.3. This is due to insufficient input sanitization and output escaping on the 'id' attribute. The...

6.4CVSS6AI score0.00027EPSS
Exploits0References9
CVE
CVE•added 2026/04/08 6:43 a.m.•5 views

CVE-2026-3618

The CVE concerns the WordPress plugin Columns by BestWebSoft (

6.4CVSS6AI score0.00027EPSS
Exploits0References9
Rows per page
Query Builder