CVE-2026-118783

The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

CVE-2026-118783 All-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode Attribute

The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

CVE-2026-118783

The All-in-One Video Gallery WordPress plugin (versions before 5.0.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly validate and escape certain shortcode attributes before they are rendered back into pages or posts. This allows users with contribu...

EUVD-2026-116738

The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

EUVD-2026-114778

The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-113482

The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-113482: Unknown Media Library Assistant: The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before…

The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

PT-2026-134832

The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-77871

The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-116609

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to SQL Injection via the 'from' and sibling 'to'/'first'/'second' shortcode attribute of the wsmshowTrafficStatsList shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the...

CVE-2026-109590

The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes of the ttbm-hotel-map shortcode in versions up to, and including, 2.3.6 This is due to insufficient input sanitization and output escaping on user...

CVE-2026-77871 Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-77871

The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress (versions up to and including 4.2.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) via shortcode attributes. The root cause is insufficient input sanitization and output escaping; specifically, entity-encoded...

EUVD-2026-111606

The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-77871 Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-104729 Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tabindex, emptynotice' parameter in all versions up to, and including, 3.16.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-111967

The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrat...

EUVD-2026-111722

The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrat...

CVE-2026-77871: saadiqbal Post Snippets – Custom WordPress Code Snippets Customizer: The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site…

The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2026-127893

The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...