11412 matches found
CVE-2026-85414
The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'customsettings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WordPress Pods plugin <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'notfound' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Pods versions = 3.3.9.1...
WordPress Gallery : FooGallery plugin <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'customsettings' Shortcode Attribute vulnerability discovered by UKO - Korea univ. in WordPress Plugin FooGallery versions = 3.3.2...
CVE-2026-85414 Gallery : FooGallery <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute
The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'customsettings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-85414
Gallery: FooGallery plugin for WordPress (all versions up to, and including, 3.3.2 ) is affected by a Stored Cross-Site Scripting (XSS) vulnerability through the custom_settings shortcode attribute, caused by insufficient input sanitization and output escaping . An authenticated attacker with Con...
EUVD-2026-71932
The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'customsettings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-85414 Gallery : FooGallery <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute
The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'customsettings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-84931
The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of...
CVE-2026-84022
The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...
CVE-2026-84931 Joli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Theme Attribute
The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of...
CVE-2026-84931
The Joli Table Of Contents WordPress plugin, in versions prior to 3.0.3 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitize or escape a shortcode attribute value before it is outputted inside an HTML element's attribute. This allows users with the Auth...
CVE-2026-84931 Joli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Theme Attribute
The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of...
EUVD-2026-71872
The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of...
CVE-2026-84022 Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes
The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...
EUVD-2026-71861
The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...
CVE-2026-84022
The Bold Page Builder WordPress plugin, in versions before 5.9.8 , is vulnerable to a Stored XSS flaw because it fails to sanitize and escape several shortcode attributes before outputting them into HTML attributes. This oversight allows users with Contributor roles or higher to inject arbitrary ...
CVE-2026-84022 Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes
The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...
PT-2026-86345
šØ CVE-2026-84022 The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected...
CVE-2026-76573: Improper Neutralization of Input During Web Page Generation
The Pods ā Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'notfound' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-84022: Improper Neutralization of Input During Web Page Generation
The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...