CVE-2026-66643

Contributor-level XSS in Wufoo Shortcode plugin (≤1.55) allows low-privileged users to inject scripts rendered in other users' browsers. CVSS 6.5 (medium) reflects network attack vector, low complexity, and required user interaction. Patchstack is the CNA; update to a fixed version beyond 1.55. N...

CVE-2026-66643 WordPress Wufoo Shortcode plugin <= 1.55 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Wufoo Shortcode = 1.55 versions...

CVE-2026-66643 WordPress Wufoo Shortcode plugin <= 1.55 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Wufoo Shortcode = 1.55 versions...

EUVD-2026-60927

Contributor Cross Site Scripting XSS in Wufoo Shortcode = 1.55 versions...

CVE-2026-66643

Contributor Cross Site Scripting XSS in Wufoo Shortcode = 1.55 versions...

WordPress Snippet Shortcodes plugin <= 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Attributes vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Snippet Shortcodes versions = 5.2.0...

WordPress Smash Balloon Social Post Feed plugin <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'id' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Smash Balloon Social Post Feed versions = 4.9.0...

WordPress Serious Slider plugin <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'theme' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Serious Slider versions = 1.4.0...

WordPress Wufoo Shortcode plugin <= 1.55 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Wufoo Shortcode versions = 1.55...

WordPress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content plugin <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution via First Name / Last Name Profile Field vulnerability discovered by WordFence in WordPress Plugin ProfilePress versions = 4.16.19...

PT-2026-77070

Contributor Cross Site Scripting XSS in Wufoo Shortcode = 1.55 versions...

CVE-2026-66643: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Wufoo Shortcode = 1.55 versions...

CVE-2026-2357 Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'btbbshortcode' shortcode in all versions up to, and including, 5.6.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

EUVD-2026-59923

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'btbbshortcode' shortcode in all versions up to, and including, 5.6.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2026-2357

The CVE concerns the Bold Page Builder WordPress plugin. A Stored Cross-Site Scripting vulnerability exists in the bt_bb_shortcode attribute handling for all versions up to 5.6.8, caused by insufficient input sanitization and output escaping. Exploitation requires authenticated access at contribu...

CVE-2026-2357

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'btbbshortcode' shortcode in all versions up to, and including, 5.6.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2026-16775

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Attribute in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15790

The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.4 via the 'emdmbmeta' shortcode. This is due to insufficient input sanitization and output escaping on attachment titles referenced by the shortcode's image field:...

CVE-2026-16775 Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Attribute in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-16775

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Attribute in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping. This makes it possible for...