CVE-2026-16775: Improper Neutralization of Input During Web Page Generation

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Attribute in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-16758: Improper Neutralization of Input During Web Page Generation

The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acce...

PT-2026-73099

Name of the Vulnerable Software and Affected Versions ProfilePress versions prior to 4.16.20 Description Authenticated attackers with subscriber-level access and above can execute arbitrary shortcodes. This occurs because the software fails to properly validate values before executing the do...

PT-2026-73136

Name of the Vulnerable Software and Affected Versions Bold Page Builder versions prior to 5.6.9 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes within the bt bb shortcode shortcode. Authenticated attackers with...

PT-2026-73110

Name of the Vulnerable Software and Affected Versions Smash Balloon Social Post Feed versions prior to 4.9.1 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject...

CVE-2026-15948

The CVE-2026-15948 entry concerns the Hydra Booking WordPress plugin. A Stored Cross-Site Scripting vulnerability exists in the first_name parameter for all versions up to and including 1.2.2 due to insufficient input sanitization and output escaping. The tfhb_host role can be self-assigned via t...

WordPress Embed Google Photos Album Easily plugin <= 2.2.1 - Contributor+ Stored XSS via link Shortcode Attribute vulnerability

Contributor+ Stored XSS via link Shortcode Attribute vulnerability discovered by testoun in WordPress Plugin Embed Google Photos album versions = 2.2.1...

WordPress PPWP - Password Protect Pages plugin <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability

WordPress PPWP - Password Protect Pages plugin = 1.9.21 - Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Attributes vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin PPWP versions = 1.9.21...

CVE-2026-14290

The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including...

EUVD-2026-58595

The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including...

CVE-2026-14290 Embed Google Photos Album Easily <= 2.2.1 - Contributor+ Stored XSS via link Shortcode Attribute

The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including...

CVE-2026-14290 Embed Google Photos Album Easily <= 2.2.1 - Contributor+ Stored XSS via link Shortcode Attribute

The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including...

CVE-2026-14290

The Embed Google Photos album WordPress plugin, in versions through 2.2.1 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to escape shortcode attribute values before they are outputted within an HTML attribute. This allows users with Contributor privileg...

CVE-2026-14290

The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including...

PT-2026-71965

The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including...

CVE-2026-3639

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2026-3639

CVE-2026-3639 : The PPWP – Password Protect Pages plugin for WordPress is vulnerable toStored Cross-Site Scripting via the plugin’s ppwp shortcode attributes in all versions up to and including 1.9.21, due to insufficient input sanitization and output escaping on user-supplied attributes. Authent...

CVE-2026-3639

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

EUVD-2026-57741

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2026-3639 PPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...