CVE-2026-12938

The CVE-2026-12938 entry describes a Stored XSS in the WordPress Newsletters Lite plugin (versions up to 4.15). The vulnerability stems from insufficient input sanitization and output escaping in the posts_single() function (injects attacker-controlled target into $wpml_target) and in the shortco...

CVE-2026-12938

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the newsletterspost shortcode in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postssingle function which propagates...

CVE-2026-12938 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the newsletterspost shortcode in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postssingle function which propagates...

CVE-2026-12938 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the newsletterspost shortcode in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postssingle function which propagates...

PT-2026-65781

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbm best seller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes...

PT-2026-65677

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the newsletters post shortcode in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the posts single function which propagate...

EUVD-2026-49789

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Readonly User Field via pmpromemberprofileedit Shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization...

CVE-2026-11598

The Shortcodify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'name' Shortcode Attribute in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acces...

CVE-2026-11598 Shortcodify <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute

The Shortcodify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'name' Shortcode Attribute in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acces...

CVE-2026-11598

CVE-2026-11598 is a Stored Cross-Site Scripting vulnerability in the Shortcodify WordPress plugin, affecting all versions up to 1.4.3. The issue arises from insufficient input sanitization and output escaping for the name shortcode attribute, enabling authenticated attackers with contributor-leve...

CVE-2026-15730

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output...

EUVD-2026-49713

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output...

CVE-2026-15730 GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output...

CVE-2026-15730

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output...

CVE-2026-15730 GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output...

CVE-2026-11598: Improper Neutralization of Input During Web Page Generation

The Shortcodify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'name' Shortcode Attribute in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acces...

PT-2026-65407

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heading size' Shortcode Attribute in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output...

CVE-2026-10082

The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is viewed, including by higher-privileged...

CVE-2026-13726 Multiple Page Generator Plugin – MPG < 4.1.8 - Reflected XSS via mpg_shortcode

The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request...

CVE-2026-10082 Advanced Ads – Ad Manager & AdSense < 2.0.23 - Contributor+ Stored XSS via the_ad Shortcode 'ad_args' Parameter

The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is viewed, including by higher-privileged...