CVE-2026-12939: Improper Neutralization of Input During Web Page Generation

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the postthumbnail and newsletterspostthumbnail shortcodes in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postthumbnai...

CVE-2026-8895: Improper Neutralization of Input During Web Page Generation

The kk blog card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blog-card' shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on the shortcode's 'href' and 'type' attributes, which are...

PT-2021-15770

Name of the Vulnerable Software and Affected Versions: AccessAlly versions prior to 3.5.7 Description: The issue is related to the leakage of environment variables due to the dumping of serialize$ SERVER in the resource/frontend/product/product-shortcode.php file. This file is responsible for the...

CVE-2021-24226: Exposure of Sensitive Information to an Unauthorized Actor

In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the accessallyorderform shortcode is dumping serialize$SERVER, which contains all environment variables. The leakage occurs on all public facing pages containing the...

PT-2019-7455

Name of the Vulnerable Software and Affected Versions freshmail-newsletter plugin versions prior to 1.6 Description The issue concerns a SQL Injection vulnerability via the FM form id= substring in the shortcode.php file. This allows for potential exploitation. Recommendations For versions prior ...

CVE-2015-9496: Improper Neutralization of Special Elements used in an SQL Command

The freshmail-newsletter plugin before 1.6 for WordPress has shortcode.php SQL Injection via the 'FMform id=' substring...

CVE-2019-7413

In the Parallax Scroll aka adamrob-parallax-scroll plugin before 2.1 for WordPress, includes/adamrob-parralax-shortcode.php allows XSS via the title text. "parallax" has a spelling change within the PHP filename...

PT-2019-18589

Name of the Vulnerable Software and Affected Versions Parallax Scroll plugin versions prior to 2.1 Description The issue allows for XSS via the title text in the includes/adamrob-parralax-shortcode.php file. Recommendations For versions prior to 2.1, update to version 2.1 or later to resolve the...

CVE-2019-7413: Improper Neutralization of Input During Web Page Generation

In the Parallax Scroll aka adamrob-parallax-scroll plugin before 2.1 for WordPress, includes/adamrob-parralax-shortcode.php allows XSS via the title text. "parallax" has a spelling change within the PHP filename...