CVE-2026-92084

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before...

CVE-2026-92084

The Beaver Builder Page Builder plugin for WordPress is vulnerable to unauthenticated arbitrary shortcode execution in all versions up to and including 2.11.0.5 . The root cause is the software's failure to properly validate a value before executing the do_shortcode function. This vulnerability c...

CVE-2026-92084 Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before...

EUVD-2026-91966

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before...

CVE-2026-79315

A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the...

EUVD-2026-84465

A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the...

CVE-2026-79315

A reflected cross-site scripting (XSS) vulnerability exists in x-ui 0.3.2 . The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Because the browser decodes HTML entities before the client-side framework evaluates...

CVE-2026-77166

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items...

CVE-2026-77166

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items...

CVE-2026-77166

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items...

PT-2026-96139

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Insufficient validation of user input in the emoji field of the page emoji update endpoint allows an attacker to inject long text and line breaks. This action...

WordPress Sidebar Manager Light plugin <= 1.18 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Nabil Irawan in WordPress Plugin Sidebar Manager Light versions = 1.18...

CVE-2026-76562

The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sbmdescription' parameter in all versions up to, and including, 1.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-76562 Sidebar Manager Light <= 1.18 - Unauthenticated Stored Cross-Site Scripting via 'sbm_description' Parameter

The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sbmdescription' parameter in all versions up to, and including, 1.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-75242

The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sbmdescription' parameter in all versions up to, and including, 1.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-76562

The Sidebar Manager Light WordPress plugin (versions up to and including 1.18 ) is vulnerable to unauthenticated stored cross-site scripting (XSS) through the sbm_description parameter, caused by insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary...

CVE-2026-76562 Sidebar Manager Light <= 1.18 - Unauthenticated Stored Cross-Site Scripting via 'sbm_description' Parameter

The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sbmdescription' parameter in all versions up to, and including, 1.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-76562: Improper Neutralization of Input During Web Page Generation

The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sbmdescription' parameter in all versions up to, and including, 1.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-89269

Name of the Vulnerable Software and Affected Versions Sidebar Manager Light versions prior to 1.19 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts via the sbm descripti...

CVE-2026-15441 Product Table & List Builder For WooCommerce <= 5.6.0 - Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameter

The WC Product Table Lite plugin for WordPress is vulnerable to CSS Injection in versions up to, and including, 5.6.0 via the 'laptopscrolloffset' shortcode attribute exposed through the unauthenticated wcptajax AJAX handler. The handler is registered for wpajaxnoprivwcptajax, JSON-decodes...