PT-2026-79372

Name of the Vulnerable Software and Affected Versions ProfilePress versions prior to 4.17.1 Description The plugin fails to strip shortcodes from two profile fields before rendering them on public pages. This allows unauthenticated attackers to store shortcodes that execute when the page is viewe...

CVE-2021-47948

WordPress GetPaid Plugin 2.4.6 contains an HTML injection vulnerability that allows authenticated attackers to inject arbitrary HTML code by exploiting the Help Text field in payment forms. Attackers can inject malicious HTML including image tags and scripts into the Help Text field during paymen...

CVE-2026-23891

Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting...

PT-2025-46300

Name of the Vulnerable Software and Affected Versions WP Go Maps formerly WP Google Maps versions prior to 9.0.48 Description The software does not properly sanitize user-provided input through an AJAX action. This allows unauthenticated users to inject and store malicious code that can be execut...