WordPress WP Ultimate Review plugin <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Eunho Kim in WordPress Plugin Wp Ultimate Review versions = 2.4.3...

CVE-2026-18443

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'accessprivileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-103519

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-18443 Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameter

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'accessprivileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-18443

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress (versions up to and including 8.97.0 ) is vulnerable to SQL Injection via the 'access_privileges' parameter. The root cause is insufficient escaping of user-supplied input and a lack of sufficient prepa...

CVE-2026-103519

The WP Ultimate Review plugin for WordPress (all versions up to and including 2.4.3 ) is vulnerable to arbitrary shortcode execution . The root cause is a failure to properly validate input before passing it to the do_shortcode function. Authenticated attackers with subscriber-level access or hig...

EUVD-2026-91959

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-103519 WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-97344

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-91108

The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.10.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes i...

CVE-2026-11399

The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-103913

The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation on coordinate values when a listing is saved,...

CVE-2026-101357

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'seopressgoogleanalyticsmatomoid' parameter in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-100148

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reviews.text' parameter in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-92923

The Unlimited Elements for Elementor WordPress plugin versions before 2.0.21 is vulnerable to a blind SQL injection because a parameter is used in a SQL statement without proper sanitization or escaping. This flaw occurs in the get_addon_output_data function. Attackers with sufficient privileges ...

CVE-2026-100148 Rich Showcase for Google Reviews <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reviews.text' parameter in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-91912

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'seopressgoogleanalyticsmatomoid' parameter in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-101357 SEOPress <= 10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_matomo_id' Parameter

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'seopressgoogleanalyticsmatomoid' parameter in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-100148

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 7.1.3 . The root cause is insufficient input sanitization and output escaping of the 'reviews[].text' parameter. An authenticated attacker with subscrib...

CVE-2026-101357

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 10.2 . The root cause is insufficient input sanitization and output escaping associated with the seopress_google_analytics_matomo_id parameter. Th...