CVE-2026-4362 ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite

The ElementsKit Elementor Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the LiveAction::reset function in all versions up to, and including, 3.8.2 The function is hooked to the WordPress init action and triggers when both post...

CVE-2026-1268

The Dynamic Widget Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget content field in the Gutenberg editor sidebar in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes ...

CVE-2026-1268

The Dynamic Widget Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget content field in the Gutenberg editor sidebar in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes ...

CVE-2026-1268 Dynamic Widget Content <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Content Field

The Dynamic Widget Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget content field in the Gutenberg editor sidebar in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes ...

CVE-2026-1268 Dynamic Widget Content <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Content Field

The Dynamic Widget Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget content field in the Gutenberg editor sidebar in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes ...

CVE-2026-1268

The CVE-2026-1268 entry concerns the WordPress Dynamic Widget Content plugin (versions up to and including 1.3.6). The vulnerability is a Stored Cross-Site Scripting (XSS) via the widget content field in the Gutenberg editor sidebar, caused by insufficient input sanitization and output escaping o...

CVE-2026-1268

The Dynamic Widget Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget content field in the Gutenberg editor sidebar in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes ...

EUVD-2026-5540

The Dynamic Widget Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget content field in the Gutenberg editor sidebar in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes ...

PT-2026-6033

Name of the Vulnerable Software and Affected Versions Dynamic Widget Content plugin for WordPress versions through 1.3.6 Description The Dynamic Widget Content plugin for WordPress is susceptible to Stored Cross-Site Scripting. This occurs through the widget content field within the Gutenberg...

WordPress plugin Dynamic Widget Content 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

WordPress Dynamic Widget Content plugin <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Content Field vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Widget Content Field vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin Dynamic Widget Content versions = 1.3.6...

CVE-2012-6720

Multiple cross-site scripting XSS vulnerabilities in SocialEngine before 4.2.4 allow remote attackers to inject arbitrary web script or HTML via the 1 title parameter to music/create, 2 location parameter to events/create, or 3 search parameter to widget/index/contentid/...