CVE-2026-92551

The ProfilePress plugin for WordPress (all versions up to and including 4.17.4 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the ppress_billing_address Filename Parameter. Unauthenticated attackers can inject arb...

Wordpress Polls Widget < 1.5.3 - SQL Injection

The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the dateanswers POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks id: CVE-2021-24442 inf...

WordPress WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin <= 4.7.3 - Unauthenticated Sensitive Information Disclosure vulnerability

Unauthenticated Sensitive Information Disclosure vulnerability discovered by walid213 in WordPress Plugin Social Icons Widget & Block by WPZOOM versions = 4.7.3...

CVE-2026-85016

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfilteredhtml to store a payload that executes when th...

CVE-2026-85016 Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfilteredhtml to store a payload that executes when th...

EUVD-2026-91192

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfilteredhtml to store a payload that executes when th...

CVE-2026-85016

The Unlimited Elements for Elementor WordPress plugin (versions before 2.0.21 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to escape an icon value before concatenating it into an HTML attribute within the shared widget-parameter processor . This flaw allows u...

PT-2026-104087

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfiltered html to store a payload that executes when t...

PT-2026-104118

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otter form widget filter' parameter. This makes it possible for authenticated attackers, with...

CVE-2025-14893

CVE-2025-14893: Cross-Site Scripting XSS Almacenado Autenticado en el Plugin IndieWeb de WordPress Descargo de responsabilidad: Este repositorio se crea únicamente con fines educativos y de divulgación ética. La vulnerabilidad ha sido reportada de manera responsable al proveedor y corregida. No...

CVE-2025-67923

Informe de Explotación de CVE-2025-67923 JetEngine = 3.7.7 — Cross-Site Scripting Almacenado No Autenticado a través de la API REST de CCT Fecha: 11 de marzo de 2026 Puntuación CVSS: 7.1 Alta Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Plugin afectado: JetEngine = 3.7.7 Slug del...

CVE-2026-30862

CVE-2026-30862 PoC - Escalada de Privilegios en Appsmith Prueba de Concepto para Escalada de Privilegios en Appsmith mediante XSS Almacenado Divulgación: Reportado originalmente por mí a través de GHSA-5hw4-whxv-6794 ⚠️ Solo para pruebas de penetración/investigación autorizadas. Información de la...

CVE-2025-41089

CVE-2025-41089: XSS Reflejado en Xibo CMS He descubierto una vulnerabilidad de Cross-Site Scripting XSS Reflejado en Xibo CMS v4.1.2. Este problema se origina por la falta de saneamiento adecuado de la entrada proporcionada por el usuario en el campo 'Configuration Name' de ciertos widgets dentro...

advisories

Sobre mí Twitter: @justinsteven Blog: https://www.justinsteven.com/ Avisos de seguridad Listados en orden cronológico inverso. Haz clic en cualquier título para leer el aviso completo. Gartner Peer Insights Widget postMessage DOM XSS Fecha de divulgación: 2023-02-03 El Gartner Peer Insights Widge...

CVE-2026-87777

The Hostinger Reach WordPress plugin (versions 1.0.6 through 1.8.2) is vulnerable to Stored XSS because it fails to sanitize and escape a widget setting before outputting it in the editor preview. This flaw specifically involves the formId Elementor Widget Attribute . An attacker with contributor...

CVE-2026-87777 Hostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget Attribute

The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens...

CVE-2026-87777 Hostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget Attribute

The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens...

EUVD-2026-89633

The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed...

CVE-2026-85001 EmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle Attribute

The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed...

CVE-2026-85001 EmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle Attribute

The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed...