CVE-2026-97348 SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the getinstancecss function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary file...

CVE-2026-96574 User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpufpaymentmethod' parameter in all versions up to, and including, 4.3.12 due to...

CVE-2026-95684

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.8.15 . The flaw resides in the 'attachments[name]' parameter due to insufficient input sanitization and output escaping . This allows unauthentic...

EUVD-2026-96223

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachmentsname' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

EUVD-2026-96225

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpufpaymentmethod' parameter in all versions up to, and including, 4.3.12 due to...

CVE-2026-95684 VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachmentsname' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2026-96840

The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.1.0 . The root cause is insufficient input sanitization and output escaping in the display_name User Field. Specifically, while WordPress core encod...

CVE-2026-96574

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.3.12 . The root cause is insufficient input sanitizatio...

CVE-2026-96840 Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field

The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via displayname User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2026-15178

The Fluent Forms plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 6.2.5 . The root cause is the plugin's failure to properly verify if a user is authorized to perform specific actions. This flaw allows authenticated attackers with Custom-level acce...

EUVD-2026-96226

The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Custom-level access an...

CVE-2026-96558 Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter

The Quiz and Survey Master QSM – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsmhiddenquestions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-15178 Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification

The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Custom-level access an...

CVE-2026-96558

The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting in all versions up to and including 11.2.6 . The flaw stems from insufficient input sanitization and output escaping of the 'qsm_hidden_questions' parameter. An unauthenticated attacker ca...

EUVD-2026-96227

The Quiz and Survey Master QSM – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsmhiddenquestions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it...

cve-2019-9787_csrf_poc

CVE-2019-9787 CSRF PoC Panoramica PoC della CVE-2019-9787 CSRF Versione WordPress 5.0 riferimento Non usarlo se non per scopi di test. Installazione $ docker-compose up -d 1. accedi a http://localhost:8080/ e installa WordPress. devi solo creare un account amministratore WP. 2. accedi a...

CVE-2026-96682

The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Tag in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-94421

The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 5.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2026-96667

The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-97643

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's givewpcampaigngrid shortcode in versions up to, and including, 4.17.0 This is due to insufficient input sanitization and output escaping on user supplied...