WordPress Mang Board plugin <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Mang Board WP versions = 2.4.3...

WordPress Gallery Custom Links plugin <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin Gallery Custom Links versions = 2.3.3...

WordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin FV Flowplayer Video Player versions = 7.5.54.7212...

WordPress PO/MO Editor plugin <= 1.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by sermsak in WordPress Plugin PO/MO Editor versions = 1.4.2...

WordPress Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Spy0x7 in WordPress Plugin Cryptocurrency Donation Box – Bitcoin & Crypto Donations versions = 2.2.13...

WordPress Document Gallery plugin <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by 刀 妖 in WordPress Plugin Document Gallery versions = 5.1.1...

WordPress Social Share Buttons & Analytics Plugin – GetSocial.io plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Alz in WordPress Plugin Social Share Buttons & Analytics Plugin – GetSocial.io versions = 4.5...

WordPress AGE-GATE plugin <= 1.0 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Spy0x7 in WordPress Plugin AGE-GATE versions = 1.0...

WordPress XStore theme < 9.7.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Theme XStore versions 9.7.9...

CVE-2026-109890 WordPress Premium Addons for Elementor plugin <= 4.11.110 - Broken Access Control vulnerability

Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Addons for Elementor: from n/a through 4.11.110...

WordPress Download Monitor integration for WooCommerce plugin <= 1.0.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mash in WordPress Plugin Download Monitor integration for WooCommerce versions = 1.0.3...

WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory 2.8.190 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping. Certified attackers with subscription-level or higher permissions can inject any web script into pages through the...

WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory versions 2.8.190 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'postimages fileinfo2 = title' parameter. It may lead to storage-based cross-site scripting attacks. Certified...

WordPress Calendar SQL Injection Vulnerability

Versions of WordPress Calendar prior to 7.37.0 have a SQL injection vulnerability. This vulnerability arises due to improper handling of special elements in SQL commands, which may lead to SQL injections...

WordPress Post Export Import with Media: Deserialization Injection Vulnerability

WordPress Post Export Import with Media has a deserialization injection vulnerability in versions 1.17.1 and earlier. This vulnerability stems from the deserialization processing of untrusted inputs, leading to PHP object injection. Certified attackers with administrator or higher privileges may ...

WordPress Push Notification for Posts and BuddyPress: Authorization Issues Vulnerability

WordPress push notification for posts and BuddyPress versions 3.23 and earlier have a permission-related vulnerability. This vulnerability stems from the absence of proper permissions, which may allow attackers to exploit incorrectly configured access control levels...

WordPress Social Share Buttons & Analytics Plugin – GetSocial.io Cross-site Script Vulnerability

WordPress Social Share Buttons & Analytics Plugin – GetSocial.io versions 4.5 and earlier have a cross-site scripting vulnerability. This vulnerability stems from improper cleaning of response parameter inputs and improper output escaping, allowing authenticated attackers to inject arbitrary web...

WordPress Gallery Custom Links: Cross-site Scripting Vulnerabilities

WordPress Gallery Custom Links versions 2.3.3 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the displayname profile.php and comment wp-comments-post.php parameters. Certified attackers with subscription and...

WordPress PeproDev Branches Map: Cross-site Scripting Vulnerabilities

WordPress PeproDev branches map 3.0.1 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping, allowing authenticated attackers with privileges of contributor or higher to inject any web script into the page, making...

WordPress Countdown Timer – Widget Countdown plugin 3.0.0-3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Widget Countdown versions 3.0.0-3.0.1...