CVE-2026-101928

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2026-101928 Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

EUVD-2026-91906

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2026-101928

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.0.34 . The root cause is insufficient input sanitization and output escaping in the 'author' parameter. Specifically, the plugin's esc_html filter ca...

PT-2026-104501

Name of the Vulnerable Software and Affected Versions Magic Tooltips For Contact Form 7 versions prior to 1.0.35 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that...

CVE-2026-101928: Improper Neutralization of Input During Web Page Generation

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2017-14725

Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php...

PT-2017-13654

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.8.2 Description The issue allows for an open redirect attack. This is related to the files wp-admin/edit-tag-form.php and wp-admin/user-edit.php. Recommendations For versions prior to 4.8.2, update to version 4.8....

CVE-2017-14725: URL Redirection to Untrusted Site

Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php...

WordPress WP Jobs Plugin SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on PHP and MySQL servers.WP Jobs plugin is one of the post management plugin. A SQL injection vulnerability exists in WordPress WP Jobs plug...

PT-2014-6425

Name of the Vulnerable Software and Affected Versions Disqus Comment System plugin version 2.77 Description The issue affects the Disqus Comment System plugin, allowing remote attackers to hijack the authentication of administrators. This can be achieved through multiple cross-site request forger...

PT-2014-6426

Name of the Vulnerable Software and Affected Versions Disqus Comment System plugin versions prior to 2.76 for WordPress Description The issue allows remote attackers to hijack the authentication of administrators for requests, conducting cross-site scripting XSS attacks. This is achieved via the...

CVE-2014-5347: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 disqusreplace, 2 disquspublickey, or 3...

CVE-2014-5346: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 activate or 2 deactivate the plugin via the active parameter to wp-admin/edit-comments.php, 3...

CVE-2007-5710: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-admin/edit-post-rows.php in WordPress 2.3 allows remote attackers to inject arbitrary web script or HTML via the postscolumns array parameter...

CVE-2005-4463: Undefined Security Weakness

WordPress before 1.5.2 allows remote attackers to obtain sensitive information via a direct request to 1 wp-includes/vars.php, 2 wp-content/plugins/hello.php, 3 wp-admin/upgrade-functions.php, 4 wp-admin/edit-form.php, 5 wp-settings.php, and 6 wp-admin/edit-form-comment.php, which leaks the path ...