78 matches found
CVE-2026-66479
Cross-Site Request Forgery CSRF vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6...
CVE-2026-66479
The Liquid Web / StellarWP WPComplete plugin (versions
CVE-2026-66479 WordPress WPComplete plugin <= 2.9.5.6 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6...
EUVD-2026-94929
Cross-Site Request Forgery CSRF vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6...
WordPress WPComplete plugin <= 2.9.5.6 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by Asim Alshaya in WordPress Plugin WPComplete versions = 2.9.5.6...
CVE-2026-77820
The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
CVE-2026-77820 WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute
The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
CVE-2026-77820
WPComplete is a WordPress plugin vulnerable to Stored Cross-Site Scripting (XSS) via the 'empty' Shortcode Attribute in all versions up to and including 2.9.9.0 . The root cause is insufficient input sanitization and output escaping . Attackers with contributor-level access or higher can inject a...
CVE-2026-77820 WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute
The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
EUVD-2026-83465
The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
CVE-2026-77820: Improper Neutralization of Input During Web Page Generation
The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
PT-2026-95733
Name of the Vulnerable Software and Affected Versions WPComplete versions prior to 2.9.9.1 Description The pro version of the WPComplete plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping when handling the empt...
WordPress WPComplete plugin <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WPComplete versions = 2.9.9.0...
CVE-2026-66599
Unauthenticated Cross Site Scripting XSS in WPComplete = 2.9.5.6 versions...
EUVD-2026-64831
Unauthenticated Cross Site Scripting XSS in WPComplete = 2.9.5.6 versions...
CVE-2026-66599 WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WPComplete = 2.9.5.6 versions...
CVE-2026-66599
CVE-2026-66599 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin WPComplete , affecting versions 2.9.5.6 and earlier . The vulnerability was discovered by Asim Alshaya and carries a CVSS v3.1 score of 7.1 (HIGH) with a scope change (CHANGED), reflecting the ab...
CVE-2026-66599 WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WPComplete = 2.9.5.6 versions...