By weakness (CWE)

CWE-79: related vulnerabilities

CVEs classified under CWE-79. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

728 published vulnerabilities · page 3 of 8

• CVE-2021-47982MEDIUM 6.4

  WordPress administrators using the WP-Paginate plugin version 2.1.3 should be aware of a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into the plugin's settings. An attacker with login credentials can submit crafted requests to the plugin configuration page, embedding JavaScript payloads that are permanently stored in the database and executed whenever site administrators access those settings. This means the payload runs in the admin's browser session, potentially allowing the attacker to steal session tokens, modify site content, create new admin accounts, or perform other harmful actions on behalf of the compromised administrator.

• CVE-2021-47983MEDIUM 6.4

  The Stripe Payments WordPress plugin version 2.0.39 contains a stored cross-site scripting (XSS) vulnerability that allows logged-in attackers to inject malicious JavaScript code into plugin settings. When an administrator views these compromised settings, the injected script executes in their browser with full administrative privileges. This type of attack is particularly dangerous because the malicious code persists in the database and affects all administrators who access the settings page.

• CVE-2021-47984MEDIUM 6.4

  The WP24 Domain Check WordPress plugin version 1.6.2 contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with plugin access to inject malicious JavaScript code. When an admin later views the plugin's settings page, that injected code executes in their browser, potentially allowing the attacker to perform unauthorized actions on their behalf or steal sensitive information. This is a persistence threat—once injected, the malicious script remains in the plugin settings until manually removed.

• CVE-2025-14042MEDIUM 6.4

  The Automotive Car Dealership Business WordPress Theme contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 13.4.1. An attacker with contributor-level or higher permissions can inject malicious scripts into Portfolio Item 'Project Details' fields. These scripts will execute when other users view the affected pages, potentially compromising visitor sessions, stealing credentials, or defacing content. The vulnerability stems from the theme's failure to properly sanitize and escape user input in a custom field.

• CVE-2025-14785MEDIUM 6.4

  Website Builder by SeedProd—a popular WordPress plugin for creating landing pages, coming soon pages, and maintenance modes—contains a stored cross-site scripting (XSS) vulnerability in its nested menu widget shortcode. An authenticated user with contributor-level permissions or higher can embed malicious JavaScript into pages. That script then executes for anyone visiting the affected page, potentially compromising visitor data or session tokens. The vulnerability affects all versions through 6.20.2.

• CVE-2025-36320MEDIUM 6.4

  IBM watsonx.data intelligence contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious JavaScript into the web interface. Once injected, the script persists and executes in the browsers of other users who access the affected page, potentially enabling attackers to steal session credentials or manipulate application behavior. The vulnerability affects versions 5.2.0 through 5.3.0 and requires valid user credentials to exploit.

• CVE-2025-8444MEDIUM 6.4

  A WordPress plugin called Animation Addons for Elementor (versions up to 2.6.7) allows authenticated users with contributor-level permissions to inject malicious scripts into pages. When other users visit those pages, the scripts execute in their browsers, potentially stealing session data, modifying page content, or performing actions on their behalf. The vulnerability stems from the plugin's failure to properly clean and validate user input before storing it.

• CVE-2026-10024MEDIUM 6.4

  The TinyMCE shortcode Addon plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 1.0.0. An authenticated user with contributor-level permissions or higher can inject malicious JavaScript code into pages via the 'btnrel' shortcode attribute. Because the plugin fails to properly sanitize and escape this input, the injected script will execute in the browsers of anyone who views the affected page. This is a *stored* vulnerability, meaning the malicious code persists in the page content until explicitly removed.

• CVE-2026-10089MEDIUM 6.4

  The Insert Pages plugin for WordPress has a security flaw where it fails to properly clean user-supplied text before displaying it on web pages. Specifically, when an author or administrator creates a custom field (metadata) with a specially crafted name and inserts a page using the plugin's shortcode, that malicious field name gets displayed without protection. This allows attackers to inject JavaScript code that runs in the browsers of anyone viewing the affected page. The vulnerability requires an authenticated account with author-level permissions or higher to exploit, which limits the immediate risk but still represents a meaningful threat in environments where multiple content creators have access.

• CVE-2026-10093MEDIUM 6.4

  A vulnerability in the File Sharing & Download Manager – User Private Files WordPress plugin allows authenticated users with subscriber-level permissions or higher to inject malicious scripts into pages. When other users visit an affected page, those scripts execute in their browsers, potentially leading to credential theft, session hijacking, or other client-side attacks. The flaw exists in how the plugin handles the 'fldr_ttl' parameter, failing to properly sanitize and escape user input.

• CVE-2026-10095MEDIUM 6.4

  WP Photo Album Plus, a popular WordPress plugin, contains a stored cross-site scripting (XSS) vulnerability in versions up to 9.1.13.005. Attackers with contributor-level access or higher can inject malicious code through the 'subtext' parameter of the plugin's photo shortcode. When other users—including administrators—view the compromised post, the injected script executes in their browser, potentially allowing attackers to steal session tokens, modify content, or perform actions on their behalf. The vulnerability persists in the database, making it a lasting threat until patched.

• CVE-2026-10570MEDIUM 6.4

  The Sympl Repeater for ACF and Elementor plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated authors and higher-privileged users to inject malicious scripts into pages. When a page containing an affected repeater field is viewed by any site visitor, the injected script executes in their browser. The vulnerability stems from the plugin's failure to properly escape data when rendering ACF field values in Elementor, leaving user input exposed to script injection.

• CVE-2026-10738MEDIUM 6.4

  The jQuery Hover Footnotes plugin for WordPress allows attackers who can write or edit content on a site (author-level access or higher) to hide malicious scripts inside footnote markup. These scripts execute whenever anyone views the affected page. The vulnerability exists because the plugin doesn't properly clean user input before storing it, and the hidden scripts bypass WordPress's built-in protections by using a specific syntax that avoids HTML tags.

• CVE-2026-10833MEDIUM 6.4

  Gutenberg Essential Blocks, a popular WordPress page builder plugin, contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 6.1.4. An authenticated WordPress user with Contributor-level permissions or higher can inject malicious JavaScript code through the 'configurablePrefix' block attribute. Once injected, this code executes whenever anyone visits the affected page, potentially compromising site visitors or enabling further attacks. The vulnerability stems from the plugin failing to properly sanitize user input and escape output in this specific block parameter.

• CVE-2026-10862MEDIUM 6.4

  The Accordions plugin for WordPress has a security flaw that allows authenticated users with custom-level permissions or higher to inject malicious scripts into accordion content. When other users view pages containing these injected scripts, the scripts execute in their browsers, potentially exposing sensitive information or performing unwanted actions on their behalf. This vulnerability affects all versions up to and including 2.3.23.

• CVE-2026-11328MEDIUM 6.4

  A WordPress plugin called Exclusive Addons for Elementor has a stored cross-site scripting (XSS) vulnerability affecting versions up to 2.7.9.8. An attacker with Contributor-level access or higher can inject malicious scripts into post titles that will execute whenever anyone visits the affected page. The vulnerability stems from the plugin's failure to properly sanitize and escape user input in the post title parameter.

• CVE-2026-11380MEDIUM 6.4

  A WordPress plugin called JetWidgets For Elementor has a security flaw in its Animated Box widget that allows authenticated users with author-level permissions to inject malicious scripts into pages. When visitors view those pages, the injected scripts execute in their browsers. The vulnerability affects versions up to 1.0.21 and requires an attacker to already have login access to the WordPress site.

• CVE-2026-11402MEDIUM 6.4

  A WordPress plugin called Services Section Block allows attackers with contributor access or higher to inject malicious scripts into pages. When someone visits those pages, the hidden scripts run in their browser. The vulnerability exists because the plugin doesn't properly validate input or sanitize output when handling links in service blocks. The injected code hides in HTML comments, which lets it slip past WordPress's standard security checks.

• CVE-2026-11597MEDIUM 6.4

  A WordPress plugin called Surbma | Infusionsoft Shortcode (versions up to 2.0.1) fails to properly validate and sanitize user input when creating shortcodes that embed external scripts. An authenticated WordPress user with contributor access or higher can inject malicious code into shortcode parameters, which gets embedded in web pages. Any visitor to those pages will execute the injected script in their browser, potentially compromising their session or harvesting sensitive information. The vulnerability requires an authenticated user to exploit it, but once weaponized, affects all subsequent visitors to the compromised page.

• CVE-2026-11614MEDIUM 6.4

  The Xpro Addons plugin for WordPress, which provides 140+ widgets for the Elementor page builder, contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.7.2. An authenticated user with author-level permissions or higher can inject malicious JavaScript code through the 'custom_attributes' parameter. This code persists in the database and executes whenever anyone visits the affected page, potentially allowing the attacker to steal session tokens, modify page content, or redirect users to malicious sites.

• CVE-2026-11783MEDIUM 6.4

  The Dokan multivendor marketplace plugin for WordPress has a stored cross-site scripting (XSS) flaw in how it handles product SKU data. An authenticated user with custom-level access or higher can inject malicious scripts into a product's SKU field. When site visitors—including those not logged in—use the store search widget, the injected script executes in their browsers. This allows an attacker to steal session data, redirect users, deface pages, or perform actions on behalf of victims.

• CVE-2026-12098MEDIUM 6.4

  The PowerPress Podcasting plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with author-level or higher permissions to inject malicious scripts into podcast episode metadata. When other users view pages containing the injected content, the scripts execute in their browsers. The vulnerability exists because the plugin stores the 'embed' field directly to the database without proper sanitization, bypassing WordPress's built-in protections that normally filter such input. All versions up to and including 11.16.8 are affected.

• CVE-2026-12135MEDIUM 6.4

  The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its 'video_player' shortcode. An authenticated user with contributor-level permissions or higher can embed malicious JavaScript code into a page through the 'align' attribute. Once injected, this code executes automatically whenever anyone views the affected page, potentially allowing attackers to steal session cookies, redirect users, deface content, or perform other malicious actions on behalf of legitimate visitors.

• CVE-2026-12136MEDIUM 6.4

  The Customize My Account For Woocommerce plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with Contributor-level permissions to inject malicious scripts into WordPress pages. The vulnerability exists in how the plugin processes user-supplied measurements for avatars—specifically height and width parameters—without properly sanitizing or escaping them before inserting them into page code. When other users visit an infected page, the injected script executes in their browsers, potentially allowing attackers to steal credentials, deface content, or perform actions on behalf of victims.

• CVE-2026-12154MEDIUM 6.4

  A WordPress plugin called Reviews Widgets for Google, Yelp & TripAdvisor contains a stored cross-site scripting (XSS) vulnerability in versions up to 2.7.3. An authenticated user with contributor-level permissions or higher can inject malicious scripts into a page using the plugin's shortcode feature. Once injected, those scripts execute whenever anyone visits the affected page, potentially compromising visitor accounts or stealing sensitive information. This requires an authenticated attacker with at least contributor access, which limits the immediate risk in most WordPress installations but remains serious for organizations with many trusted editors.

• CVE-2026-12157MEDIUM 6.4

  BetterDocs, a popular WordPress plugin that creates knowledge bases and FAQ sections, contains a security flaw that allows certain authenticated users to inject malicious code into pages. If a contributor or higher-privilege user exploits this, their injected script will run in the browsers of anyone who visits that page, potentially stealing information, redirecting users, or defacing content. The vulnerability exists in how the plugin handles a specific block setting called 'blockId' without properly cleaning or escaping it before displaying it on the page.

• CVE-2026-12170MEDIUM 6.4

  AcyMailing, a popular WordPress newsletter and marketing automation plugin, contains a stored cross-site scripting (XSS) flaw in its 'alignment' attribute handler. Authenticated WordPress contributors and higher-privileged users can inject malicious scripts that persist in the database and execute in the browsers of anyone viewing the affected pages. This affects all versions up to and including 10.10.2.

• CVE-2026-12731MEDIUM 6.4

  The weDocs WordPress plugin, used for creating AI-powered knowledge bases and documentation sites, contains a security flaw in how it handles certain block settings. Attackers with contributor-level access or higher can embed malicious scripts into pages through two specific settings (sectionTitleTag and articleTitleTag). These scripts execute whenever anyone views the compromised page, potentially compromising visitor security or stealing sensitive information. The vulnerability affects all versions up to and including 2.3.0.

• CVE-2026-12732MEDIUM 6.4

  LearnPress, a popular WordPress learning management plugin, contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 4.4.0. An authenticated user with contributor-level permissions or higher can inject malicious JavaScript code into a course template using the 'class_wrapper_form' shortcode attribute. Because the payload is stored in the database, any visitor to the affected page will automatically execute the attacker's script, potentially allowing session hijacking, credential theft, or content manipulation.

• CVE-2026-12734MEDIUM 6.4

  The weDocs WordPress plugin, which provides AI-powered documentation and knowledge base functionality, contains a stored cross-site scripting (XSS) vulnerability affecting all versions up to 2.3.0. An authenticated user with contributor-level permissions or higher can inject malicious scripts into pages through the 'connectorWidth' block attribute. These scripts persist in the database and execute for every visitor who views the compromised page, potentially allowing attackers to steal session data, deface content, or redirect users to malicious sites.

• CVE-2026-12924MEDIUM 6.4

  The Eventin plugin for WordPress, used for event management and ticketing, has a stored cross-site scripting (XSS) flaw in its FAQ content feature. An authenticated user with contributor permissions or higher can inject malicious code into FAQ sections. This code runs in the browsers of anyone viewing the affected pages, potentially stealing session data, redirecting users, or defacing content. The vulnerability affects all versions up to 4.1.15.

• CVE-2026-13246MEDIUM 6.4

  GiveWP, a popular WordPress donation and fundraising plugin, contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 4.16.0. An authenticated user with author-level permissions or higher can embed malicious JavaScript code into campaign comment shortcodes. When other users view pages containing these injected shortcodes, the malicious code executes in their browsers, potentially stealing session data, modifying page content, or redirecting users to phishing sites. The vulnerability stems from improper sanitization of the 'block_id' attribute and insufficient output escaping when rendering the shortcode.

• CVE-2026-13247MEDIUM 6.4

  A WordPress plugin called Logo Slider contains a security flaw that allows attackers with contributor-level access or higher to inject malicious scripts into pages. These scripts execute whenever anyone visits the affected pages, potentially stealing data or performing unauthorized actions on behalf of visitors. The vulnerability exists in versions 5.5 and earlier due to improper handling of the 'lgx_tooltip_position' parameter.

• CVE-2026-13252MEDIUM 6.4

  The RSS Aggregator by Feedzy plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in how it handles the 'aspectRatio' attribute. An authenticated user with contributor-level permissions or higher can inject malicious JavaScript code into pages. When other users visit those pages, the injected script executes in their browsers, potentially allowing the attacker to steal session tokens, modify page content, or perform actions on behalf of legitimate users. The vulnerability affects all versions up to and including 5.2.1.

• CVE-2026-13253MEDIUM 6.4

  Ultimate Post, a WordPress plugin, contains a stored cross-site scripting (XSS) vulnerability in its Advanced Search block feature. Authenticated users with contributor-level permissions or higher can embed malicious scripts into page content through the 'moreResultsText' attribute. When other users view an affected page, those scripts execute in their browsers, potentially compromising their accounts or session data. The vulnerability exists in plugin versions up to 5.0.31 and requires contributor access to exploit, which limits but does not eliminate risk in multi-author WordPress environments.

• CVE-2026-13295MEDIUM 6.4

  The Page Builder by SiteOrigin plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with Contributor-level permissions or higher to inject malicious scripts into pages. When other users visit those pages, the injected scripts execute in their browsers, potentially allowing attackers to steal session cookies, redirect users, or perform actions on their behalf. This vulnerability affects all versions up to and including 2.34.3.

• CVE-2026-13335MEDIUM 6.4

  The CodePeople Post Map for Google Maps WordPress plugin contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 1.2.6. An authenticated user with Contributor role or higher can inject malicious JavaScript into map point data that will execute in the browsers of anyone viewing the affected page. This is a *stored* vulnerability, meaning the malicious code persists and executes repeatedly, making it more dangerous than reflected XSS attacks.

• CVE-2026-13443MEDIUM 6.4

  A security flaw in the Tutor LMS WordPress plugin allows authenticated users with author-level permissions or higher to embed malicious JavaScript code into lesson attachments. When other users view pages containing these attachments, the injected script executes in their browsers, potentially compromising their accounts or stealing sensitive data. The vulnerability affects all versions up to 3.9.13 and requires an authenticated attacker—this is not a zero-authentication threat, but poses real risk in multiuser WordPress environments where content creators may be compromised or malicious.

• CVE-2026-13704MEDIUM 6.4

  GiveWP, a popular WordPress donation and fundraising plugin, contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 4.16.1. An authenticated attacker with Give Worker-level permissions or higher can inject malicious JavaScript code through the plugin's image introduction field. This injected code persists in the database and executes whenever any user views the affected page, potentially leading to session hijacking, credential theft, or malware distribution. The vulnerability requires authentication but affects site visitors who may not realize they've been compromised.

• CVE-2026-13710MEDIUM 6.4

  A popular WordPress plugin called Jeg Kit for Elementor (Powerful Addons for Elementor, Widgets & Templates) contains a stored cross-site scripting (XSS) vulnerability in its Image Box widget. The vulnerability exists because user-supplied text in the description field is not properly cleaned before being displayed on web pages. An authenticated user with Contributor role or higher can inject malicious JavaScript code through the description parameter. When other users visit a page containing the injected widget, the malicious script executes in their browsers, potentially allowing session hijacking, credential theft, or other client-side attacks. The vulnerability affects versions up to and including 3.2.6.

• CVE-2026-13733MEDIUM 6.4

  The Download Manager plugin for WordPress contains a security flaw that allows contributors and higher-privileged users to inject malicious JavaScript code into pages. The vulnerability exists in how the plugin handles the 'no_data_msg' shortcode attribute—specifically, it fails to properly clean the attribute value before displaying it. An attacker with contributor access can craft a specially formatted payload that bypasses WordPress's standard content filtering and executes arbitrary scripts whenever someone visits an affected page. This is a stored vulnerability, meaning the malicious code persists in the database and affects all visitors.

• CVE-2026-13771MEDIUM 6.4

  The Customer Reviews for WooCommerce plugin contains a stored cross-site scripting (XSS) flaw in its shortcode color attribute. Authenticated users with contributor-level permissions or higher can inject malicious scripts into pages; when other users visit those pages, the scripts execute in their browsers. This vulnerability affects all versions through 5.113.0.

• CVE-2026-14343MEDIUM 6.4

  The Download Manager plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions through 3.3.61. Authenticated users with contributor-level access or higher can inject malicious scripts through the 'note_before' and 'note_after' shortcode attributes. When other users view pages containing these injected shortcodes, the malicious scripts execute in their browsers. This is a persistent vulnerability—the injected code remains stored in the WordPress database and continues to pose a risk each time affected pages are accessed.

• CVE-2026-15284MEDIUM 6.4

  King Addons for Elementor, a popular WordPress plugin, contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 51.1.62. An authenticated attacker with subscriber-level permissions or higher can inject malicious scripts through the form page ID parameter. When administrators or other users view certain pages, the injected script executes in their browser, potentially allowing the attacker to steal credentials, modify content, or perform unauthorized actions on behalf of those users.

• CVE-2026-15285MEDIUM 6.4

  The Plus Addons for Elementor WordPress plugin contained a security flaw in how it handled custom attributes on button widgets. Contributors and higher-privilege users could inject malicious JavaScript code that would be stored in the database and then executed in the browsers of site visitors or administrators who viewed the affected page. The vulnerability has been patched in version 6.4.12.

• CVE-2026-15292MEDIUM 6.4

  The Sudoku Shortcode plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level permissions or higher to inject malicious scripts into pages. When someone visits an affected page, the injected script runs in their browser. The vulnerability exists because the plugin doesn't properly filter user input in the 'background' parameter of the sudoku-sc shortcode. All versions up to 1.0.0 are affected.

• CVE-2026-15296MEDIUM 6.4

  The WP Affiliate Plugin (affiliate-toolkit) for WordPress contains a stored cross-site scripting (XSS) vulnerability in its product shortcode feature. An attacker with contributor-level or higher privileges can embed malicious scripts into pages through poorly sanitized shortcode attributes. When anyone visits an affected page, the injected script executes in their browser, potentially compromising their session, stealing credentials, or performing unauthorized actions. This vulnerability affects all versions up to 3.7.0 and represents a bypass of a previously patched flaw (CVE-2024-10227).

• CVE-2026-15299MEDIUM 6.4

  A stored cross-site scripting (XSS) vulnerability exists in the Animation Addons for Elementor WordPress plugin affecting all versions through 2.6.3. An authenticated user with Contributor-level permissions or higher can inject malicious scripts through the Weather widget's configuration settings. These scripts are saved to the database and executed in the browsers of all site visitors who view the affected page, potentially compromising user sessions, stealing credentials, or defacing content. The vulnerability requires the Weather widget to be properly configured with an OpenWeatherMap API key to trigger the vulnerable code path.

• CVE-2026-15301MEDIUM 6.4

  The BuddyHolis TableSearch plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions 1.1.0 and earlier. Attackers with Contributor-level access or higher can inject malicious scripts through the 'placeholder' parameter. These scripts persist in the database and execute whenever any user views the affected page, potentially stealing credentials, session tokens, or performing actions on behalf of victims.

• CVE-2026-1856MEDIUM 6.4

  The Appointment Booking Calendar plugin for WordPress has a stored cross-site scripting (XSS) flaw affecting all versions through 1.4.4. An attacker with Author-level WordPress access or higher can inject malicious scripts into custom booking field labels. These scripts persist in the database and execute whenever anyone views the affected page, potentially stealing session cookies, hijacking accounts, or redirecting users to malicious sites. The vulnerability requires authenticated access, which limits its attack surface but makes it a concern for organizations managing multiple WordPress contributors or where account compromise is possible.

• CVE-2026-2021MEDIUM 6.4

  The Slideshow Gallery LITE plugin for WordPress contains a vulnerability that allows authenticated users with contributor-level permissions or higher to embed malicious scripts into pages. When other users visit an affected page, those scripts execute in their browsers. This is a stored cross-site scripting (XSS) flaw affecting all versions through 1.8.5, caused by the plugin failing to properly sanitize and escape the 'alwaysauto' shortcode attribute.

• CVE-2026-2382MEDIUM 6.4

  The FPW Category Thumbnails WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.9.5. Any user with Subscriber-level access or higher can inject malicious JavaScript through the 'id' parameter in an AJAX function. This script persists in the plugin's settings and executes whenever an administrator views that page, potentially compromising administrator accounts. The vulnerability stems from the plugin failing to properly clean and escape user input before storing and displaying it.

• CVE-2026-2387MEDIUM 6.4

  A stored cross-site scripting (XSS) vulnerability exists in the Event Organiser WordPress plugin affecting all versions up to and including 3.12.9. Authenticated users with Contributor-level permissions or higher can inject malicious scripts into event list pages through the 'eo_events' shortcode's 'no_events' parameter. These scripts persist in the database and execute in the browsers of anyone viewing the affected pages, potentially compromising site visitors.

• CVE-2026-3011MEDIUM 6.4

  The Recipe Card Blocks Lite WordPress plugin contains a flaw that allows authenticated authors and above to inject malicious scripts into recipe blocks. These scripts execute when anyone views the published post or its print version, potentially compromising visitor sessions or redirecting them to malicious sites. The vulnerability exists because the plugin decodes special character sequences after security checks have already been completed, bypassing intended protections.

• CVE-2026-3251MEDIUM 6.4

  A stored cross-site scripting (XSS) vulnerability exists in Webremium Istanbul Web Design Mezunum Satiyorum versions 1.2.504 through 10072026. An authenticated attacker can inject malicious scripts into the application that will be permanently stored and executed in the browsers of other users who view the affected content. This allows credential theft, session hijacking, malware distribution, or defacement of the web application.

• CVE-2026-3297MEDIUM 6.4

  A vulnerability in the Pagelayer WordPress plugin allows users with contributor access or higher to inject malicious code into pages through the Anchor block feature. Because the plugin doesn't properly validate and escape user input, this injected code runs whenever anyone visits the affected page, potentially compromising site visitors or stealing their data.

• CVE-2026-3722MEDIUM 6.4

  A WordPress plugin called 'Auto Image Attributes From Filename With Bulk Updater' fails to properly clean and display user-supplied data in image metadata fields. This allows authenticated users with Author-level permissions or higher to embed malicious code into image properties. When site visitors view pages containing the injected image, that code runs in their browsers—potentially stealing session cookies, performing actions on their behalf, or redirecting them to malicious sites. The vulnerability affects all versions up to and including 4.9.

• CVE-2026-3907MEDIUM 6.4

  The Hostel WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in its booking shortcode feature. An authenticated user with Contributor-level permissions or higher can inject malicious JavaScript code into a page by crafting a specially-formed shortcode. When other users visit that page, the injected script executes in their browsers, potentially allowing the attacker to steal session cookies, deface content, or redirect users to malicious sites. The vulnerability exists in all versions up to 1.1.7 and stems from the plugin failing to properly sanitize and escape user input before displaying it on the page.

• CVE-2026-4080MEDIUM 6.4

  The Easy Cart plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its 'add_to_cart' shortcode. Attackers with Contributor-level access or above can inject malicious scripts into shortcode parameters that will execute for any user viewing the affected page. The vulnerability stems from incomplete sanitization—while HTML tags are stripped, quotation marks are not escaped, allowing attackers to break out of HTML attribute context and inject event handlers like onclick or onerror. All versions through 1.8 are affected.

• CVE-2026-4081MEDIUM 6.4

  The ZeM STL plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level permissions or higher to inject malicious scripts into website pages. When someone visits a page containing the injected script, their browser executes the attacker's code. This happens because the plugin doesn't properly clean or escape user input when processing shortcode parameters like 'url', 'color', and 'bgcolor'. All versions up to 1.0 are affected.

• CVE-2026-4334MEDIUM 6.4

  The Shariff Wrapper plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 4.6.20. Attackers with Contributor-level access or higher can inject malicious scripts through the 'headline' parameter in the [shariff] shortcode. When other users view the affected page, the injected code executes in their browsers, potentially enabling session hijacking, credential theft, or further compromise. The vulnerability stems from the plugin's use of a permissive HTML sanitization routine followed by unsafe string replacement operations that reintroduce dangerous content after the sanitization check.

• CVE-2026-4610MEDIUM 6.4

  The ProfileGrid plugin for WordPress, used for managing user profiles and community features, contains a security flaw that allows authenticated users (those with Subscriber level access or higher) to inject malicious scripts into pages. When other users visit those affected pages, the injected scripts execute in their browsers, potentially compromising their sessions or stealing data. The vulnerability affects all versions up to 5.9.9.2, though a partial fix was introduced in version 5.9.8.5.

• CVE-2026-4653MEDIUM 6.4

  The Block, Suspend, Report for BuddyPress plugin contains a stored cross-site scripting (XSS) vulnerability that allows any logged-in user with subscriber access or higher to inject malicious scripts into the plugin's pages. When other users visit those pages, the injected scripts execute in their browsers, potentially allowing attackers to steal session cookies, deface content, or perform actions on behalf of victims. The vulnerability exists in versions 3.6.4 and earlier due to the plugin failing to properly filter the 'link' parameter before displaying it.

• CVE-2026-4804MEDIUM 6.4

  The Zakra WordPress theme contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 4.2.0. An authenticated user with basic contributor permissions can inject malicious JavaScript into specific theme settings that gets saved and executed whenever anyone views the affected page. The vulnerability exists because the theme fails to validate user input through its REST API, even though it does sanitize input from the classic editor. This allows attackers to compromise visitor sessions and steal data without needing to exploit any other systems.

• CVE-2026-48167MEDIUM 6.4

  Filament, a popular Laravel development framework, contains a stored cross-site scripting (XSS) vulnerability in its ImageColumn and ImageEntry components. These components display database images without sanitizing the underlying data, allowing an attacker to inject malicious HTML or JavaScript. If an attacker can control the image data stored in the database—typically through an application feature that accepts user uploads or metadata—the injected code executes when other users view the affected table or schema. This is a persistence risk: the attack payload stays in the database and impacts every user who accesses that view.

• CVE-2026-50592MEDIUM 6.4

  Znuny, a widely-used open-source helpdesk and ticketing platform, contains a reflected cross-site scripting (XSS) vulnerability in its administrative communication log interface. An authenticated attacker with login credentials can craft a malicious URL containing injected JavaScript that executes in the browser of another administrator viewing the communication logs. This could allow credential theft, session hijacking, or other actions performed on behalf of the compromised administrator. The vulnerability affects Znuny LTS versions before 6.5.21 and Znuny versions before 7.3.3.

• CVE-2026-5220MEDIUM 6.4

  DivvyDrive, a file collaboration and sharing platform by DivvyDrive Information Technologies Inc., contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into the application. When other users access pages containing this injected content, the malicious code executes in their browsers, potentially allowing attackers to steal session tokens, modify data, or perform actions on behalf of victims. The vulnerability affects versions 4.8.2.23 through 4.8.3.0; version 4.8.3.1 and later resolve the issue.

• CVE-2026-52781MEDIUM 6.4

  OpenProject, a popular open-source project management platform, contains a vulnerability in how it sanitizes HTML content in work package descriptions. An attacker with login credentials can inject malicious code that exploits Stimulus.js, a JavaScript framework, to automatically execute commands in the browsers of other authenticated users. This could redirect victims to phishing sites or other attacker-controlled locations without their knowledge. The flaw affects all versions before 17.3.3 and 17.4.1.

• CVE-2026-53987MEDIUM 6.4

  A vulnerability in the Tag plugin for GLPI 11 allows authenticated users with tag management privileges to inject malicious HTML code into tag names. Because the plugin fails to sanitize tag names when storing them and doesn't escape output when displaying tags in Kanban views, the injected code executes in the browsers of any user viewing tickets, problems, changes, or projects that use those tags. This is a stored cross-site scripting (XSS) vulnerability that persists until the malicious tag is removed.

• CVE-2026-5714MEDIUM 6.4

  The Enable Media Replace plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with Author-level permissions or higher to inject malicious scripts into pages. When other users visit those pages, the injected scripts execute in their browsers, potentially compromising their accounts, stealing session data, or performing actions on their behalf. The vulnerability exists in all versions up to and including 4.1.8 and results from the plugin's failure to properly sanitize and escape the 'location_dir' parameter.

• CVE-2026-6275MEDIUM 6.4

  The StatCounter – Free Real Time Visitor Stats WordPress plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated authors to inject malicious scripts into their posts. When any visitor views a post authored by an attacker, the injected script executes in their browser. The vulnerability exists because the plugin fails to properly escape the author's nickname before outputting it into JavaScript code on every post page.

• CVE-2026-6427MEDIUM 6.4

  The a3 Lazy Load WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions through 2.7.6. An attacker with Contributor-level permissions can craft a malicious video element that exploits a regex parsing bug in the plugin's video filtering logic. When this crafted content is viewed by any site user—including administrators—malicious JavaScript executes in their browser. The vulnerability stems from improper quote handling in HTML attribute processing, combined with unescaped output in the admin interface.

• CVE-2026-6459MEDIUM 6.4

  A WordPress plugin called Essential Addons for Elementor has a security flaw in its Event Calendar widget that allows content creators and administrators to inject malicious code into web pages. When visitors view those pages, the injected code runs in their browsers, potentially allowing attackers to steal session cookies, redirect users, or perform actions on their behalf. The vulnerability exists because the plugin doesn't properly clean or escape event titles pulled from The Events Calendar. Only users with Author-level permissions or higher can exploit this, so it requires insider access or a compromised legitimate account.

• CVE-2026-6740MEDIUM 6.4

  The Nexter Blocks plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'commentIcon' parameter that affects all versions through 4.7.4. An authenticated attacker with contributor-level or higher permissions can inject malicious JavaScript code that persists in page content. When any user visits an affected page, the injected script executes in their browser, potentially compromising their session, stealing credentials, or performing unauthorized actions on their behalf.

• CVE-2026-6742MEDIUM 6.4

  The Advanced iFrame plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its 'additional' parameter that allows authenticated users with contributor-level permissions or higher to inject malicious scripts into pages. When other users view those pages, the injected code executes in their browsers, potentially compromising data or sessions. The vulnerability affects all versions up to and including 2026.1 and stems from inadequate input validation and output encoding.

• CVE-2026-6910MEDIUM 6.4

  The Bookero.pl online reservation system plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 2.2. An authenticated user with contributor privileges or higher can embed malicious JavaScript code into pages using the plugin's shortcode attributes. When other users visit those pages, the injected script executes in their browsers, potentially compromising their accounts or stealing sensitive information. The vulnerability exists because the plugin fails to properly sanitize and escape user input before embedding it directly into JavaScript code.

• CVE-2026-7662MEDIUM 6.4

  The ePaperFlip Publisher plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with Contributor-level permissions or higher to inject malicious scripts into pages. When other users view those pages, the injected scripts execute in their browsers, potentially compromising their accounts or stealing sensitive information. The vulnerability affects all versions up to and including version 1 and stems from the plugin failing to properly filter and escape user input in the 'publicationid' shortcode attribute before inserting it into JavaScript code.

• CVE-2026-7795MEDIUM 6.4

  The Click to Chat – WA Widget plugin for WordPress contains a flaw that allows authenticated users with basic contributor permissions to inject malicious code into pages. When someone clicks the WhatsApp chat button on an affected site, the injected code executes in their browser. The vulnerability stems from improper handling of a shortcode parameter: the plugin escapes user input in a way that works for HTML attributes, but that escaping is later decoded by browsers when the value appears inside a JavaScript function call within an event handler. This creates a window for attackers to break out of the intended string context and run arbitrary JavaScript.

• CVE-2026-7796MEDIUM 6.4

  The EmbedPress WordPress plugin, used for embedding PDFs, videos, and other rich media content, contains a stored cross-site scripting (XSS) vulnerability that allows attackers with contributor-level access to inject malicious scripts into pages. When other users visit those pages, the injected scripts execute in their browsers, potentially allowing attackers to steal credentials, perform unauthorized actions, or compromise user sessions. This affects all versions up to and including 4.5.3.

• CVE-2026-8039MEDIUM 6.4

  The Fancy Testimonials plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in how it handles the 'author' attribute of the testimonial shortcode. An authenticated user with Contributor-level permissions or higher can insert malicious JavaScript into a page through this attribute. That script then executes in the browsers of anyone who visits the affected page. Because the malicious code is permanently stored in the page content, every visitor becomes a potential victim—making this a stored XSS rather than a one-time reflected attack.

• CVE-2026-8351MEDIUM 6.4

  The RTMKit plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its Advanced Heading widget. An authenticated user with contributor-level permissions or higher can inject malicious JavaScript into the 'Background Text' parameter, which gets saved to the database and executes whenever any site visitor loads the affected page. This is a persistence risk because the payload remains embedded in your content until manually removed.

• CVE-2026-8489MEDIUM 6.4

  The Ultimate Member WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in its user profile 'about_me' field. Authenticated users with subscriber-level permissions can inject malicious JavaScript code that persists in the database and executes in the browsers of anyone viewing the affected profile or related pages. This is a stored variant, meaning the attack payload remains active until manually removed, creating ongoing exposure for site visitors.

• CVE-2026-8494MEDIUM 6.4

  Permalink Manager Lite, a WordPress plugin, contains a security flaw in its admin interface that allows contributors and higher-level users to embed malicious scripts into post titles. When an administrator later visits the Permalink Manager page, that script executes in their browser. The vulnerability exists in all versions up to 2.5.3.3 and requires an authenticated attacker with at least contributor privileges to exploit.

• CVE-2026-8599MEDIUM 6.4

  MailerPress, a popular WordPress plugin for email marketing and automation, contains a vulnerability that allows attackers with author-level or higher permissions to inject malicious scripts into campaign content. These scripts execute when administrators preview the campaigns in the WordPress dashboard. The vulnerability stems from the plugin not properly filtering user input when storing campaign HTML, nor adequately escaping that content when displaying it. The public-facing preview that customers see is protected by security headers, so the risk is primarily to the WordPress site's admin users rather than to recipients of sent emails.

• CVE-2026-8607MEDIUM 6.4

  The myCred WordPress plugin, used for managing loyalty points, badges, and gamification features, contains a stored cross-site scripting (XSS) vulnerability in its shortcode functionality. An attacker with contributor-level or higher access to WordPress can craft malicious code within a shortcode attribute that will execute in the browsers of all users who visit the affected page. This is a persistent attack—the malicious script remains embedded in the site until removed—rather than a one-time exploitation attempt.

• CVE-2026-8613MEDIUM 6.4

  The aThemes Addons for Elementor plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in multiple widget components. A WordPress contributor or higher-privilege user can inject malicious JavaScript into page settings that will execute in the browsers of any visitor to that page. The vulnerability exists in the Posts Timeline widget and Posts Carousel widget (across its default, Banner, and Modern variants) due to missing input validation on the 'title_tag' setting. The same plugin's Posts List widget correctly implements this validation, indicating the flaw is inconsistently applied across the codebase.

• CVE-2026-8677MEDIUM 6.4

  Prime Elementor Addons, a WordPress plugin for building pages with Elementor, has a stored cross-site scripting (XSS) vulnerability that allows contributors and higher-privileged users to inject malicious scripts into pages. When other users view those pages, the injected scripts execute in their browsers, potentially compromising their sessions or stealing sensitive information. The vulnerability persists through versions up to 1.3.3 because the plugin fails to properly sanitize widget HTML settings before storing them.

• CVE-2026-8841MEDIUM 6.4

  The Extra Settings for RocketChat plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 0.1. A WordPress user with contributor-level permissions or higher can craft a malicious 'title' attribute in the 'rocketchat' shortcode to inject JavaScript code into a page. When other users visit that page, the injected script executes in their browser within the site's context, potentially allowing the attacker to steal credentials, perform actions on their behalf, or deface content.

• CVE-2026-8865MEDIUM 6.4

  The Avalon23 Products Filter for WooCommerce plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated WordPress contributors and higher-privileged users to inject malicious JavaScript into pages via the 'avalon23_qr' shortcode. When other users visit an affected page, the injected script executes in their browsers, potentially compromising their accounts or stealing sensitive data. The vulnerability exists because the plugin fails to properly sanitize and escape user input in shortcode attributes before displaying them in HTML.

• CVE-2026-8880MEDIUM 6.4

  The RomanCart Ecommerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its shortcode handler. An authenticated user with contributor permissions or higher can inject malicious JavaScript code into pages through the romancart_button shortcode's attributes. Once injected, that code executes for every visitor who views the affected page, potentially leading to session hijacking, credential theft, or defacement. The vulnerability exists in versions 2.0.8 and earlier due to inadequate input validation and output encoding.

• CVE-2026-8882MEDIUM 6.4

  A WordPress plugin called WP ApplicantStack Jobs Display contains a security flaw that allows certain logged-in users to inject malicious code into web pages. When other users visit those pages, the injected code runs in their browsers, potentially compromising their accounts or stealing sensitive information. The vulnerability affects all versions up to and including 1.1.1 and requires the attacker to have at least contributor-level permissions on the WordPress site.

• CVE-2026-8883MEDIUM 6.4

  The Global Body Mass Index Calculator WordPress plugin contains a stored cross-site scripting (XSS) flaw affecting versions 1.2 and earlier. Attackers with contributor-level access can inject malicious scripts through the plugin's shortcode functionality. These scripts persist in the database and execute whenever site visitors view affected pages, potentially compromising user sessions, stealing credentials, or spreading malware across your WordPress site.

• CVE-2026-8885MEDIUM 6.4

  The DeMomentSomTres Shortcodes plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its 'callout' shortcode feature. An authenticated user with contributor-level permissions or higher can inject malicious JavaScript code through the 'width' and 'align' shortcode parameters. Because the plugin fails to properly sanitize and escape these inputs, the injected code executes whenever any visitor views the affected page. This creates a persistent threat that compromises site visitors, not just the page editor.

• CVE-2026-8892MEDIUM 6.4

  The CM Business Directory plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated contributors to inject malicious code into business address fields. Unlike typical WordPress vulnerabilities, this flaw bypasses the standard HTML filtering mechanism because the malicious payload is stored in metadata rather than post content. Once injected, the script executes whenever anyone views pages displaying that business directory data, potentially affecting site visitors and administrators.

• CVE-2026-8893MEDIUM 6.4

  A stored cross-site scripting (XSS) vulnerability exists in the Express Payment For Stripe WordPress plugin up to version 1.28.0. Authenticated users with contributor-level permissions or higher can embed malicious scripts into pages using the [stripe-express] shortcode. These scripts execute in the browsers of anyone viewing the affected page, potentially allowing attackers to steal session cookies, redirect users, or perform actions on their behalf. The vulnerability stems from the plugin failing to properly escape shortcode attribute values before rendering them in HTML.

• CVE-2026-8895MEDIUM 6.4

  A WordPress plugin called 'kk blog card' contains a security flaw that allows contributors and higher-level users to embed malicious scripts into pages. When someone visits a page with the injected code, the script runs automatically in their browser. The vulnerability exists in versions 1.3 and earlier, and stems from the plugin not properly filtering user input before inserting it into HTML code.

• CVE-2026-8896MEDIUM 6.4

  The MIR blocks and shortcodes WordPress plugin contains a vulnerability that allows authenticated users with contributor-level permissions or higher to embed malicious code into pages. When someone visits an affected page, that malicious code runs in their browser. The vulnerability exists because the plugin doesn't properly clean user input in its 'msc_stats' shortcode—specifically in the 'title' and 'ready_animation_text' attributes. While this requires an attacker to already have login access to WordPress, it's a serious risk for multi-user sites or those with guest contributor roles.

• CVE-2026-8900MEDIUM 6.4

  The Simple SEO Slideshow WordPress plugin has a security flaw that allows authenticated users with contributor-level permissions or higher to inject malicious scripts into pages. When someone visits a page containing this injected code, the script executes in their browser—including for administrators. The vulnerability exists because the plugin does not properly filter user input when processing shortcode attributes, even though WordPress has built-in protections that should catch this. All versions through 1.2.8 are affected.

• CVE-2026-8977MEDIUM 6.4

  The WP GDPR Cookie Consent plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with subscriber-level permissions or higher to inject malicious JavaScript code into website pages. When other users visit an affected page, the injected script executes in their browsers, potentially allowing attackers to steal session tokens, redirect visitors, inject malware, or perform other actions on behalf of legitimate users. The vulnerability exists because the plugin fails to properly validate user input and safely display stored configuration settings.

• CVE-2026-9019MEDIUM 6.4

  The Easy Image Collage plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.13.6. Attackers with author-level access or higher can inject malicious scripts into posts or pages through image collage settings. When other users view these pages, the injected scripts execute in their browsers, potentially stealing credentials, redirecting traffic, or performing actions on their behalf. The vulnerability persists because the plugin stores user input in post metadata without proper sanitization, bypassing WordPress's standard HTML restriction controls that normally protect against this type of attack.