Vulnerability database

15,901 results · page 41 of 319

• May 27, 2026NS Product icon badge: Reflected Cross-Site ScriptingCVE-2026-8707 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The NS Product icon badge plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  NS Product icon badge

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update NS Product icon badge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 27, 2026Endless Scroll: Stored Cross-Site ScriptingCVE-2026-8703 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Endless Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Endless Scroll

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Endless Scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 27, 2026GBI To Print: Stored Cross-Site Scripting in version 1CVE-2026-8702 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The GBI To Print plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0 via the 'div' attribute of the 'gbitoprint' shortcode. This is due to insufficient output escaping in the gbi_toprint_shortcode() function, which concatenates the raw shortcode attribute value directly into an HTML attribute without applying esc_attr() or any other sanitization. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  GBI To Print

  What to do

  Update GBI To Print to the newest version.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• May 27, 2026GNTT Post Title Ticker: Stored Cross-Site Scripting in version 1CVE-2026-8701 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The GNTT Post Title Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0 via the `title-ticker-slide`, `title-ticker-fade`, and `title-ticker-typing` shortcodes. This is due to insufficient input sanitization and output escaping on shortcode attributes (notably `border`, `width`, `height`, `header_background`, `header_text_color`, and `id`) within the `gntt_title_ticker_slide()`, `gntt_title_ticker_fade()`, and `gntt_title_ticker_typing()` functions. None of these attribute values are passed through `esc_attr()` or any other escaping function before being concatenated into HTML output. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  GNTT Post Title Ticker

  What to do

  Update GNTT Post Title Ticker to the newest version.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 27, 2026Cryptocurrency Prijsvergelijking Widget: Stored Cross-Site Scripting in version 1CVE-2026-8698 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Cryptocurrency Prijsvergelijking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0. This is due to insufficient output escaping in the as_get_coin_shortcode() function, which renders the 'width' (and 'height') shortcode attribute directly into the style attribute of an <iframe> element without applying any escaping function such as esc_attr(). An attacker-controlled value like '100px;"onload="alert(1)" x="' terminates the style attribute prematurely and injects an arbitrary HTML attribute into the iframe tag. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Cryptocurrency Prijsvergelijking Widget

  What to do

  Update Cryptocurrency Prijsvergelijking Widget to the newest version.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 27, 2026My Email Shortcode: Stored Cross-Site ScriptingCVE-2026-8048 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The My Email Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subject' shortcode attribute in the 'my-email' shortcode in all versions up to, and including, 0.91 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  My Email Shortcode

  Affected

  up to 0.91

  What to do

  Affects up to 0.91. Update My Email Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 27, 2026faq shortocde: Stored Cross-Site ScriptingCVE-2026-8040 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The faq shortocde plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' shortcode attribute in the 'faq' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  faq shortocde

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update faq shortocde to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 27, 2026Old Posts Highlighter: Cross-Site Request ForgeryCVE-2026-7614 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Old Posts Highlighter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the OPH_options function. This makes it possible for unauthenticated attackers to update the plugin's configuration settings without authorization via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Old Posts Highlighter

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Old Posts Highlighter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 27, 2026CM Ad Changer – A simple tool to control and optimize your site's banners: Cross-Site Request ForgeryCVE-2026-9236 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The CM Ad Changer – A simple tool to control and optimize your site's banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the cmac_campaigns_action function. This makes it possible for unauthenticated attackers to permanently delete arbitrary advertising campaigns, including their associated banner records and uploaded files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  CM Ad Changer – A simple tool to control and optimize your site's banners

  Affected

  up to 2.0.7

  What to do

  Affects up to 2.0.7. Update CM Ad Changer – A simple tool to control and optimize your site's banners to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 27, 2026ShopLentor - WooCommerce Builder for Elementor & Gutenberg: Stored Cross-Site ScriptingCVE-2026-6287 · WordPress plugins & themes · reported by WordfenceMedium 5.4

  The ShopLentor - WooCommerce Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blockUniqId' block attribute in multiple Product Gride blocks in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  ShopLentor - WooCommerce Builder for Elementor & Gutenberg

  Affected

  up to 3.3.8

  What to do

  Affects up to 3.3.8. Update ShopLentor - WooCommerce Builder for Elementor & Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• May 27, 2026Splide Carousel Block: Stored Cross-Site ScriptingCVE-2026-9022 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Splide Carousel Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'url' Block Attribute in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload must be published before it executes for site visitors, which requires an editor or administrator to approve and publish the contributor's post.

  Product

  Splide Carousel Block

  Affected

  up to 1.7.1

  What to do

  Affects up to 1.7.1. Update Splide Carousel Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 26, 2026Style Kits – Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns: Stored Cross-Site ScriptingCVE-2026-6565 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Style Kits – Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '/wp-json/agwp/v1/tokens/save' endpoint kit title parameter in versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping in an admin attribute context. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Style Kits – Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns

  Affected

  up to 2.5.0

  What to do

  Affects up to 2.5.0. Update Style Kits – Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• May 26, 2026Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery (CSRF).CVE-2026-8174 · WordPress plugins & themes · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 5.7

  Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery (CSRF). This issue affects Zoho Mail wordpress plugin versions before 1.6.2.

  Fixed in

  1.6.2

  What to do

  Update the plugin to 1.6.2 or newer.

  Full record and what to do →NVD recordwordpress.org

• May 26, 2026Geo Mashup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27427 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup allows Stored XSS. This issue affects Geo Mashup: from n/a through 1.13.18.

  Product

  Geo Mashup

  Affected

  up to 1.13.18

  What to do

  Affects up to 1.13.18. Update Geo Mashup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 25, 2026WP Activity Log: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-45435 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-Based XSS. This issue affects WP Activity Log: from n/a through 5.6.3.

  Product

  WP Activity Log

  Affected

  up to 5.6.3

  What to do

  Affects up to 5.6.3. Update WP Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 25, 2026CformsII: Cross-Site Request Forgery (CSRF)CVE-2026-39436 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in bgermann CformsII allows Cross Site Request Forgery. This issue affects CformsII: from n/a through 15.1.3.

  Product

  CformsII

  Affected

  up to 15.1.3

  What to do

  Affects up to 15.1.3. Update CformsII to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 25, 2026WPSubscription: Cross-Site Request Forgery (CSRF)CVE-2026-24554 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Convers Lab WPSubscription allows Cross Site Request Forgery. This issue affects WPSubscription: from n/a through 1.9.1.

  Product

  WPSubscription

  Affected

  up to 1.9.1

  What to do

  Affects up to 1.9.1. Update WPSubscription to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 25, 2026Team Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62745 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Team Showcase allows Stored XSS. This issue affects Team Showcase: from n/a through 1.22.28.

  Product

  Team Showcase

  Affected

  up to 1.22.28

  What to do

  Affects up to 1.22.28. Update Team Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 25, 2026Organization chart: Cross-Site Request Forgery (CSRF)CVE-2026-24597 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Organization chart allows Cross Site Request Forgery. This issue affects Organization chart: from n/a through 1.7.5.

  Product

  Organization chart

  Affected

  up to 1.7.5

  What to do

  Affects up to 1.7.5. Update Organization chart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 25, 2026Export WP Page to Static HTML/CSS: Cross-Site Request Forgery (CSRF)CVE-2026-24574 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in Recorp Export WP Page to Static HTML/CSS allows Cross Site Request Forgery. This issue affects Export WP Page to Static HTML/CSS: from n/a through 6.0.0.

  Product

  Export WP Page to Static HTML/CSS

  Affected

  up to 6.0.0

  What to do

  Affects up to 6.0.0. Update Export WP Page to Static HTML/CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 22, 2026Widget Context: Cross-Site Request ForgeryCVE-2026-7615 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Widget Context plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.3. This is due to missing or incorrect nonce validation on the save_widget_context_settings function. This makes it possible for unauthenticated attackers to modify widget visibility context settings stored in the WordPress options table via a forged POST request to /wp-admin/widgets.php via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Widget Context

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update Widget Context to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org

• May 22, 2026Draft List: Stored Cross-Site ScriptingCVE-2026-9104 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Draft Post Title in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unescaped injection path is triggered specifically when the viewing user lacks edit capabilities, meaning payloads embedded in draft post titles via attribute-breakout techniques execute for unauthenticated users and subscribers.

  Product

  Draft List

  Affected

  up to 2.6.3

  What to do

  Affects up to 2.6.3. Update Draft List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 22, 2026KIA Subtitle: Stored Cross-Site ScriptingCVE-2026-7509 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The KIA Subtitle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `the-subtitle` shortcode `before` and `after` attributes in all versions up to, and including, 4.0.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  KIA Subtitle

  Affected

  up to 4.0.1

  What to do

  Affects up to 4.0.1. Update KIA Subtitle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 22, 2026CBX 5 Star Rating & Review: Reflected Cross-Site ScriptingCVE-2026-6864 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The CBX 5 Star Rating & Review plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

  Product

  CBX 5 Star Rating & Review

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update CBX 5 Star Rating & Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 22, 2026Alfie – Feed: Cross-Site Request ForgeryCVE-2026-4070 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Alfie – Feed Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the alfie_manage() function which handles feed deletion via the 'delete' GET parameter. This makes it possible for unauthenticated attackers to delete arbitrary plugin feed data (from alfie_colindex, alfie_producten, alfie_reactions, and alfie_searchproduct tables) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Alfie – Feed

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Alfie – Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 22, 2026WP Blockade: Reflected Cross-Site ScriptingCVE-2026-3481 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The WP Blockade plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode' parameter in all versions up to and including 0.9.14. This is due to insufficient input sanitization and output escaping in the render_shortcode_preview() function. The function receives user input from $_GET['shortcode'], passes it through stripslashes() without any sanitization, and then outputs it directly via echo do_shortcode($shortcode) on line 393. When the input is not a valid WordPress shortcode (e.g., an HTML tag with JavaScript event handlers), do_shortcode() returns it unchanged, and it is reflected into the page without escaping. The endpoint is registered via admin_post_ (not admin_post_nopriv_), meaning it requires the user to be logged in with at minimum a Subscriber-level account. There is no nonce verification or additional capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute if they can successfully trick a user into performing an action such as clicking a link.

  Product

  WP Blockade

  Affected

  up to 0.9.14

  What to do

  Affects up to 0.9.14. Update WP Blockade to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 21, 2026Avada (Fusion) Builder: Stored Cross-Site ScriptingCVE-2026-1543 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 3.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user (typically an administrator) accesses a page displaying dynamic user data (such as via the Dynamic Data feature pulling user biographical information).

  Product

  Avada (Fusion) Builder

  Affected

  up to 3.15.2

  What to do

  Affects up to 3.15.2. Update Avada (Fusion) Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordavada.comthemeforest.net

• May 21, 2026WPB Floating Menu & Categories for WordPress – Sticky Side Menu with Icons: Stored Cross-Site ScriptingCVE-2026-4811 · WordPress plugins & themes · reported by WordfenceMedium 4.9

  The WPB Floating Menu & Categories for WordPress – Sticky Side Menu with Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Icon CSS Class' category field in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  WPB Floating Menu & Categories for WordPress – Sticky Side Menu with Icons

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update WPB Floating Menu & Categories for WordPress – Sticky Side Menu with Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• May 20, 2026Cost of Goods by PixelYourSite: Stored Cross-Site ScriptingCVE-2026-7613 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Cost of Goods by PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csvdata[0][cost_of_goods_value]' parameter in versions up to, and including, 1.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Cost of Goods by PixelYourSite

  Affected

  up to 1.2.12

  What to do

  Affects up to 1.2.12. Update Cost of Goods by PixelYourSite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpixelyoursite.comwordfence.com

• May 20, 2026Visualizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24573 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Visualizer allows Stored XSS. This issue affects Visualizer: from n/a before 4.0.0.

  Product

  Visualizer

  Fixed in

  4.0.0

  What to do

  Update Visualizer to 4.0.0 or newer.

  Full record and what to do →NVD recordpatchstack.com

• May 20, 2026Anomify AI – Anomaly Detection and Alerting: Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS)CVE-2026-6405 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Anomify AI – Anomaly Detection and Alerting plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in versions up to and including 0.3.6. This is due to missing nonce verification on the settings page handler and insufficient output escaping in the admin_options.php template. The settings form includes no wp_nonce_field() and the handler performs no check_admin_referer() check, meaning any cross-origin POST can modify plugin settings. The API key field is sanitized only with sanitize_text_field(), which strips HTML tags but does not encode double-quote characters; the value is then rendered into an HTML attribute via bare echo without esc_attr(), allowing a double-quote attribute-escape payload to survive both sanitization and storage. This makes it possible for unauthenticated attackers to inject arbitrary web scripts by tricking a logged-in administrator into visiting a malicious page that submits a forged request, storing the payload in the database and causing it to execute in the administrator's browser whenever the plugin settings page is visited.

  Product

  Anomify AI – Anomaly Detection and Alerting

  Affected

  up to 0.3.6

  What to do

  Affects up to 0.3.6. Update Anomify AI – Anomaly Detection and Alerting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 20, 2026AI Chatbot & Workflow Automation by AIWU: Stored Cross-Site ScriptingCVE-2026-2955 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' header in versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Practical exploitation is constrained due to a 20-character storage limit.

  Product

  AI Chatbot & Workflow Automation by AIWU

  Affected

  up to 1.4.14

  What to do

  Affects up to 1.4.14. Update AI Chatbot & Workflow Automation by AIWU to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• May 19, 2026Correct Prices: Reflected Cross-Site ScriptingCVE-2026-8627 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Correct Prices plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $_SERVER['PHP_SELF'] variable in versions up to and including 1.0. This is due to the correct_prices_page() function echoing $_SERVER['PHP_SELF'] into a form's action attribute without any input sanitization or output escaping (such as esc_url() or esc_attr()). Because PHP_SELF reflects attacker-controlled path-info appended to the script URL, an attacker can break out of the attribute and inject arbitrary markup. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.

  Product

  Correct Prices

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Correct Prices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• May 19, 2026SponsorMe: Reflected Cross-Site ScriptingCVE-2026-8626 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The SponsorMe plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The PHP_SELF value is reflected in two separate locations within the vulnerable function — a form action attribute and an anchor href attribute — both of which can be exploited by appending a crafted payload to the wp-admin/admin.php URL path.

  Product

  SponsorMe

  Affected

  up to 0.5.2

  What to do

  Affects up to 0.5.2. Update SponsorMe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 19, 2026LJ comments import: reloaded: Reflected Cross-Site ScriptingCVE-2026-8624 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The LJ comments import: reloaded plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and including, 0.97.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability arises specifically because PHP_SELF includes attacker-controllable PATH_INFO appended to the script name, and there are two distinct unsanitized echo points for this value in the same function.

  Product

  LJ comments import: reloaded

  Affected

  up to 0.97.1

  What to do

  Affects up to 0.97.1. Update LJ comments import: reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 19, 2026Remove Yellow BGBOX: Cross-Site Request ForgeryCVE-2026-8424 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Remove Yellow BGBOX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'rybb_api_settings' page. This makes it possible for unauthenticated attackers to reset the plugin's stored settings by overwriting its configuration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Remove Yellow BGBOX

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Remove Yellow BGBOX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 19, 2026JaviBola Custom Theme Test: Cross-Site Request ForgeryCVE-2026-8423 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The JaviBola Custom Theme Test plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on the options page. This makes it possible for unauthenticated attackers to change the site's active theme by modifying the jbct_theme option via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  JaviBola Custom Theme Test

  Affected

  up to 2.0.5

  What to do

  Affects up to 2.0.5. Update JaviBola Custom Theme Test to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 19, 2026BLOGCHAT Chat System: Cross-Site Request ForgeryCVE-2026-8420 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The BLOGCHAT Chat System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.6.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  BLOGCHAT Chat System

  Affected

  up to 1.3.6.3

  What to do

  Affects up to 1.3.6.3. Update BLOGCHAT Chat System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 19, 2026Amazon Scraper: Cross-Site Request ForgeryCVE-2026-8419 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Amazon Scraper plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Amazon Scraper

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Amazon Scraper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 19, 2026Games Catalog: Cross-Site Request ForgeryCVE-2026-8418 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Games Catalog plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.0. This is due to missing or incorrect nonce validation on the gc_crud() function which handles the delete action (action=delete) via a GET request without any wp_verify_nonce() / check_admin_referer() call. This makes it possible for unauthenticated attackers to delete arbitrary game catalog entries (including the associated WordPress post created for the game) via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Games Catalog

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Games Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 19, 2026Faces of Users: Stored Cross-Site ScriptingCVE-2026-8038 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Faces of Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in the 'facesofusers' shortcode in all versions up to, and including, 0.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Faces of Users

  Affected

  up to 0.0.3

  What to do

  Affects up to 0.0.3. Update Faces of Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 19, 2026VatanSMS WP SMS: Reflected Cross-Site ScriptingCVE-2026-7462 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The VatanSMS WP SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `page` parameter in all versions up to, and including, 1.01. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

  Product

  VatanSMS WP SMS

  Affected

  up to 1.01

  What to do

  Affects up to 1.01. Update VatanSMS WP SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 19, 2026ProSolution WP Client: Arbitrary File UploadCVE-2026-6555 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0. This is due to an array validation mismatch where only the first file in the upload array undergoes extension and MIME type validation, while all files are processed and uploaded to a web-accessible directory. This makes it possible for unauthenticated attackers to upload malicious PHP files and achieve remote code execution by sending a valid first file followed by a malicious file.

  Product

  ProSolution WP Client

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update ProSolution WP Client to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 19, 2026Logo Manager For Enamad: Stored Cross-Site ScriptingCVE-2026-6549 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Logo Manager For Enamad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute of the `vc_enamad_namad`, `vc_enamad_shamed`, and `vc_enamad_custom` shortcodes in all versions up to, and including, 0.7.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Logo Manager For Enamad

  Affected

  up to 0.7.4

  What to do

  Affects up to 0.7.4. Update Logo Manager For Enamad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 19, 2026Bigfishgames Syndicate: Cross-Site Request ForgeryCVE-2026-6452 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Bigfishgames Syndicate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the bigfishgames_syndicate_submenu() function. This makes it possible for unauthenticated attackers to reset plugin settings and update them via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Bigfishgames Syndicate

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Bigfishgames Syndicate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 19, 2026Anomify AI – Anomaly Detection and Alerting: Stored Cross-Site ScriptingCVE-2026-6404 · WordPress plugins & themes · reported by WordfenceMedium 4.4

  The Anomify AI – Anomaly Detection and Alerting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'anomify_api_key' parameter in versions up to and including 0.3.6. This is due to insufficient input sanitization and missing output escaping: the plugin applies sanitize_text_field() to the Metric Data Key input before saving it via update_option(), but sanitize_text_field() strips HTML tags without encoding double-quote characters, and the value is then echoed directly into an HTML attribute context (value="...") without esc_attr(). This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts that execute whenever a user visits the plugin's settings page.

  Product

  Anomify AI – Anomaly Detection and Alerting

  Affected

  up to 0.3.6

  What to do

  Affects up to 0.3.6. Update Anomify AI – Anomaly Detection and Alerting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 19, 2026Bottom Bar: Cross-Site Request ForgeryCVE-2026-6401 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Bottom Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.1.7. This is due to missing nonce verification on the plugin's settings update forms handled in bottom-bar-admin.php. None of the three settings forms (main settings, sharing services, restore defaults) include a wp_nonce_field(), and the server-side processing code never calls check_admin_referer() or any equivalent nonce validation before processing POST data and calling update_option(). This makes it possible for unauthenticated attackers to trick a logged-in administrator into submitting a crafted request that updates plugin configuration options, such as changing the language, maximum post counts, or enabled sharing services.

  Product

  Bottom Bar

  Affected

  up to 0.1.7

  What to do

  Affects up to 0.1.7. Update Bottom Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 19, 2026Child Height Predictor by Ostheimer: Cross-Site Request ForgeryCVE-2026-6400 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Child Height Predictor by Ostheimer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.3. This is due to missing nonce verification in the options() function, which handles plugin settings updates. The form template does not include a wp_nonce_field() call, and the handler never calls check_admin_referer() or wp_verify_nonce(). This makes it possible for unauthenticated attackers to trick a site administrator into clicking a link or visiting a malicious page that submits a forged POST request, causing unauthorized changes to the plugin settings such as unit preferences to be persisted to the database via update_option().

  Product

  Child Height Predictor by Ostheimer

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Child Height Predictor by Ostheimer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 19, 2026General Options: Stored Cross-Site ScriptingCVE-2026-6399 · WordPress plugins & themes · reported by WordfenceMedium 4.4

  The General Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.1.0. This is due to the use of sanitize_text_field() for output escaping in the Contact Number (ad_contact_number) field — a function that strips HTML tags but does not encode double-quote characters to their HTML entity equivalent ("). When the stored value is echoed inside a double-quoted HTML attribute (value="..."), an attacker-supplied double-quote character breaks out of the attribute context. Even with WordPress's wp_magic_quotes mechanism (which prefixes quotes with a backslash), the resulting \" sequence is NOT treated as an escaped quote by HTML parsers — the backslash is rendered as a literal character and the bare double-quote still closes the attribute. This makes it possible for authenticated attackers with Administrator-level access and above to inject arbitrary web scripts in the admin settings page that will execute whenever any administrator visits the General Options settings page.

  Product

  General Options

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update General Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 19, 2026Sticky: Stored Cross-Site ScriptingCVE-2026-6397 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Sticky plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `cvmh-sticky` shortcode `readmoretext` attribute in versions up to and including 2.5.6. This is due to insufficient input sanitization and output escaping in the `cvmh_sticky_front_render()` function — the `readmoretext` attribute value is passed through `apply_filters()` and directly concatenated into the HTML output without any escaping function such as `esc_html()`. This makes it possible for authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a page containing the injected shortcode.

  Product

  Sticky

  Affected

  up to 2.5.6

  What to do

  Affects up to 2.5.6. Update Sticky to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.