Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
10564 vulnerabilities
CVE-2026-10818 (GCVE-0-2026-10818)
Vulnerability from cvelistv5 – Published: 2026-07-25 06:50 – Updated: 2026-07-25 06:50
VLAI
EPSS
VEX
Title
WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
Summary
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Severity
8.1 (High)
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WPForms | WPForms Pro |
Affected:
0 , ≤ 1.10.1.1
(semver)
|
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPForms Pro",
"vendor": "WPForms",
"versions": [
{
"lessThanOrEqual": "1.10.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lhking"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T06:50:06.104Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b267f163-966a-43f7-8a7c-67d34c2c7e9d?source=cve"
},
{
"url": "https://wpforms.com/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-07T13:06:00.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-24T17:42:04.000Z",
"value": "Disclosed"
}
],
"title": "WPForms Pro \u003c= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-10818",
"datePublished": "2026-07-25T06:50:06.104Z",
"dateReserved": "2026-06-04T07:00:23.213Z",
"dateUpdated": "2026-07-25T06:50:06.104Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15425 (GCVE-0-2026-15425)
Vulnerability from cvelistv5 – Published: 2026-07-25 06:50 – Updated: 2026-07-25 06:50
VLAI
EPSS
VEX
Title
Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)
Summary
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug (post_name) in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires pretty permalinks to be enabled, as the exploit chain depends on get_permalink() embedding the stored percent-encoded post_name in the generated URL.
Severity
6.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| yoast | Yoast SEO – Advanced SEO with real-time guidance and built-in AI |
Affected:
0 , ≤ 28.0
(semver)
|
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI",
"vendor": "yoast",
"versions": [
{
"lessThanOrEqual": "28.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dmitrii Ignatyev"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug (post_name) in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires pretty permalinks to be enabled, as the exploit chain depends on get_permalink() embedding the stored percent-encoded post_name in the generated URL."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T06:50:05.480Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4b2fa1b7-a5af-4ea6-9bee-19a6cdfd7701?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/28.0/admin/class-bulk-editor-list-table.php#L900"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/28.0/admin/class-bulk-editor-list-table.php#L898"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/27.6/admin/class-bulk-editor-list-table.php#L900"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/27.6/admin/class-bulk-editor-list-table.php#L898"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3598937/wordpress-seo/trunk/admin/class-bulk-editor-list-table.php"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fwordpress-seo/tags/28.0\u0026new_path=%2Fwordpress-seo/tags/28.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-24T17:58:17.000Z",
"value": "Disclosed"
}
],
"title": "Yoast SEO \u003c= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15425",
"datePublished": "2026-07-25T06:50:05.480Z",
"dateReserved": "2026-07-10T16:20:53.214Z",
"dateUpdated": "2026-07-25T06:50:05.480Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14955 (GCVE-0-2026-14955)
Vulnerability from cvelistv5 – Published: 2026-07-25 05:34 – Updated: 2026-07-25 05:34
VLAI
EPSS
VEX
Title
Checkout Field Editor for WooCommerce (Pro) <= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'thwcfe_legacy_file' Parameter
Summary
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfe_legacy_file' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Severity
6.5 (Medium)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Themehigh | Checkout Field Editor for WooCommerce (Pro) |
Affected:
0 , ≤ 3.7.7
(semver)
|
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Checkout Field Editor for WooCommerce (Pro)",
"vendor": "Themehigh",
"versions": [
{
"lessThanOrEqual": "3.7.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "0xd4rk5id3"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the \u0027thwcfe_legacy_file\u0027 parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T05:34:55.666Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a9576cee-2375-437e-9dc8-713209a96a73?source=cve"
},
{
"url": "https://www.themehigh.com/product/woocommerce-checkout-field-editor-pro/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-24T17:26:59.000Z",
"value": "Disclosed"
}
],
"title": "Checkout Field Editor for WooCommerce (Pro) \u003c= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via \u0027thwcfe_legacy_file\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-14955",
"datePublished": "2026-07-25T05:34:55.666Z",
"dateReserved": "2026-07-07T13:32:03.687Z",
"dateUpdated": "2026-07-25T05:34:55.666Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8789 (GCVE-0-2026-8789)
Vulnerability from cvelistv5 – Published: 2026-07-24 14:34 – Updated: 2026-07-24 15:31
VLAI
EPSS
VEX
Title
Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion
Summary
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary connection records from the `wp_ea_connections` table, disrupting the plugin's core booking functionality.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| easyappointments | Easy Appointments |
Affected:
0 , ≤ 3.12.27
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8789",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T15:31:50.579247Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T15:31:56.280Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Easy Appointments",
"vendor": "easyappointments",
"versions": [
{
"lessThanOrEqual": "3.12.27",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Vamshi Krishna Upadrasta"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary connection records from the `wp_ea_connections` table, disrupting the plugin\u0027s core booking functionality."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:34:50.754Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/47ed52b3-4bfe-46ce-aabc-7a4647ab7db5?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3595856%40easy-appointments\u0026new=3595856%40easy-appointments"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-23T16:53:31.000Z",
"value": "Disclosed"
}
],
"title": "Easy Appointments \u003c= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-8789",
"datePublished": "2026-07-24T14:34:50.754Z",
"dateReserved": "2026-05-17T15:46:31.150Z",
"dateUpdated": "2026-07-24T15:31:56.280Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10033 (GCVE-0-2026-10033)
Vulnerability from cvelistv5 – Published: 2026-07-24 09:31 – Updated: 2026-07-24 12:35
VLAI
EPSS
VEX
Title
EventON Action User <= 2.5.14 - Missing Authorization to Unauthenticated Privilege Escalation via evoau_save_capability AJAX Action
Summary
The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to grant EventON management capabilities and the upload_files capability to any non-administrator WordPress role or user, escalating their privileges within the site. The administrator role is protected by an early-return guard in update_role_caps(), so only non-administrator roles and individual users can be targeted; however, the same unauthenticated exposure also allows attackers to enumerate all WordPress users with their IDs and display names, disclose role and user capability state along with nonce values, and tamper with event-to-user term assignments.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| EventON | EventON Action User |
Affected:
0 , ≤ 2.5.14
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10033",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T12:35:27.209137Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T12:35:36.658Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EventON Action User",
"vendor": "EventON",
"versions": [
{
"lessThanOrEqual": "2.5.14",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Vincent Szopa (bioflavonoid)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to grant EventON management capabilities and the upload_files capability to any non-administrator WordPress role or user, escalating their privileges within the site. The administrator role is protected by an early-return guard in update_role_caps(), so only non-administrator roles and individual users can be targeted; however, the same unauthenticated exposure also allows attackers to enumerate all WordPress users with their IDs and display names, disclose role and user capability state along with nonce values, and tamper with event-to-user term assignments."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T09:31:46.983Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6ca9eaf7-261b-42ab-a779-9e11dde5763b?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/eventon-action-user/trunk/includes/admin/class-admin-ajax.php#L243"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-09T15:23:20.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T21:26:43.000Z",
"value": "Disclosed"
}
],
"title": "EventON Action User \u003c= 2.5.14 - Missing Authorization to Unauthenticated Privilege Escalation via evoau_save_capability AJAX Action"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-10033",
"datePublished": "2026-07-24T09:31:46.983Z",
"dateReserved": "2026-05-28T18:52:02.895Z",
"dateUpdated": "2026-07-24T12:35:36.658Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15663 (GCVE-0-2026-15663)
Vulnerability from cvelistv5 – Published: 2026-07-24 09:31 – Updated: 2026-07-24 10:53
VLAI
EPSS
VEX
Title
Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key
Summary
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable keys originate from the 'settings' object in an attacker-controlled import file processed via file_get_contents() or base64-decoded/JSON-decoded blobs, bypassing wp_magic_quotes protections entirely; two distinct sinks are affected — _save_setting() in Model.php and insert_form_meta() in ImportForm.php — as only the value side is escaped while the key side receives no sanitization or parameterization at any point in the call chain.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kstover | Ninja Forms – The Contact Form Builder That Grows With You |
Affected:
0 , ≤ 3.14.9
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15663",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T10:49:32.796426Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T10:53:25.104Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Ninja Forms \u2013 The Contact Form Builder That Grows With You",
"vendor": "kstover",
"versions": [
{
"lessThanOrEqual": "3.14.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Ninja Forms \u2013 The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File \u0027settings\u0027 Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable keys originate from the \u0027settings\u0027 object in an attacker-controlled import file processed via file_get_contents() or base64-decoded/JSON-decoded blobs, bypassing wp_magic_quotes protections entirely; two distinct sinks are affected \u2014 _save_setting() in Model.php and insert_form_meta() in ImportForm.php \u2014 as only the value side is escaped while the key side receives no sanitization or parameterization at any point in the call chain."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T09:31:46.051Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2fda47d8-8e8c-4103-aabb-c70935e13450?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.14.9/includes/Abstracts/Model.php#L714"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.14.9/includes/Admin/Processes/ImportForm.php#L357"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.14.9/includes/Admin/Menus/ImportExport.php#L63"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.14.9/includes/AJAX/REST/BatchProcess.php#L41"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3614986%40ninja-forms\u0026new=3614986%40ninja-forms"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-13T20:39:42.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T21:25:12.000Z",
"value": "Disclosed"
}
],
"title": "Ninja Forms \u003c= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File \u0027settings\u0027 Key"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15663",
"datePublished": "2026-07-24T09:31:46.051Z",
"dateReserved": "2026-07-13T20:24:33.708Z",
"dateUpdated": "2026-07-24T10:53:25.104Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15401 (GCVE-0-2026-15401)
Vulnerability from cvelistv5 – Published: 2026-07-24 09:31 – Updated: 2026-07-24 19:52
VLAI
EPSS
VEX
Title
VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter
Summary
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vbfX custom-field value is stored via the public-facing saveorder task, which has no capability or authentication check enforced by default, enabling fully unauthenticated submission of malicious payloads.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
14 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| e4jvikwp | VikBooking Hotel Booking Engine & PMS |
Affected:
0 , ≤ 1.8.13
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15401",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T18:50:15.216616Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T19:52:04.538Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VikBooking Hotel Booking Engine \u0026 PMS",
"vendor": "e4jvikwp",
"versions": [
{
"lessThanOrEqual": "1.8.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The VikBooking Hotel Booking Engine \u0026 PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027vbfX\u0027 parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vbfX custom-field value is stored via the public-facing saveorder task, which has no capability or authentication check enforced by default, enabling fully unauthenticated submission of malicious payloads."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T09:31:45.522Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0714273b-014e-4bed-b394-138f46a77eaa?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.12/admin/views/editorder/tmpl/default.php#L1405"
},
{
"url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.13/admin/views/editorder/tmpl/default.php#L1405"
},
{
"url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.13/admin/views/editorder/tmpl/default.php#L1420"
},
{
"url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.13/site/controller.php#L304"
},
{
"url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.13/site/controller.php#L919"
},
{
"url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.13/site/controller.php#L1083"
},
{
"url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.13/site/helpers/lib.vikbooking.php#L5415"
},
{
"url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.12/admin/views/editorder/tmpl/default.php#L1420"
},
{
"url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.12/site/controller.php#L304"
},
{
"url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.12/site/controller.php#L919"
},
{
"url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.12/site/controller.php#L1083"
},
{
"url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.12/site/helpers/lib.vikbooking.php#L5415"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3610507%40vikbooking\u0026new=3610507%40vikbooking"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-10T13:52:55.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T20:31:52.000Z",
"value": "Disclosed"
}
],
"title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field \u0027vbfX\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15401",
"datePublished": "2026-07-24T09:31:45.522Z",
"dateReserved": "2026-07-10T13:37:43.258Z",
"dateUpdated": "2026-07-24T19:52:04.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15346 (GCVE-0-2026-15346)
Vulnerability from cvelistv5 – Published: 2026-07-24 07:53 – Updated: 2026-07-24 14:48
VLAI
EPSS
VEX
Title
VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Reflected Cross-Site Scripting via 'category_id' Parameter
Summary
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'category_id' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is limited to browsers that support access keys as the injection is in a hidden element.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| e4jvikwp | VikBooking Hotel Booking Engine & PMS |
Affected:
0 , ≤ 1.8.13
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15346",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:48:29.980445Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:48:41.120Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VikBooking Hotel Booking Engine \u0026 PMS",
"vendor": "e4jvikwp",
"versions": [
{
"lessThanOrEqual": "1.8.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The VikBooking Hotel Booking Engine \u0026 PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u0027category_id\u0027 parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is limited to browsers that support access keys as the injection is in a hidden element."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T07:53:37.201Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e456b8c8-ba4a-4199-b006-c6be381b6ef8?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.12/site/views/search/tmpl/default.php#L409"
},
{
"url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.13/site/views/search/tmpl/default.php#L409"
},
{
"url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.13/site/views/search/tmpl/default.php#L43"
},
{
"url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.13/libraries/adapter/input/filter.php#L233"
},
{
"url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.13/site/views/search/tmpl/default.php#L385"
},
{
"url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.12/site/views/search/tmpl/default.php#L43"
},
{
"url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.12/libraries/adapter/input/filter.php#L233"
},
{
"url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.12/site/views/search/tmpl/default.php#L385"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3610507%40vikbooking\u0026new=3610507%40vikbooking"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-09T20:43:54.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T19:03:55.000Z",
"value": "Disclosed"
}
],
"title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.8.13 - Reflected Cross-Site Scripting via \u0027category_id\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15346",
"datePublished": "2026-07-24T07:53:37.201Z",
"dateReserved": "2026-07-09T20:28:43.169Z",
"dateUpdated": "2026-07-24T14:48:41.120Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15739 (GCVE-0-2026-15739)
Vulnerability from cvelistv5 – Published: 2026-07-24 07:53 – Updated: 2026-07-24 14:24
VLAI
EPSS
VEX
Title
Rich Showcase for Google Reviews <= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pagination' Shortcode Attribute
Summary
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| widgetpack | Rich Showcase for Google Reviews |
Affected:
0 , ≤ 6.9.9
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15739",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:23:50.359067Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:24:07.142Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rich Showcase for Google Reviews",
"vendor": "widgetpack",
"versions": [
{
"lessThanOrEqual": "6.9.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027pagination\u0027 Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T07:53:36.691Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c3851607-73e7-44ae-8d5b-e8b7460851ea?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.7/includes/class-view.php#L336"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.8/includes/class-view.php#L336"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.8/includes/class-view.php#L172"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.8/includes/class-feed-old.php#L45"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.8/includes/class-feed-shortcode.php#L33"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.7/includes/class-view.php#L172"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.7/includes/class-feed-old.php#L45"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.7/includes/class-feed-shortcode.php#L33"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3610853%40widget-google-reviews%2Ftrunk\u0026old=3606801%40widget-google-reviews%2Ftrunk"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-14T14:38:09.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T19:00:45.000Z",
"value": "Disclosed"
}
],
"title": "Rich Showcase for Google Reviews \u003c= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027pagination\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15739",
"datePublished": "2026-07-24T07:53:36.691Z",
"dateReserved": "2026-07-14T14:22:59.359Z",
"dateUpdated": "2026-07-24T14:24:07.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15821 (GCVE-0-2026-15821)
Vulnerability from cvelistv5 – Published: 2026-07-24 07:53 – Updated: 2026-07-25 00:51
VLAI
EPSS
VEX
Title
SureDash <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Summary
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| brainstormforce | SureDash – Community, Courses & Member Dashboard |
Affected:
0 , ≤ 1.10.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15821",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-25T00:51:11.116367Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T00:51:25.016Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SureDash \u2013 Community, Courses \u0026 Member Dashboard",
"vendor": "brainstormforce",
"versions": [
{
"lessThanOrEqual": "1.10.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The SureDash \u2013 Community, Courses \u0026 Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T07:53:35.538Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/260c8ee3-dac5-4ad7-ba77-2312160e9348?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.10.0/core/shortcodes/user-profile.php#L111"
},
{
"url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.10.0/core/shortcodes/user-profile.php#L85"
},
{
"url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.10.0/core/shortcodes/user-profile.php#L64"
},
{
"url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.10.0/core/blocks/interactivity/build/Profile/view.php#L23"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3614211%40suredash\u0026new=3614211%40suredash"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-15T13:31:50.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T19:02:55.000Z",
"value": "Disclosed"
}
],
"title": "SureDash \u003c= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15821",
"datePublished": "2026-07-24T07:53:35.538Z",
"dateReserved": "2026-07-15T13:16:32.513Z",
"dateUpdated": "2026-07-25T00:51:25.016Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15464 (GCVE-0-2026-15464)
Vulnerability from cvelistv5 – Published: 2026-07-24 06:52 – Updated: 2026-07-24 14:27
VLAI
EPSS
VEX
Title
WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute
Summary
The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable on browsers where access keys can be used as the payload is stored in a hidden attribute.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| thimpress | WP Hotel Booking |
Affected:
0 , ≤ 2.3.2
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15464",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:27:35.889351Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:27:56.299Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP Hotel Booking",
"vendor": "thimpress",
"versions": [
{
"lessThanOrEqual": "2.3.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027widget_search\u0027 Shortcode Attribute in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable on browsers where access keys can be used as the payload is stored in a hidden attribute."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T06:52:01.916Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9f3a4258-2f45-4617-a5ca-9b28835ef405?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-hotel-booking/tags/2.3.2/templates/search/search-form.php#L103"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-hotel-booking/tags/2.3.2/includes/shortcodes/class-wphb-shortcode-hotel-booking.php#L44"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3609563%40wp-hotel-booking\u0026new=3609563%40wp-hotel-booking"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-10T21:16:59.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T18:03:42.000Z",
"value": "Disclosed"
}
],
"title": "WP Hotel Booking \u003c= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027widget_search\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15464",
"datePublished": "2026-07-24T06:52:01.916Z",
"dateReserved": "2026-07-10T21:01:50.015Z",
"dateUpdated": "2026-07-24T14:27:56.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15653 (GCVE-0-2026-15653)
Vulnerability from cvelistv5 – Published: 2026-07-24 06:52 – Updated: 2026-07-24 12:29
VLAI
EPSS
VEX
Title
Visualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter
Summary
The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backend-title' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeisle | Visualizer – Tables & Charts Manager with Built-in AI Generator |
Affected:
0 , ≤ 4.0.5
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15653",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T12:28:54.560852Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T12:29:03.502Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Visualizer \u2013 Tables \u0026 Charts Manager with Built-in AI Generator",
"vendor": "themeisle",
"versions": [
{
"lessThanOrEqual": "4.0.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Visualizer \u2013 Tables \u0026 Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027backend-title\u0027 parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T06:52:01.471Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/914554fd-1525-4925-bce4-2df4a8df5dbf?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/visualizer/tags/4.0.5/classes/Visualizer/Render/Page/Data.php#L96"
},
{
"url": "https://plugins.trac.wordpress.org/browser/visualizer/tags/4.0.5/classes/Visualizer/Module/Chart.php#L826"
},
{
"url": "https://plugins.trac.wordpress.org/browser/visualizer/tags/4.0.5/classes/Visualizer/Module/Chart.php#L553"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3619025%40visualizer\u0026new=3619025%40visualizer"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-13T19:55:30.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T18:05:48.000Z",
"value": "Disclosed"
}
],
"title": "Visualizer \u003c= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027backend-title\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15653",
"datePublished": "2026-07-24T06:52:01.471Z",
"dateReserved": "2026-07-13T19:40:20.977Z",
"dateUpdated": "2026-07-24T12:29:03.502Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12654 (GCVE-0-2026-12654)
Vulnerability from cvelistv5 – Published: 2026-07-24 06:52 – Updated: 2026-07-24 19:55
VLAI
EPSS
VEX
Title
Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret
Summary
The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary pending asynchronous WooCommerce orders as paid by forging a charge.pending event with attacker-controlled metadata.order_id, metadata.gateway_id, and a charge object carrying status=succeeded and captured=true, triggering payment_complete() and downstream fulfillment flows with an attacker-supplied transaction ID. Exploitation requires the merchant to have left the webhook_secret_test or webhook_secret_live option blank, which is the plugin's default state until a Stripe-issued whsec_ value is manually configured; once a non-empty secret is set, the signature verification cannot be bypassed.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-862 - Missing Authorization
Assigner
References
12 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| paymentplugins | Payment Plugins for Stripe WooCommerce |
Affected:
0 , ≤ 4.0.7
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12654",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T19:55:09.941731Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T19:55:36.258Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Payment Plugins for Stripe WooCommerce",
"vendor": "paymentplugins",
"versions": [
{
"lessThanOrEqual": "4.0.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "gidget smith"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary pending asynchronous WooCommerce orders as paid by forging a charge.pending event with attacker-controlled metadata.order_id, metadata.gateway_id, and a charge object carrying status=succeeded and captured=true, triggering payment_complete() and downstream fulfillment flows with an attacker-supplied transaction ID. Exploitation requires the merchant to have left the webhook_secret_test or webhook_secret_live option blank, which is the plugin\u0027s default state until a Stripe-issued whsec_ value is manually configured; once a non-empty secret is set, the signature verification cannot be bypassed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T06:52:00.542Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/45185f25-9a1f-411d-9d2a-295b5ceb5629?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.105/includes/controllers/class-wc-stripe-controller-webhook.php#L60"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.108/includes/controllers/class-wc-stripe-controller-webhook.php#L60"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.108/includes/controllers/class-wc-stripe-controller-webhook.php#L54"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.108/includes/controllers/class-wc-stripe-controller-webhook.php#L24"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.108/includes/wc-stripe-webhook-functions.php#L427"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.108/includes/abstract/abstract-wc-stripe-payment.php#L104"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.105/includes/controllers/class-wc-stripe-controller-webhook.php#L54"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.105/includes/controllers/class-wc-stripe-controller-webhook.php#L24"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.105/includes/wc-stripe-webhook-functions.php#L427"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.105/includes/abstract/abstract-wc-stripe-payment.php#L104"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3611878%40woo-stripe-payment\u0026new=3611878%40woo-stripe-payment"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-23T18:32:05.000Z",
"value": "Disclosed"
}
],
"title": "Payment Plugins for Stripe WooCommerce \u003c= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12654",
"datePublished": "2026-07-24T06:52:00.542Z",
"dateReserved": "2026-06-18T18:47:59.973Z",
"dateUpdated": "2026-07-24T19:55:36.258Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15648 (GCVE-0-2026-15648)
Vulnerability from cvelistv5 – Published: 2026-07-24 06:52 – Updated: 2026-07-24 22:10
VLAI
EPSS
VEX
Title
Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute
Summary
The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'width' Shortcode Attribute in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| berocket | Brands for WooCommerce |
Affected:
0 , ≤ 3.8.8
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15648",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T22:10:42.362669Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T22:10:51.283Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Brands for WooCommerce",
"vendor": "berocket",
"versions": [
{
"lessThanOrEqual": "3.8.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027width\u0027 Shortcode Attribute in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T06:52:00.092Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3efb5f5c-64d2-4819-82bf-45574df94209?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/brands-for-woocommerce/tags/3.8.8/addons/divi_shortcode/divi-builder.php#L127"
},
{
"url": "https://plugins.trac.wordpress.org/browser/brands-for-woocommerce/tags/3.8.8/addons/divi_shortcode/divi-builder.php#L16"
},
{
"url": "https://plugins.trac.wordpress.org/browser/brands-for-woocommerce/tags/3.8.8/addons/divi_shortcode/divi-builder.php#L7"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3608899%40brands-for-woocommerce\u0026new=3608899%40brands-for-woocommerce"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-13T19:27:09.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T18:26:40.000Z",
"value": "Disclosed"
}
],
"title": "Brands for WooCommerce \u003c= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027width\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15648",
"datePublished": "2026-07-24T06:52:00.092Z",
"dateReserved": "2026-07-13T19:11:58.753Z",
"dateUpdated": "2026-07-24T22:10:51.283Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15334 (GCVE-0-2026-15334)
Vulnerability from cvelistv5 – Published: 2026-07-24 06:51 – Updated: 2026-07-24 14:49
VLAI
EPSS
VEX
Title
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute
Summary
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon.view' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
14 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cozythemes | Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates |
Affected:
0 , ≤ 2.2.11
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15334",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:48:56.109293Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:49:08.119Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cozy Blocks \u2013 Page Builder for Gutenberg Editor \u0026 FSE with 600+ Patterns, 58 Blocks \u0026 Templates",
"vendor": "cozythemes",
"versions": [
{
"lessThanOrEqual": "2.2.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Cozy Blocks \u2013 Page Builder for Gutenberg Editor \u0026 FSE with 600+ Patterns, 58 Blocks \u0026 Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027icon.view\u0027 Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T06:51:59.674Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2daddb7a-0ea7-4d11-8699-1982e336120f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/blocks/advanced-categories/render.php#L425"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/blocks/advanced-categories/render.php#L413"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/blocks/advanced-categories/render.php#L414"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/blocks/advanced-categories/render.php#L426"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/blocks/advanced-categories/render.php#L427"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/blocks/advanced-categories/block.json#L354"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.9/blocks/advanced-categories/render.php#L425"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.9/blocks/advanced-categories/render.php#L413"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.9/blocks/advanced-categories/render.php#L414"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.9/blocks/advanced-categories/render.php#L426"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.9/blocks/advanced-categories/render.php#L427"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.9/blocks/advanced-categories/block.json#L354"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3619461%40cozy-addons\u0026new=3619461%40cozy-addons"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-10T04:01:53.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T18:28:29.000Z",
"value": "Disclosed"
}
],
"title": "Cozy Blocks \u003c= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027icon.view\u0027 Block Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15334",
"datePublished": "2026-07-24T06:51:59.674Z",
"dateReserved": "2026-07-09T19:00:09.445Z",
"dateUpdated": "2026-07-24T14:49:08.119Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15755 (GCVE-0-2026-15755)
Vulnerability from cvelistv5 – Published: 2026-07-24 06:51 – Updated: 2026-07-24 10:59
VLAI
EPSS
VEX
Title
Open User Map <= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Summary
The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack does not require post publication; a Contributor submitting a post for pending review is sufficient, as the payload executes when an Administrator opens the pending-review preview.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| 100plugins | Open User Map – Interactive Leaflet Maps |
Affected:
0 , ≤ 1.4.45
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15755",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T10:58:57.457277Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T10:59:33.620Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Open User Map \u2013 Interactive Leaflet Maps",
"vendor": "100plugins",
"versions": [
{
"lessThanOrEqual": "1.4.45",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Qu\u1ed1c Huy (jtwings)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Open User Map \u2013 Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack does not require post publication; a Contributor submitting a post for pending review is sufficient, as the payload executes when an Administrator opens the pending-review preview."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T06:51:59.294Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2bcc2783-1c47-47e4-ba63-822012aba0a6?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/open-user-map/tags/1.4.45/templates/partial-map-render.php#L450"
},
{
"url": "https://plugins.trac.wordpress.org/browser/open-user-map/tags/1.4.45/templates/partial-map-init.php#L682"
},
{
"url": "https://plugins.trac.wordpress.org/browser/open-user-map/tags/1.4.45/inc/Pages/Frontend.php#L120"
},
{
"url": "https://plugins.trac.wordpress.org/browser/open-user-map/tags/1.4.45/inc/Base/BaseController.php#L1026"
},
{
"url": "https://plugins.trac.wordpress.org/browser/open-user-map/tags/1.4.40/templates/partial-map-render.php#L450"
},
{
"url": "https://plugins.trac.wordpress.org/browser/open-user-map/tags/1.4.40/templates/partial-map-init.php#L682"
},
{
"url": "https://plugins.trac.wordpress.org/browser/open-user-map/tags/1.4.40/inc/Pages/Frontend.php#L120"
},
{
"url": "https://plugins.trac.wordpress.org/browser/open-user-map/tags/1.4.40/inc/Base/BaseController.php#L1026"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3618639%40open-user-map\u0026new=3618639%40open-user-map"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-14T16:51:23.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T18:30:30.000Z",
"value": "Disclosed"
}
],
"title": "Open User Map \u003c= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15755",
"datePublished": "2026-07-24T06:51:59.294Z",
"dateReserved": "2026-07-14T16:14:55.906Z",
"dateUpdated": "2026-07-24T10:59:33.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15333 (GCVE-0-2026-15333)
Vulnerability from cvelistv5 – Published: 2026-07-24 06:51 – Updated: 2026-07-24 11:01
VLAI
EPSS
VEX
Title
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute
Summary
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
16 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cozythemes | Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates |
Affected:
0 , ≤ 2.2.11
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15333",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T11:00:04.739510Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T11:01:57.309Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cozy Blocks \u2013 Page Builder for Gutenberg Editor \u0026 FSE with 600+ Patterns, 58 Blocks \u0026 Templates",
"vendor": "cozythemes",
"versions": [
{
"lessThanOrEqual": "2.2.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Cozy Blocks \u2013 Page Builder for Gutenberg Editor \u0026 FSE with 600+ Patterns, 58 Blocks \u0026 Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027cozyCustomFont\u0027 Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T06:51:58.906Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0cc9cad8-0e2f-4ecf-9ca7-15ca060879c1?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/includes/functions.php#L2258"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/includes/functions.php#L2170"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/includes/functions.php#L2160"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/includes/functions.php#L2183"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/includes/functions.php#L2251"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/includes/functions.php#L2254"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/includes/functions.php#L2374"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.9/includes/functions.php#L2258"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.9/includes/functions.php#L2170"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.9/includes/functions.php#L2160"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.9/includes/functions.php#L2183"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.9/includes/functions.php#L2251"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.9/includes/functions.php#L2254"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.9/includes/functions.php#L2374"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3619461%40cozy-addons\u0026new=3619461%40cozy-addons"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-10T04:01:52.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T18:27:40.000Z",
"value": "Disclosed"
}
],
"title": "Cozy Blocks \u003c= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027cozyCustomFont\u0027 Block Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15333",
"datePublished": "2026-07-24T06:51:58.906Z",
"dateReserved": "2026-07-09T18:40:02.166Z",
"dateUpdated": "2026-07-24T11:01:57.309Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15665 (GCVE-0-2026-15665)
Vulnerability from cvelistv5 – Published: 2026-07-24 06:51 – Updated: 2026-07-24 20:26
VLAI
EPSS
VEX
Title
Fluent Support <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute
Summary
The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The XSS payload is in a hidden attribute so it only fires in specific browsers when specific access keys are used making exploitation unlikely.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpmanageninja | Fluent Support – Helpdesk & Customer Support Ticket System |
Affected:
0 , ≤ 2.3.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15665",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T20:12:35.556792Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T20:26:51.110Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Fluent Support \u2013 Helpdesk \u0026 Customer Support Ticket System",
"vendor": "wpmanageninja",
"versions": [
{
"lessThanOrEqual": "2.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Fluent Support \u2013 Helpdesk \u0026 Customer Support Ticket System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027redirect-to\u0027 Shortcode Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The XSS payload is in a hidden attribute so it only fires in specific browsers when specific access keys are used making exploitation unlikely."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T06:51:58.346Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0c963224-e680-4ca6-85ae-07cd0ee6c1d4?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluent-support/tags/2.3.0/app/Hooks/Handlers/AuthHandler.php#L149"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluent-support/tags/2.3.0/app/Hooks/Handlers/AuthHandler.php#L201"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluent-support/tags/2.3.0/app/Hooks/Handlers/AuthHandler.php#L500"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluent-support/tags/2.3.0/app/Hooks/Handlers/AuthHandler.php#L111"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3609122%40fluent-support\u0026new=3609122%40fluent-support"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-13T21:02:05.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T18:29:33.000Z",
"value": "Disclosed"
}
],
"title": "Fluent Support \u003c= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027redirect-to\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15665",
"datePublished": "2026-07-24T06:51:58.346Z",
"dateReserved": "2026-07-13T20:46:44.256Z",
"dateUpdated": "2026-07-24T20:26:51.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11354 (GCVE-0-2026-11354)
Vulnerability from cvelistv5 – Published: 2026-07-24 02:32 – Updated: 2026-07-24 21:18
VLAI
EPSS
VEX
Title
Participants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Parameter
Summary
The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and redirect the private_id-bearing record-access link to an attacker-controlled email address, granting full read and edit access to the victim's stored personally identifiable information including names, email addresses, phone numbers, and any other fields collected in the participant database. An attacker can harvest a valid nonce with a plain unauthenticated GET request to any page rendering the public signup or record form, then POST action=update with an arbitrary id value to overwrite any record; chaining a subsequent action=retrieve then delivers the private-access link to the attacker-controlled mailbox.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| xnau | Participants Database |
Affected:
0 , ≤ 2.7.8.3
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11354",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T20:53:30.210496Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T21:18:17.757Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Participants Database",
"vendor": "xnau",
"versions": [
{
"lessThanOrEqual": "2.7.8.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Robert Hartinger"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the \u0027id\u0027 parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and redirect the private_id-bearing record-access link to an attacker-controlled email address, granting full read and edit access to the victim\u0027s stored personally identifiable information including names, email addresses, phone numbers, and any other fields collected in the participant database. An attacker can harvest a valid nonce with a plain unauthenticated GET request to any page rendering the public signup or record form, then POST action=update with an arbitrary id value to overwrite any record; chaining a subsequent action=retrieve then delivers the private-access link to the attacker-controlled mailbox."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T02:32:00.774Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ff1b8d09-974a-4735-8b63-15084412090d?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/participants-database/tags/2.7.8.3/classes/PDb_submission/main_query/update_query.php#L57"
},
{
"url": "https://plugins.trac.wordpress.org/browser/participants-database/tags/2.7.8.3/participants-database.php#L2437"
},
{
"url": "https://plugins.trac.wordpress.org/browser/participants-database/tags/2.7.8.3/participants-database.php#L1671"
},
{
"url": "https://plugins.trac.wordpress.org/browser/participants-database/tags/2.7.8.3/classes/PDb_Shortcode.php#L1267"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3606851%40participants-database\u0026new=3606851%40participants-database"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-17T02:31:37.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T14:30:26.000Z",
"value": "Disclosed"
}
],
"title": "Participants Database \u003c= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via \u0027id\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-11354",
"datePublished": "2026-07-24T02:32:00.774Z",
"dateReserved": "2026-06-05T11:25:56.930Z",
"dateUpdated": "2026-07-24T21:18:17.757Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12736 (GCVE-0-2026-12736)
Vulnerability from cvelistv5 – Published: 2026-07-24 02:32 – Updated: 2026-07-24 11:08
VLAI
EPSS
VEX
Title
WPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint
Summary
The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) passing the request-supplied 'option' and 'data' parameters directly to update_option() without any option-name allowlist or value sanitization, while the permission_callback only verifies the manage_woocommerce capability. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by overwriting arbitrary WordPress options (for example setting default_role to administrator and users_can_register to 1, or disabling security plugins via active_plugins).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpify | WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce |
Affected:
0 , ≤ 5.4.16
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12736",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T11:07:57.916332Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T11:08:09.327Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPify Woo \u2013 Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce",
"vendor": "wpify",
"versions": [
{
"lessThanOrEqual": "5.4.16",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) passing the request-supplied \u0027option\u0027 and \u0027data\u0027 parameters directly to update_option() without any option-name allowlist or value sanitization, while the permission_callback only verifies the manage_woocommerce capability. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by overwriting arbitrary WordPress options (for example setting default_role to administrator and users_can_register to 1, or disabling security plugins via active_plugins)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T02:32:00.363Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a9b8f2d5-a2c5-4f90-ab1d-4e17f7a7996e?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpify-woo/tags/5.4.9/src/Api/SettingsApi.php#L67"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpify-woo/tags/5.4.10/src/Api/SettingsApi.php#L67"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpify-woo/tags/5.4.10/src/Api/SettingsApi.php#L39"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpify-woo/tags/5.4.10/src/Managers/ApiManager.php#L18"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpify-woo/tags/5.4.9/src/Api/SettingsApi.php#L39"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpify-woo/tags/5.4.9/src/Managers/ApiManager.php#L18"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3614762%40wpify-woo\u0026new=3614762%40wpify-woo"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-23T14:23:21.000Z",
"value": "Disclosed"
}
],
"title": "WPify Woo \u003c= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12736",
"datePublished": "2026-07-24T02:32:00.363Z",
"dateReserved": "2026-06-19T16:24:48.590Z",
"dateUpdated": "2026-07-24T11:08:09.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-9205 (GCVE-0-2025-9205)
Vulnerability from cvelistv5 – Published: 2026-07-24 02:31 – Updated: 2026-07-24 12:23
VLAI
EPSS
VEX
Title
MapSVG Lite <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Summary
The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| oyatek | MapSVG – Vector maps, Image maps, Google Maps |
Affected:
0 , ≤ 8.14.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9205",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T12:23:00.561801Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T12:23:09.617Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MapSVG \u2013 Vector maps, Image maps, Google Maps",
"vendor": "oyatek",
"versions": [
{
"lessThanOrEqual": "8.14.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zer0gh0st"
}
],
"descriptions": [
{
"lang": "en",
"value": "The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T02:31:59.945Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a2dab9d3-a890-4c66-a825-e30329e37a60?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mapsvg-lite-interactive-vector-maps/tags/8.7.5/php/Admin/Admin.php#L233"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3608308%40mapsvg-lite-interactive-vector-maps\u0026new=3608308%40mapsvg-lite-interactive-vector-maps"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-08-20T05:27:22.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T14:29:42.000Z",
"value": "Disclosed"
}
],
"title": "MapSVG Lite \u003c= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-9205",
"datePublished": "2026-07-24T02:31:59.945Z",
"dateReserved": "2025-08-19T17:53:39.009Z",
"dateUpdated": "2026-07-24T12:23:09.617Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15420 (GCVE-0-2026-15420)
Vulnerability from cvelistv5 – Published: 2026-07-24 02:31 – Updated: 2026-07-24 22:10
VLAI
EPSS
VEX
Title
Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter
Summary
The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plus_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary JS/CSS files on the server, which can lead to denial of service or destruction of critical plugin and theme assets.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| posimyththemes | Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder |
Affected:
0 , ≤ 5.0.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15420",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T22:09:58.064263Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T22:10:12.300Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Nexter Blocks \u2013 Gutenberg Blocks, Page Builder \u0026 AI Website Builder",
"vendor": "posimyththemes",
"versions": [
{
"lessThanOrEqual": "5.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Nexter Blocks \u2013 Gutenberg Blocks, Page Builder \u0026 AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the \u0027plus_name\u0027 parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary JS/CSS files on the server, which can lead to denial of service or destruction of critical plugin and theme assets."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T02:31:59.549Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/85550779-fd46-4130-92f1-b291d4e86b21?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/the-plus-addons-for-block-editor/tags/4.7.14/classes/tp-registered-blocks.php#L2985"
},
{
"url": "https://plugins.trac.wordpress.org/browser/the-plus-addons-for-block-editor/tags/4.7.17/classes/tp-registered-blocks.php#L2985"
},
{
"url": "https://plugins.trac.wordpress.org/browser/the-plus-addons-for-block-editor/tags/4.7.17/classes/tp-registered-blocks.php#L2862"
},
{
"url": "https://plugins.trac.wordpress.org/browser/the-plus-addons-for-block-editor/tags/4.7.17/classes/tp-registered-blocks.php#L3521"
},
{
"url": "https://plugins.trac.wordpress.org/browser/the-plus-addons-for-block-editor/tags/4.7.17/classes/tp-registered-blocks.php#L2710"
},
{
"url": "https://plugins.trac.wordpress.org/browser/the-plus-addons-for-block-editor/tags/4.7.14/classes/tp-registered-blocks.php#L2862"
},
{
"url": "https://plugins.trac.wordpress.org/browser/the-plus-addons-for-block-editor/tags/4.7.14/classes/tp-registered-blocks.php#L3521"
},
{
"url": "https://plugins.trac.wordpress.org/browser/the-plus-addons-for-block-editor/tags/4.7.14/classes/tp-registered-blocks.php#L2710"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3614203%40the-plus-addons-for-block-editor\u0026new=3614203%40the-plus-addons-for-block-editor"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-10T15:15:51.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T14:21:30.000Z",
"value": "Disclosed"
}
],
"title": "Nexter Blocks \u003c= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via \u0027plus_name\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15420",
"datePublished": "2026-07-24T02:31:59.549Z",
"dateReserved": "2026-07-10T15:00:42.141Z",
"dateUpdated": "2026-07-24T22:10:12.300Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13464 (GCVE-0-2026-13464)
Vulnerability from cvelistv5 – Published: 2026-07-24 02:31 – Updated: 2026-07-24 14:40
VLAI
EPSS
VEX
Title
Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
Summary
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full title, content, and excerpt of any WordPress post — including drafts, pending, privately published, password-protected, and trashed posts — regardless of author, by supplying an arbitrary post ID via the context parameter alongside an attacker-controlled block template.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeum | Kirki – Freeform Page Builder, Website Builder & Customizer |
Affected:
0 , ≤ 6.0.14
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13464",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:39:49.449429Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:40:01.097Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Kirki \u2013 Freeform Page Builder, Website Builder \u0026 Customizer",
"vendor": "themeum",
"versions": [
{
"lessThanOrEqual": "6.0.14",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abu Hurayra (HurayraIIT)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Kirki \u2013 Freeform Page Builder, Website Builder \u0026 Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the \u0027context\u0027 parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full title, content, and excerpt of any WordPress post \u2014 including drafts, pending, privately published, password-protected, and trashed posts \u2014 regardless of author, by supplying an arbitrary post ID via the context parameter alongside an attacker-controlled block template."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T02:31:59.162Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84f65255-f710-44f9-9f77-61776a40abae?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/includes/API/Frontend/Controllers/CollectionController.php#L117"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/includes/API/Frontend/Controllers/FrontendRESTController.php#L39"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/includes/API/Frontend/Controllers/CollectionController.php#L33"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.1/includes/API/Frontend/Controllers/CollectionController.php#L117"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.1/includes/API/Frontend/Controllers/FrontendRESTController.php#L39"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.1/includes/API/Frontend/Controllers/CollectionController.php#L33"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3617070%40kirki\u0026new=3617070%40kirki"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-26T20:27:47.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T14:28:39.000Z",
"value": "Disclosed"
}
],
"title": "Kirki \u003c= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via \u0027context\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-13464",
"datePublished": "2026-07-24T02:31:59.162Z",
"dateReserved": "2026-06-26T20:12:35.429Z",
"dateUpdated": "2026-07-24T14:40:01.097Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6454 (GCVE-0-2026-6454)
Vulnerability from cvelistv5 – Published: 2026-07-24 02:31 – Updated: 2026-07-24 12:22
VLAI
EPSS
VEX
Title
Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute
Summary
The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, where this.href is string-concatenated directly into an HTML string without escaping, allowing a stored href containing entity-encoded double-quotes to break out of the data attribute and inject arbitrary event handlers into the DOM. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user clicks the malicious PDF link.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| firelightwp | Firelight Lightbox |
Affected:
0 , ≤ 2.3.20
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6454",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T12:22:27.655328Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T12:22:43.270Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Firelight Lightbox",
"vendor": "firelightwp",
"versions": [
{
"lessThanOrEqual": "2.3.20",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Qu\u1ed1c Huy (jtwings)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, where this.href is string-concatenated directly into an HTML string without escaping, allowing a stored href containing entity-encoded double-quotes to break out of the data attribute and inject arbitrary event handlers into the DOM. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user clicks the malicious PDF link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T02:31:58.797Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8396c124-9c72-4801-8964-1cd5fbd52d20?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-fancybox/trunk/inc/fancybox-2.php#L322"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-fancybox/trunk/fancybox/2.2.0/jquery.fancybox.js#L280"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-fancybox/trunk/fancybox/2.2.0/jquery.fancybox.js#L1235"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-fancybox/tags/2.3.18/inc/fancybox-2.php#L322"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-fancybox/tags/2.3.18/fancybox/2.2.0/jquery.fancybox.js#L280"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-fancybox/tags/2.3.18/fancybox/2.2.0/jquery.fancybox.js#L1235"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3610643%40easy-fancybox\u0026new=3610643%40easy-fancybox"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-16T20:23:30.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T14:27:39.000Z",
"value": "Disclosed"
}
],
"title": "Firelight Lightbox \u003c= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad \u0027href\u0027 Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-6454",
"datePublished": "2026-07-24T02:31:58.797Z",
"dateReserved": "2026-04-16T20:08:18.705Z",
"dateUpdated": "2026-07-24T12:22:43.270Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15100 (GCVE-0-2026-15100)
Vulnerability from cvelistv5 – Published: 2026-07-24 02:31 – Updated: 2026-07-24 14:23
VLAI
EPSS
VEX
Title
Post Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute
Summary
The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'searchnoresult' Block Attribute in all versions up to, and including, 5.0.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is particularly concerning in a cross-privilege scenario where a Contributor creates a pending or draft post containing the malicious block attribute, which then executes arbitrary JavaScript in the browser session of an Editor or Administrator who previews that post.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpxpo | Post Grid Gutenberg Blocks – PostX |
Affected:
0 , ≤ 5.0.32
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15100",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:22:57.869294Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:23:09.985Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Post Grid Gutenberg Blocks \u2013 PostX",
"vendor": "wpxpo",
"versions": [
{
"lessThanOrEqual": "5.0.32",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Post Grid Gutenberg Blocks \u2013 PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027searchnoresult\u0027 Block Attribute in all versions up to, and including, 5.0.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is particularly concerning in a cross-privilege scenario where a Contributor creates a pending or draft post containing the malicious block attribute, which then executes arbitrary JavaScript in the browser session of an Editor or Administrator who previews that post."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T02:31:58.268Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1f645d0c-d641-4fff-a4f4-33c037de30e9?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ultimate-post/tags/5.0.32/blocks/Advanced_Search.php#L116"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ultimate-post/tags/5.0.32/blocks/Advanced_Search.php#L107"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ultimate-post/tags/5.0.32/classes/Blocks.php#L231"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3613430%40ultimate-post\u0026new=3613430%40ultimate-post"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-08T17:03:30.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T14:31:26.000Z",
"value": "Disclosed"
}
],
"title": "Post Grid Gutenberg Blocks \u003c= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027searchnoresult\u0027 Block Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15100",
"datePublished": "2026-07-24T02:31:58.268Z",
"dateReserved": "2026-07-08T16:48:20.982Z",
"dateUpdated": "2026-07-24T14:23:09.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15981 (GCVE-0-2026-15981)
Vulnerability from cvelistv5 – Published: 2026-07-23 20:33 – Updated: 2026-07-24 22:06
VLAI
EPSS
VEX
Title
SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter
Summary
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-287 - Improper Authentication
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cyberlord92 | SAML Single Sign On – SSO Login |
Affected:
0 , ≤ 5.4.4
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15981",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T22:05:57.054951Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T22:06:10.389Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SAML Single Sign On \u2013 SSO Login",
"vendor": "cyberlord92",
"versions": [
{
"lessThanOrEqual": "5.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Supakiad S. (m3ez)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The SAML Single Sign On \u2013 SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP\u0027s openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error \u2014 bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T20:33:51.362Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b412f60f-61ea-47b1-a3ef-17275f7951df?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.4/class-mo-saml-login-validate.php#L118"
},
{
"url": "https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.4/class-mo-saml-utilities.php#L403"
},
{
"url": "https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.4/includes/lib/SAML2Core/class-mo-saml-xml-security-dsig.php#L938"
},
{
"url": "https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.4/includes/lib/SAML2Core/class-mo-saml-xml-security-key.php#L621"
},
{
"url": "https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.4/class-mo-saml-login-validate.php#L541"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3611421/miniorange-saml-20-single-sign-on"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-16T17:11:08.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T08:24:20.000Z",
"value": "Disclosed"
}
],
"title": "SAML Single Sign On \u003c= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15981",
"datePublished": "2026-07-23T20:33:51.362Z",
"dateReserved": "2026-07-16T16:55:30.527Z",
"dateUpdated": "2026-07-24T22:06:10.389Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15212 (GCVE-0-2026-15212)
Vulnerability from cvelistv5 – Published: 2026-07-23 19:45 – Updated: 2026-07-24 14:27
VLAI
EPSS
VEX
Title
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 43.2 - Cross-Site Request Forgery to Privilege Escalation via Plugin Settings Update
Summary
The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::verify_ajax_request() helper gating its wp_verify_nonce() call behind the boolean option 'enable_nonce_check', which is absent from the default 'wpo365_options' array and therefore evaluates to false via get_global_boolean_var(); as a result, the wp_ajax_wpo365_update_settings handler (Ajax_Service::update_settings) accepts POSTs from cross-origin pages and forwards the attacker-supplied 'settings' payload (base64/JSON) to Options_Service::update_options(), which merges every key/value into wpo365_options without a key allowlist. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin options — including enabling the SCIM REST endpoint (enable_scim), planting an attacker-known scim_secret_token, and setting new_usr_default_role to 'administrator' — via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpo365 | WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) |
Affected:
0 , ≤ 43.2
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15212",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:26:56.963035Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:27:08.898Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)",
"vendor": "wpo365",
"versions": [
{
"lessThanOrEqual": "43.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Osvaldo Noe Gonzalez Del Rio (Os)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::verify_ajax_request() helper gating its wp_verify_nonce() call behind the boolean option \u0027enable_nonce_check\u0027, which is absent from the default \u0027wpo365_options\u0027 array and therefore evaluates to false via get_global_boolean_var(); as a result, the wp_ajax_wpo365_update_settings handler (Ajax_Service::update_settings) accepts POSTs from cross-origin pages and forwards the attacker-supplied \u0027settings\u0027 payload (base64/JSON) to Options_Service::update_options(), which merges every key/value into wpo365_options without a key allowlist. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin options \u2014 including enabling the SCIM REST endpoint (enable_scim), planting an attacker-known scim_secret_token, and setting new_usr_default_role to \u0027administrator\u0027 \u2014 via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T19:45:52.225Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/51d0ba58-614e-4284-ae0b-b0b76fc5c46d?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpo365-login/tags/43.2/Services/Ajax_Service.php#L805"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3610759/wpo365-login"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-16T19:50:15.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T07:23:25.000Z",
"value": "Disclosed"
}
],
"title": "WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) \u003c= 43.2 - Cross-Site Request Forgery to Privilege Escalation via Plugin Settings Update"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15212",
"datePublished": "2026-07-23T19:45:52.225Z",
"dateReserved": "2026-07-09T07:43:41.039Z",
"dateUpdated": "2026-07-24T14:27:08.898Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15015 (GCVE-0-2026-15015)
Vulnerability from cvelistv5 – Published: 2026-07-23 09:33 – Updated: 2026-07-23 13:45
VLAI
EPSS
VEX
Title
MountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint
Summary
The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to obtain an administrator-bound OAuth Bearer token via a self-registered client, granting full administrator-equivalent access to the plugin's MCP tool surface and all exposed WordPress content, users, and options. This is exploitable by combining the publicly accessible Dynamic Client Registration endpoint, which allows unauthenticated callers to register arbitrary OAuth clients with an attacker-controlled redirect_uri, with the unprotected authorization endpoint to complete the full OAuth flow without any administrator interaction.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cascadiawebservices | MountDev AI MCP Connector for WordPress |
Affected:
0 , ≤ 1.6.1
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15015",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-23T13:45:23.835581Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T13:45:33.763Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MountDev AI MCP Connector for WordPress",
"vendor": "cascadiawebservices",
"versions": [
{
"lessThanOrEqual": "1.6.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "AeonRisk"
}
],
"descriptions": [
{
"lang": "en",
"value": "The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to obtain an administrator-bound OAuth Bearer token via a self-registered client, granting full administrator-equivalent access to the plugin\u0027s MCP tool surface and all exposed WordPress content, users, and options. This is exploitable by combining the publicly accessible Dynamic Client Registration endpoint, which allows unauthenticated callers to register arbitrary OAuth clients with an attacker-controlled redirect_uri, with the unprotected authorization endpoint to complete the full OAuth flow without any administrator interaction."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T09:33:59.123Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ce8ec66f-5efc-4354-8871-8e35ab4e51fc?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mountdev-ai-mcp-connector/tags/1.6.0/includes/class-oauth-controller.php#L571"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mountdev-ai-mcp-connector/tags/1.6.0/includes/class-oauth-controller.php#L474"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mountdev-ai-mcp-connector/tags/1.6.0/includes/class-oauth-controller.php#L188"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mountdev-ai-mcp-connector/tags/1.6.0/includes/class-oauth-controller.php#L370"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3601448%40mountdev-ai-mcp-connector\u0026new=3601448%40mountdev-ai-mcp-connector"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-08T17:28:49.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-22T20:49:11.000Z",
"value": "Disclosed"
}
],
"title": "MountDev AI MCP Connector for WordPress \u003c= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15015",
"datePublished": "2026-07-23T09:33:59.123Z",
"dateReserved": "2026-07-07T22:34:19.224Z",
"dateUpdated": "2026-07-23T13:45:33.763Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15394 (GCVE-0-2026-15394)
Vulnerability from cvelistv5 – Published: 2026-07-23 09:33 – Updated: 2026-07-23 14:54
VLAI
EPSS
VEX
Title
Header Footer Script Adder <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'asm_code' Snippet Meta
Summary
The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asm_code' Snippet Meta in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mahethekiller | Header Footer Script Adder |
Affected:
0 , ≤ 2.1
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15394",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-23T13:54:44.022834Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T14:54:29.917Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Header Footer Script Adder",
"vendor": "mahethekiller",
"versions": [
{
"lessThanOrEqual": "2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Header Footer Script Adder \u2013 Insert Code in Header, Body \u0026 Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027asm_code\u0027 Snippet Meta in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T09:33:58.720Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c394c9bc-21f6-45ea-8eda-8ee22a9b87ba?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/header-and-footer-script-adder/tags/2.1/pro/class-pro-admin.php#L400"
},
{
"url": "https://plugins.trac.wordpress.org/browser/header-and-footer-script-adder/tags/2.1/pro/class-pro-public.php#L145"
},
{
"url": "https://plugins.trac.wordpress.org/browser/header-and-footer-script-adder/tags/2.1/pro/class-pro-public.php#L253"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3611085%40header-and-footer-script-adder\u0026new=3611085%40header-and-footer-script-adder"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-22T20:46:45.000Z",
"value": "Disclosed"
}
],
"title": "Header Footer Script Adder \u003c= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting via \u0027asm_code\u0027 Snippet Meta"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15394",
"datePublished": "2026-07-23T09:33:58.720Z",
"dateReserved": "2026-07-10T13:06:59.654Z",
"dateUpdated": "2026-07-23T14:54:29.917Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15448 (GCVE-0-2026-15448)
Vulnerability from cvelistv5 – Published: 2026-07-23 09:33 – Updated: 2026-07-23 16:04
VLAI
EPSS
VEX
Title
Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_order_status_filter' Parameter
Summary
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_order_status_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with staff-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tickera | Tickera – Sell Tickets & Manage Events |
Affected:
0 , ≤ 3.6.0.1
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15448",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-23T16:04:04.111779Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T16:04:18.628Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Tickera \u2013 Sell Tickets \u0026 Manage Events",
"vendor": "tickera",
"versions": [
{
"lessThanOrEqual": "3.6.0.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Tickera \u2013 Sell Tickets \u0026 Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the \u0027tc_order_status_filter\u0027 parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with staff-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T09:33:58.352Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8972b507-4aae-40cc-a79e-2603dbdc70c0?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tickera-event-ticketing-system/tags/3.6.0.0/includes/addons/better-attendees-and-tickets/index.php#L260"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tickera-event-ticketing-system/tags/3.6.0.0/includes/addons/better-attendees-and-tickets/index.php#L252"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tickera-event-ticketing-system/tags/3.6.0.0/includes/addons/better-attendees-and-tickets/index.php#L238"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3618136%40tickera-event-ticketing-system\u0026new=3618136%40tickera-event-ticketing-system"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-10T19:36:05.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-22T20:55:02.000Z",
"value": "Disclosed"
}
],
"title": "Tickera \u003c= 3.6.0.1 - Authenticated (Staff+) SQL Injection via \u0027tc_order_status_filter\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15448",
"datePublished": "2026-07-23T09:33:58.352Z",
"dateReserved": "2026-07-10T19:20:56.047Z",
"dateUpdated": "2026-07-23T16:04:18.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}