Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
212 vulnerabilities by smub
CVE-2026-101921 (GCVE-0-2026-101921)
Vulnerability from nvd – Published: 2026-10-10 07:41 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute
Summary
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag (e.g. "x")' parameter in all versions up to, and including, 2.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that a site administrator has previously saved a form whose description embeds a {query_var} Smart Tag inside an iframe srcdoc attribute and has enabled Show Description on a public-facing page.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:11 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More |
Affected:
0 , ≤ 2.0.2.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101921",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:11:54.362686Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:44.291Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz \u0026 More",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "2.0.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "UKO"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz \u0026 More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u0027attacker-chosen key referenced by the smart tag (e.g. \"x\")\u0027 parameter in all versions up to, and including, 2.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that a site administrator has previously saved a form whose description embeds a {query_var} Smart Tag inside an iframe srcdoc attribute and has enabled Show Description on a public-facing page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:44.285Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/39e1abcf-c3b6-4c53-a3dc-8a5741f24cca?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/2.0.2.1/src/SmartTags/SmartTags.php#L673"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/2.0.2.1/src/SmartTags/SmartTag/QueryVar.php#L34"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/2.0.2.1/src/Frontend/Classic.php#L323"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3730630%40wpforms-lite\u0026old=3709178%40wpforms-lite"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3730630/wpforms-lite/trunk/src/SmartTags/SmartTags.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-28T16:15:25.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:10:54.000Z",
"value": "Disclosed"
}
],
"title": "WPForms \u003c= 2.0.2.1 - Reflected Cross-Site Scripting via \u0027query_var\u0027 Smart Tag in iframe srcdoc Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-101921",
"datePublished": "2026-10-10T07:41:44.285Z",
"dateReserved": "2026-09-28T16:00:15.271Z",
"dateUpdated": "2026-10-11T12:13:44.291Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14335 (GCVE-0-2026-14335)
Vulnerability from nvd – Published: 2026-10-10 05:31 – Updated: 2026-10-11 12:23
VLAI
EPSS
VEX
Title
Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters
Summary
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:14 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | Easy Digital Downloads – eCommerce Payments and Subscriptions made easy |
Affected:
0 , ≤ 3.6.9
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14335",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:14:41.129311Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:23:56.383Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "3.6.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "skyv3il"
},
{
"lang": "en",
"type": "finder",
"value": "AmonRa"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T05:31:07.474Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eea7ddc4-b3fb-4bad-9acc-9d913ecb8e1b?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3625073/easy-digital-downloads/trunk/includes/admin/reporting/class-gateway-error-logs-list-table.php?old=3226442\u0026old_path=easy-digital-downloads%2Ftrunk%2Fincludes%2Fadmin%2Freporting%2Fclass-gateway-error-logs-list-table.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-04T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-07-01T13:11:17.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T16:46:10.000Z",
"value": "Disclosed"
}
],
"title": "Easy Digital Downloads \u003c= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-14335",
"datePublished": "2026-10-10T05:31:07.474Z",
"dateReserved": "2026-07-01T12:55:45.754Z",
"dateUpdated": "2026-10-11T12:23:56.383Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100152 (GCVE-0-2026-100152)
Vulnerability from nvd – Published: 2026-10-03 05:29 – Updated: 2026-10-03 15:42
VLAI
EPSS
VEX
Title
All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter
Summary
The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This requires the AIOSEO breadcrumb to be rendered on the search results page via the block, widget, shortcode, or template tag.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-03 15:27 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) |
Affected:
0 , ≤ 5.0.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-100152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-03T15:27:31.930798Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T15:42:44.600Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings \u0026 Traffic (Schema, Local SEO, Sitemap \u0026 SEO Insights)",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "5.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kuba"
}
],
"descriptions": [
{
"lang": "en",
"value": "The The All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings \u0026 Traffic (Schema, Local SEO, Sitemap \u0026 SEO Insights) plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This requires the AIOSEO breadcrumb to be rendered on the search results page via the block, widget, shortcode, or template tag."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T05:29:16.146Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9fa47d2b-e9a9-4d1b-b933-fd4aa453ba1a?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.2/app/Common/Breadcrumbs/Frontend.php#L280"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.2/app/Common/Breadcrumbs/Frontend.php#L104"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.2/app/Common/Breadcrumbs/Breadcrumbs.php#L242"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.2/app/Common/Breadcrumbs/Tags.php#L108"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3723760/all-in-one-seo-pack/trunk/app/Common/Breadcrumbs/Frontend.php?old=3709877\u0026old_path=all-in-one-seo-pack%2Ftrunk%2Fapp%2FCommon%2FBreadcrumbs%2FFrontend.php"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3723760/all-in-one-seo-pack/trunk/app/Common/Breadcrumbs/Frontend.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-25T12:19:21.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-02T16:33:28.000Z",
"value": "Disclosed"
}
],
"title": "All in One SEO \u003c= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via \u0027s\u0027 Search Query Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-100152",
"datePublished": "2026-10-03T05:29:16.146Z",
"dateReserved": "2026-09-25T12:04:15.445Z",
"dateUpdated": "2026-10-03T15:42:44.600Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85492 (GCVE-0-2026-85492)
Vulnerability from nvd – Published: 2026-10-02 09:25 – Updated: 2026-10-03 15:42
VLAI
EPSS
VEX
Title
All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname
Summary
The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user visits a crafted URL. Exploitation requires the victim to hold the aioseo_manage_seo capability and to open the SEO Preview panel in the WordPress admin toolbar while visiting a page with a malicious payload embedded in the URL pathname.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-03 15:28 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) |
Affected:
0 , ≤ 5.0.1.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85492",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-03T15:28:30.710466Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T15:42:48.068Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings \u0026 Traffic (Schema, Local SEO, Sitemap \u0026 SEO Insights)",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "5.0.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "mak3bread"
}
],
"descriptions": [
{
"lang": "en",
"value": "The All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings \u0026 Traffic (Schema, Local SEO, Sitemap \u0026 SEO Insights) plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user visits a crafted URL. Exploitation requires the victim to hold the aioseo_manage_seo capability and to open the SEO Preview panel in the WordPress admin toolbar while visiting a page with a malicious payload embedded in the URL pathname."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T09:25:56.509Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5d4da592-3e8a-401d-b461-1770db9de654?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.1.1/dist/Lite/assets/js/GoogleSearchPreview.8286359f.js#L1"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.1.1/dist/Lite/assets/js/app-core.36551fe5.js#L1"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3709882%40all-in-one-seo-pack%2Ftags%2F5.0.2\u0026old=3670552%40all-in-one-seo-pack%2Ftags%2F5.0.1.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-03T22:04:08.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-01T20:40:52.000Z",
"value": "Disclosed"
}
],
"title": "All in One SEO \u003c= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-85492",
"datePublished": "2026-10-02T09:25:56.509Z",
"dateReserved": "2026-09-03T21:44:22.180Z",
"dateUpdated": "2026-10-03T15:42:48.068Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93756 (GCVE-0-2026-93756)
Vulnerability from nvd – Published: 2026-10-02 07:39 – Updated: 2026-10-03 15:42
VLAI
EPSS
VEX
Title
Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview
Summary
The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator accesses the feed builder preview page. This attack requires only a Facebook account to post a comment on the connected Facebook Page, with no WordPress credentials needed; additionally, the use of v-show rather than v-if means injected HTML — including onerror handlers — is evaluated in the DOM even when the comment section is not visually displayed. When combined with the lack of URL validation in the cff_install_addon AJAX handler (admin/addon-functions.php), an injected script running in an administrator's session can trigger arbitrary plugin installation from an attacker-controlled URL, which may result in server-side code execution.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-03 15:29 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | Smash Balloon Social Post Feed – Simple Social Feeds for WordPress |
Affected:
0 , ≤ 4.13.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93756",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-03T15:29:58.438463Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T15:42:48.981Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Smash Balloon Social Post Feed \u2013 Simple Social Feeds for WordPress",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "4.13.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuto Hyakumoto"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Smash Balloon Social Post Feed \u2013 Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator accesses the feed builder preview page. This attack requires only a Facebook account to post a comment on the connected Facebook Page, with no WordPress credentials needed; additionally, the use of v-show rather than v-if means injected HTML \u2014 including onerror handlers \u2014 is evaluated in the DOM even when the comment section is not visually displayed. When combined with the lack of URL validation in the cff_install_addon AJAX handler (admin/addon-functions.php), an injected script running in an administrator\u0027s session can trigger arbitrary plugin installation from an attacker-controlled URL, which may result in server-side code execution."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T07:39:27.358Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a4a3bc4b-bc0c-47ac-9f60-e05b300311b4?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.12.0/inc/Integrations/CFF_Graph_Url.php#L76"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.12.0/inc/Builder/CFF_Feed_Builder.php#L805"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.12.0/admin/builder/templates/preview/preview-components.php#L142"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.12.0/inc/Builder/CFF_Feed_Builder.php#L242"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.12.0/admin/addon-functions.php#L142"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3720826/custom-facebook-feed/trunk/admin/builder/templates/preview/preview-components.php?old=3656491\u0026old_path=custom-facebook-feed%2Ftrunk%2Fadmin%2Fbuilder%2Ftemplates%2Fpreview%2Fpreview-components.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T16:53:36.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-01T18:58:03.000Z",
"value": "Disclosed"
}
],
"title": "Smash Balloon Social Post Feed \u003c= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-93756",
"datePublished": "2026-10-02T07:39:27.358Z",
"dateReserved": "2026-09-18T16:38:25.574Z",
"dateUpdated": "2026-10-03T15:42:48.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88996 (GCVE-0-2026-88996)
Vulnerability from nvd – Published: 2026-09-25 07:40 – Updated: 2026-09-25 10:33
VLAI
EPSS
VEX
Title
WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter
Summary
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'page_title' POST Parameter via {page_title} Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable on forms whose admin-authored confirmation message places the {page_title} Smart Tag inside an HTML attribute context.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 10:31 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More |
Affected:
0 , ≤ 2.0.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88996",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T10:31:56.123505Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:33:00.989Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz \u0026 More",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "2.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "UKO"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz \u0026 More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via \u0027page_title\u0027 POST Parameter via {page_title} Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable on forms whose admin-authored confirmation message places the {page_title} Smart Tag inside an HTML attribute context."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T07:40:24.474Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0a10570c-542a-494c-9dea-96a58b91139e?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/2.0.1.1/src/Frontend/Classic.php#L297"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/2.0.1.1/src/SmartTags/SmartTag/PageTitle.php#L33"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/2.0.1.1/src/SmartTags/SmartTags.php#L482"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/2.0.1.1/includes/class-process.php#L1718"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3709178%40wpforms-lite\u0026new=3709178%40wpforms-lite"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-10T16:23:00.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-24T19:08:46.000Z",
"value": "Disclosed"
}
],
"title": "WPForms \u003c= 2.0.2 - Reflected Cross-Site Scripting via \u0027page_title\u0027 POST Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-88996",
"datePublished": "2026-09-25T07:40:24.474Z",
"dateReserved": "2026-09-10T16:07:54.730Z",
"dateUpdated": "2026-09-25T10:33:00.989Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84909 (GCVE-0-2026-84909)
Vulnerability from nvd – Published: 2026-09-18 06:38 – Updated: 2026-09-18 14:31
VLAI
EPSS
VEX
Title
Custom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute
Summary
The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable on common installs where the admin has configured access tokens with zero or multiple legacy feeds, as this causes the ctf_statuses support_legacy_shortcode option to be set to boolean true by default, activating the unfiltered legacy shortcode attribute code path.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 14:16 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | Custom Twitter Feeds – A Tweets Widget or X Feed Widget |
Affected:
0 , ≤ 2.8.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84909",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T14:16:07.796663Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T14:31:44.098Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Custom Twitter Feeds \u2013 A Tweets Widget or X Feed Widget",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "2.8.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Custom Twitter Feeds \u2013 A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027buttoncolor\u0027 Shortcode Attribute in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable on common installs where the admin has configured access tokens with zero or multiple legacy feeds, as this causes the ctf_statuses support_legacy_shortcode option to be set to boolean true by default, activating the unfiltered legacy shortcode attribute code path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T06:38:55.694Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b1a9d042-c0c0-477a-8cdf-9fb9d2239059?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.8.0/inc/CtfFeed.php#L2338"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.8.0/inc/CTF_Parse.php#L551"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.8.0/inc/CtfFeed.php#L2001"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.8.0/inc/CTF_Settings.php#L293"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.8.0/inc/CTF_Settings.php#L234"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.8.0/inc/CtfFeed.php#L139"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.8.0/custom-twitter-feed.php#L432"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3695675%40custom-twitter-feeds\u0026old=3665650%40custom-twitter-feeds"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-02T15:57:47.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-17T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Custom Twitter Feeds \u003c= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027buttoncolor\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-84909",
"datePublished": "2026-09-18T06:38:55.694Z",
"dateReserved": "2026-09-02T15:42:41.203Z",
"dateUpdated": "2026-09-18T14:31:44.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77189 (GCVE-0-2026-77189)
Vulnerability from nvd – Published: 2026-09-01 05:30 – Updated: 2026-09-02 17:57
VLAI
EPSS
VEX
Title
Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute
Summary
The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The [charitable_donors] shortcode is accessible to Contributor-level users via draft or pending post previews, providing an authenticated but low-privileged entry point for exploitation.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 17:57 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) |
Affected:
0 , ≤ 1.8.12.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77189",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T17:57:23.398544Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T17:57:36.245Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Charitable \u2013 Donation \u0026 Fundraising Platform (Donation Forms, Recurring Donations \u0026 Fundraising Campaigns)",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "1.8.12.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Charitable \u2013 Donation \u0026 Fundraising Platform (Donation Forms, Recurring Donations \u0026 Fundraising Campaigns) plugin for WordPress is vulnerable to generic SQL Injection via \u0027order\u0027 Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The [charitable_donors] shortcode is accessible to Contributor-level users via draft or pending post previews, providing an authenticated but low-privileged entry point for exploitation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T05:30:40.881Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1cfc48bc-1768-49ef-bb22-7fa2c6691b23?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.12.1/includes/abstracts/abstract-class-charitable-query.php#L443"
},
{
"url": "https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.12.1/includes/abstracts/abstract-class-charitable-query.php#L194"
},
{
"url": "https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.12.1/includes/queries/class-charitable-donor-query.php#L60"
},
{
"url": "https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.12.1/includes/shortcodes/class-charitable-donors-shortcode.php#L52"
},
{
"url": "https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.12.1/includes/shortcodes/class-charitable-donors-shortcode.php#L171"
},
{
"url": "https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.12.1/includes/shortcodes/charitable-shortcodes-hooks.php#L37"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3662994%40charitable\u0026new=3662994%40charitable"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-20T16:54:34.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-08-31T17:03:35.000Z",
"value": "Disclosed"
}
],
"title": "Charitable \u003c= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via \u0027order\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-77189",
"datePublished": "2026-09-01T05:30:40.881Z",
"dateReserved": "2026-08-20T16:39:24.018Z",
"dateUpdated": "2026-09-02T17:57:36.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3423 (GCVE-0-2026-3423)
Vulnerability from nvd – Published: 2026-08-28 11:29 – Updated: 2026-08-28 16:09
VLAI
EPSS
VEX
Title
Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description
Summary
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page displaying the gallery with a description enabled.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 16:09 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More |
Affected:
0 , ≤ 1.12.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3423",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T16:09:01.557156Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T16:09:20.421Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows \u0026 More",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "1.12.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lord willmore"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery \u0027description\u0027 configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page displaying the gallery with a description enabled."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T11:29:28.138Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/17de5b96-7a61-4f37-a921-6a023cc40812?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/envira-gallery-lite/trunk/includes/global/shortcode.php#L807"
},
{
"url": "https://plugins.trac.wordpress.org/browser/envira-gallery-lite/trunk/includes/global/rest.php#L192"
},
{
"url": "https://plugins.trac.wordpress.org/browser/envira-gallery-lite/trunk/includes/global/rest.php#L239"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3514026/envira-gallery-lite/trunk/includes/global/shortcode.php?old=3465371\u0026old_path=envira-gallery-lite%2Ftrunk%2Fincludes%2Fglobal%2Fshortcode.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-02T04:05:51.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-08-27T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Envira Gallery \u003c= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-3423",
"datePublished": "2026-08-28T11:29:28.138Z",
"dateReserved": "2026-03-02T03:50:27.235Z",
"dateUpdated": "2026-08-28T16:09:20.421Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16775 (GCVE-0-2026-16775)
Vulnerability from nvd – Published: 2026-08-16 05:27 – Updated: 2026-08-17 17:10
VLAI
EPSS
VEX
Title
Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Summary
The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Attribute in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 17:09 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | Smash Balloon Social Post Feed – Simple Social Feeds for WordPress |
Affected:
0 , ≤ 4.9.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16775",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T17:09:34.670925Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T17:10:39.060Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Smash Balloon Social Post Feed \u2013 Simple Social Feeds for WordPress",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "4.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Smash Balloon Social Post Feed \u2013 Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027id\u0027 Shortcode Attribute in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-16T05:27:30.012Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ae039144-2c02-4a00-9fff-f4e90a6a8236?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.9.0/inc/CFF_Shortcode.php#L1149"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.9.0/inc/CFF_Shortcode.php#L312"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.9.0/inc/CFF_FB_Settings.php#L59"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3640517/custom-facebook-feed/trunk/inc/CFF_Shortcode.php?old=3465306\u0026old_path=custom-facebook-feed%2Ftrunk%2Finc%2FCFF_Shortcode.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-23T17:25:15.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-08-15T16:27:31.000Z",
"value": "Disclosed"
}
],
"title": "Smash Balloon Social Post Feed \u003c= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027id\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-16775",
"datePublished": "2026-08-16T05:27:30.012Z",
"dateReserved": "2026-07-23T17:10:06.554Z",
"dateUpdated": "2026-08-17T17:10:39.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15452 (GCVE-0-2026-15452)
Vulnerability from nvd – Published: 2026-08-05 09:26 – Updated: 2026-08-05 14:26
VLAI
EPSS
VEX
Title
Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String
Summary
The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query String in all versions up to, and including, 6.11.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 14:25 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | Smash Balloon Social Photo Feed – Easy Social Feeds Plugin |
Affected:
0 , ≤ 6.11.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15452",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T14:25:54.740470Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T14:26:41.490Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Smash Balloon Social Photo Feed \u2013 Easy Social Feeds Plugin",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "6.11.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tarc\u00edsio Luchesi De Almeida Silva (Poystick)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Smash Balloon Social Photo Feed \u2013 Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query String in all versions up to, and including, 6.11.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T09:26:25.631Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/33f1d8b9-3561-4347-8267-8c36d4c9071f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.3/admin/SBI_Callout.php#L448"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.3/admin/SBI_Callout.php#L361"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.3/admin/SBI_Callout.php#L386"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.3/admin/SBI_Callout.php#L319"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.0/admin/SBI_Callout.php#L448"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.0/admin/SBI_Callout.php#L361"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.0/admin/SBI_Callout.php#L386"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.0/admin/SBI_Callout.php#L319"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3619076/instagram-feed/trunk/admin/SBI_Callout.php?old=3481379\u0026old_path=instagram-feed%2Ftrunk%2Fadmin%2FSBI_Callout.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-10T19:51:12.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-08-04T20:42:08.000Z",
"value": "Disclosed"
}
],
"title": "Smash Balloon Social Photo Feed \u003c= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15452",
"datePublished": "2026-08-05T09:26:25.631Z",
"dateReserved": "2026-07-10T19:35:50.380Z",
"dateUpdated": "2026-08-05T14:26:41.490Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12476 (GCVE-0-2026-12476)
Vulnerability from nvd – Published: 2026-07-29 02:31 – Updated: 2026-07-29 12:22
VLAI
EPSS
VEX
Title
Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter
Summary
The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edd_do_ajax_import_file_upload() function , which only checks the client-supplied $_FILES['edd-import-file']['type'] Content-Type header against an allow-list of CSV mime types, then uses raw move_uploaded_file() (bypassing wp_handle_upload()'s core MIME enforcement) to write the file under its original extension into the web-accessible wp-content/uploads/edd/exports/ directory. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-29 12:22 UTC
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | Easy Digital Downloads – eCommerce Payments and Subscriptions made easy |
Affected:
0 , ≤ 3.6.9
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12476",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T12:22:04.545877Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T12:22:13.311Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "3.6.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tal Kantor"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edd_do_ajax_import_file_upload() function , which only checks the client-supplied $_FILES[\u0027edd-import-file\u0027][\u0027type\u0027] Content-Type header against an allow-list of CSV mime types, then uses raw move_uploaded_file() (bypassing wp_handle_upload()\u0027s core MIME enforcement) to write the file under its original extension into the web-accessible wp-content/uploads/edd/exports/ directory. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to upload arbitrary files on the affected site\u0027s server which may make remote code execution possible."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T02:31:38.774Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5b0c8edd-b392-4d23-bde3-0521eeedc5a0?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.6.8/includes/admin/import/import-functions.php#L92"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.6.8/includes/admin/import/import-functions.php#L68"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.6.8/includes/admin/import/import-functions.php#L87"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.6.7/includes/admin/import/import-functions.php#L92"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.6.7/includes/admin/import/import-functions.php#L68"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.6.7/includes/admin/import/import-functions.php#L87"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3625073/easy-digital-downloads/trunk/includes/admin/import/import-functions.php?old=3577787\u0026old_path=easy-digital-downloads%2Ftrunk%2Fincludes%2Fadmin%2Fimport%2Fimport-functions.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-16T20:40:23.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-28T13:30:14.000Z",
"value": "Disclosed"
}
],
"title": "Easy Digital Downloads \u003c= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via \u0027edd-import-file\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12476",
"datePublished": "2026-07-29T02:31:38.774Z",
"dateReserved": "2026-06-16T20:25:13.528Z",
"dateUpdated": "2026-07-29T12:22:13.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15782 (GCVE-0-2026-15782)
Vulnerability from nvd – Published: 2026-07-21 05:35 – Updated: 2026-07-21 13:27
VLAI
EPSS
VEX
Title
WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content
Summary
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content in all versions up to, and including, 2.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the OptinMonster plugin to be installed and configured with an active inline campaign that outputs matching #om-{id} markup on the target page, as the WPForms handler only fires when OptinMonster emits its 'om.Campaign.load' event.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-21 13:27 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More |
Affected:
0 , ≤ 2.0.0.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15782",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-21T13:27:39.279188Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T13:27:49.495Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz \u0026 More",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "2.0.0.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Asaf Mozes"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz \u0026 More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content in all versions up to, and including, 2.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the OptinMonster plugin to be installed and configured with an active inline campaign that outputs matching #om-{id} markup on the target page, as the WPForms handler only fires when OptinMonster emits its \u0027om.Campaign.load\u0027 event."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T05:35:28.946Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6d5264a1-dabf-4630-9871-ab6e14817768?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.2.1/assets/js/frontend/wpforms.min.js#L5"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.4/assets/js/frontend/wpforms.min.js#L5"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3610719/wpforms-lite/trunk/assets/js/frontend/wpforms.min.js?old=3586095\u0026old_path=wpforms-lite%2Ftrunk%2Fassets%2Fjs%2Ffrontend%2Fwpforms.min.js"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-14T19:12:07.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-20T16:53:08.000Z",
"value": "Disclosed"
}
],
"title": "WPForms \u003c= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15782",
"datePublished": "2026-07-21T05:35:28.946Z",
"dateReserved": "2026-07-14T18:56:43.945Z",
"dateUpdated": "2026-07-21T13:27:49.495Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12002 (GCVE-0-2026-12002)
Vulnerability from nvd – Published: 2026-07-08 12:33 – Updated: 2026-07-08 13:03
VLAI
EPSS
VEX
Title
Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter
Summary
The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.11.1. This is due to missing or incorrect nonce validation on the maybe_connection_data function. This makes it possible for unauthenticated attackers to overwrite the site's Instagram and Facebook oEmbed access tokens via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-08 13:02 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | Smash Balloon Social Photo Feed – Easy Social Feeds Plugin |
Affected:
0 , ≤ 6.11.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12002",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-08T13:02:53.626151Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:04.692Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Smash Balloon Social Photo Feed \u2013 Easy Social Feeds Plugin",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "6.11.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "normaandersonfrank"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Smash Balloon Social Photo Feed \u2013 Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.11.1. This is due to missing or incorrect nonce validation on the maybe_connection_data function. This makes it possible for unauthenticated attackers to overwrite the site\u0027s Instagram and Facebook oEmbed access tokens via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T12:33:16.785Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/abe6366a-3729-474f-8920-b5ed2eeab906?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3575933/instagram-feed/trunk/admin/SBI_oEmbeds.php?old=3289310\u0026old_path=instagram-feed%2Ftrunk%2Fadmin%2FSBI_oEmbeds.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-06T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-06-11T17:14:54.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-08T00:00:58.000Z",
"value": "Disclosed"
}
],
"title": "Smash Balloon Social Photo Feed \u2013 Easy Social Feeds Plugin \u003c= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via \u0027sbi_access_token\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12002",
"datePublished": "2026-07-08T12:33:16.785Z",
"dateReserved": "2026-06-11T16:59:38.484Z",
"dateUpdated": "2026-07-08T13:03:04.692Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12127 (GCVE-0-2026-12127)
Vulnerability from nvd – Published: 2026-07-01 04:32 – Updated: 2026-07-01 10:42
VLAI
EPSS
VEX
Title
WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name
Summary
The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Improper Neutralization of CRLF Sequences ('CRLF Injection') in all versions up to, and including, 1.10.2 This is due to `get_reply_to_address()` processing the Reply-To display name through smart-tag expansion with context `'notification'` instead of `'notification-reply-to'`, which bypasses email-address validation while `wpforms_sanitize_textarea_field()` intentionally preserves CR/LF characters that are never stripped before the display name is concatenated into the raw `Reply-To:` mail header string. This makes it possible for unauthenticated attackers to inject arbitrary additional email headers — such as `Bcc:` — into outgoing notification emails, silently blind-copying all notification email copies to an attacker-controlled address. Exploitation requires that a form notification is configured to use a Paragraph Text (textarea) field as the Reply-To display name via a Smart Tag.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-01 10:31 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
11 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More |
Affected:
0 , ≤ 1.10.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12127",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-01T10:31:09.519094Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T10:42:10.985Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz \u0026 More",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "1.10.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jack Pas (Dark.)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPForms \u2013 Easy Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Surveys, \u0026 More plugin for WordPress is vulnerable to Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027) in all versions up to, and including, 1.10.2 This is due to `get_reply_to_address()` processing the Reply-To display name through smart-tag expansion with context `\u0027notification\u0027` instead of `\u0027notification-reply-to\u0027`, which bypasses email-address validation while `wpforms_sanitize_textarea_field()` intentionally preserves CR/LF characters that are never stripped before the display name is concatenated into the raw `Reply-To:` mail header string. This makes it possible for unauthenticated attackers to inject arbitrary additional email headers \u2014 such as `Bcc:` \u2014 into outgoing notification emails, silently blind-copying all notification email copies to an attacker-controlled address. Exploitation requires that a form notification is configured to use a Paragraph Text (textarea) field as the Reply-To display name via a Smart Tag."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93 Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T04:32:27.607Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d5a51c22-c4ca-4897-ad7e-c5df00b07fe0?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.1.1/src/Emails/Mailer.php#L368"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.1.1/src/Emails/Notifications.php#L1098"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.1.1/src/Emails/Notifications.php#L1138"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.1.1/includes/fields/class-textarea.php#L326"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/src/Emails/Mailer.php#L368"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/src/Emails/Notifications.php#L1098"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/src/Emails/Notifications.php#L1138"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/includes/fields/class-textarea.php#L326"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3586095/wpforms-lite/trunk/src/Emails/Mailer.php"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fwpforms-lite/tags/1.10.2\u0026new_path=%2Fwpforms-lite/tags/1.10.2.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-12T15:48:56.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-06-30T16:02:50.000Z",
"value": "Disclosed"
}
],
"title": "WPForms \u003c= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12127",
"datePublished": "2026-07-01T04:32:27.607Z",
"dateReserved": "2026-06-12T15:16:37.220Z",
"dateUpdated": "2026-07-01T10:42:10.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101921 (GCVE-0-2026-101921)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:41 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute
Summary
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag (e.g. "x")' parameter in all versions up to, and including, 2.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that a site administrator has previously saved a form whose description embeds a {query_var} Smart Tag inside an iframe srcdoc attribute and has enabled Show Description on a public-facing page.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:11 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More |
Affected:
0 , ≤ 2.0.2.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101921",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:11:54.362686Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:44.291Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz \u0026 More",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "2.0.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "UKO"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz \u0026 More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u0027attacker-chosen key referenced by the smart tag (e.g. \"x\")\u0027 parameter in all versions up to, and including, 2.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that a site administrator has previously saved a form whose description embeds a {query_var} Smart Tag inside an iframe srcdoc attribute and has enabled Show Description on a public-facing page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:44.285Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/39e1abcf-c3b6-4c53-a3dc-8a5741f24cca?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/2.0.2.1/src/SmartTags/SmartTags.php#L673"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/2.0.2.1/src/SmartTags/SmartTag/QueryVar.php#L34"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/2.0.2.1/src/Frontend/Classic.php#L323"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3730630%40wpforms-lite\u0026old=3709178%40wpforms-lite"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3730630/wpforms-lite/trunk/src/SmartTags/SmartTags.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-28T16:15:25.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:10:54.000Z",
"value": "Disclosed"
}
],
"title": "WPForms \u003c= 2.0.2.1 - Reflected Cross-Site Scripting via \u0027query_var\u0027 Smart Tag in iframe srcdoc Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-101921",
"datePublished": "2026-10-10T07:41:44.285Z",
"dateReserved": "2026-09-28T16:00:15.271Z",
"dateUpdated": "2026-10-11T12:13:44.291Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14335 (GCVE-0-2026-14335)
Vulnerability from cvelistv5 – Published: 2026-10-10 05:31 – Updated: 2026-10-11 12:23
VLAI
EPSS
VEX
Title
Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters
Summary
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:14 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | Easy Digital Downloads – eCommerce Payments and Subscriptions made easy |
Affected:
0 , ≤ 3.6.9
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14335",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:14:41.129311Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:23:56.383Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "3.6.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "skyv3il"
},
{
"lang": "en",
"type": "finder",
"value": "AmonRa"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T05:31:07.474Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eea7ddc4-b3fb-4bad-9acc-9d913ecb8e1b?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3625073/easy-digital-downloads/trunk/includes/admin/reporting/class-gateway-error-logs-list-table.php?old=3226442\u0026old_path=easy-digital-downloads%2Ftrunk%2Fincludes%2Fadmin%2Freporting%2Fclass-gateway-error-logs-list-table.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-04T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-07-01T13:11:17.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T16:46:10.000Z",
"value": "Disclosed"
}
],
"title": "Easy Digital Downloads \u003c= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-14335",
"datePublished": "2026-10-10T05:31:07.474Z",
"dateReserved": "2026-07-01T12:55:45.754Z",
"dateUpdated": "2026-10-11T12:23:56.383Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100152 (GCVE-0-2026-100152)
Vulnerability from cvelistv5 – Published: 2026-10-03 05:29 – Updated: 2026-10-03 15:42
VLAI
EPSS
VEX
Title
All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter
Summary
The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This requires the AIOSEO breadcrumb to be rendered on the search results page via the block, widget, shortcode, or template tag.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-03 15:27 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) |
Affected:
0 , ≤ 5.0.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-100152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-03T15:27:31.930798Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T15:42:44.600Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings \u0026 Traffic (Schema, Local SEO, Sitemap \u0026 SEO Insights)",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "5.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kuba"
}
],
"descriptions": [
{
"lang": "en",
"value": "The The All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings \u0026 Traffic (Schema, Local SEO, Sitemap \u0026 SEO Insights) plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This requires the AIOSEO breadcrumb to be rendered on the search results page via the block, widget, shortcode, or template tag."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T05:29:16.146Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9fa47d2b-e9a9-4d1b-b933-fd4aa453ba1a?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.2/app/Common/Breadcrumbs/Frontend.php#L280"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.2/app/Common/Breadcrumbs/Frontend.php#L104"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.2/app/Common/Breadcrumbs/Breadcrumbs.php#L242"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.2/app/Common/Breadcrumbs/Tags.php#L108"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3723760/all-in-one-seo-pack/trunk/app/Common/Breadcrumbs/Frontend.php?old=3709877\u0026old_path=all-in-one-seo-pack%2Ftrunk%2Fapp%2FCommon%2FBreadcrumbs%2FFrontend.php"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3723760/all-in-one-seo-pack/trunk/app/Common/Breadcrumbs/Frontend.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-25T12:19:21.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-02T16:33:28.000Z",
"value": "Disclosed"
}
],
"title": "All in One SEO \u003c= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via \u0027s\u0027 Search Query Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-100152",
"datePublished": "2026-10-03T05:29:16.146Z",
"dateReserved": "2026-09-25T12:04:15.445Z",
"dateUpdated": "2026-10-03T15:42:44.600Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85492 (GCVE-0-2026-85492)
Vulnerability from cvelistv5 – Published: 2026-10-02 09:25 – Updated: 2026-10-03 15:42
VLAI
EPSS
VEX
Title
All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname
Summary
The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user visits a crafted URL. Exploitation requires the victim to hold the aioseo_manage_seo capability and to open the SEO Preview panel in the WordPress admin toolbar while visiting a page with a malicious payload embedded in the URL pathname.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-03 15:28 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) |
Affected:
0 , ≤ 5.0.1.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85492",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-03T15:28:30.710466Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T15:42:48.068Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings \u0026 Traffic (Schema, Local SEO, Sitemap \u0026 SEO Insights)",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "5.0.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "mak3bread"
}
],
"descriptions": [
{
"lang": "en",
"value": "The All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings \u0026 Traffic (Schema, Local SEO, Sitemap \u0026 SEO Insights) plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user visits a crafted URL. Exploitation requires the victim to hold the aioseo_manage_seo capability and to open the SEO Preview panel in the WordPress admin toolbar while visiting a page with a malicious payload embedded in the URL pathname."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T09:25:56.509Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5d4da592-3e8a-401d-b461-1770db9de654?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.1.1/dist/Lite/assets/js/GoogleSearchPreview.8286359f.js#L1"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.1.1/dist/Lite/assets/js/app-core.36551fe5.js#L1"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3709882%40all-in-one-seo-pack%2Ftags%2F5.0.2\u0026old=3670552%40all-in-one-seo-pack%2Ftags%2F5.0.1.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-03T22:04:08.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-01T20:40:52.000Z",
"value": "Disclosed"
}
],
"title": "All in One SEO \u003c= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-85492",
"datePublished": "2026-10-02T09:25:56.509Z",
"dateReserved": "2026-09-03T21:44:22.180Z",
"dateUpdated": "2026-10-03T15:42:48.068Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93756 (GCVE-0-2026-93756)
Vulnerability from cvelistv5 – Published: 2026-10-02 07:39 – Updated: 2026-10-03 15:42
VLAI
EPSS
VEX
Title
Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview
Summary
The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator accesses the feed builder preview page. This attack requires only a Facebook account to post a comment on the connected Facebook Page, with no WordPress credentials needed; additionally, the use of v-show rather than v-if means injected HTML — including onerror handlers — is evaluated in the DOM even when the comment section is not visually displayed. When combined with the lack of URL validation in the cff_install_addon AJAX handler (admin/addon-functions.php), an injected script running in an administrator's session can trigger arbitrary plugin installation from an attacker-controlled URL, which may result in server-side code execution.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-03 15:29 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | Smash Balloon Social Post Feed – Simple Social Feeds for WordPress |
Affected:
0 , ≤ 4.13.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93756",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-03T15:29:58.438463Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T15:42:48.981Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Smash Balloon Social Post Feed \u2013 Simple Social Feeds for WordPress",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "4.13.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuto Hyakumoto"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Smash Balloon Social Post Feed \u2013 Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator accesses the feed builder preview page. This attack requires only a Facebook account to post a comment on the connected Facebook Page, with no WordPress credentials needed; additionally, the use of v-show rather than v-if means injected HTML \u2014 including onerror handlers \u2014 is evaluated in the DOM even when the comment section is not visually displayed. When combined with the lack of URL validation in the cff_install_addon AJAX handler (admin/addon-functions.php), an injected script running in an administrator\u0027s session can trigger arbitrary plugin installation from an attacker-controlled URL, which may result in server-side code execution."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T07:39:27.358Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a4a3bc4b-bc0c-47ac-9f60-e05b300311b4?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.12.0/inc/Integrations/CFF_Graph_Url.php#L76"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.12.0/inc/Builder/CFF_Feed_Builder.php#L805"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.12.0/admin/builder/templates/preview/preview-components.php#L142"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.12.0/inc/Builder/CFF_Feed_Builder.php#L242"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.12.0/admin/addon-functions.php#L142"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3720826/custom-facebook-feed/trunk/admin/builder/templates/preview/preview-components.php?old=3656491\u0026old_path=custom-facebook-feed%2Ftrunk%2Fadmin%2Fbuilder%2Ftemplates%2Fpreview%2Fpreview-components.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T16:53:36.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-01T18:58:03.000Z",
"value": "Disclosed"
}
],
"title": "Smash Balloon Social Post Feed \u003c= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-93756",
"datePublished": "2026-10-02T07:39:27.358Z",
"dateReserved": "2026-09-18T16:38:25.574Z",
"dateUpdated": "2026-10-03T15:42:48.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88996 (GCVE-0-2026-88996)
Vulnerability from cvelistv5 – Published: 2026-09-25 07:40 – Updated: 2026-09-25 10:33
VLAI
EPSS
VEX
Title
WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter
Summary
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'page_title' POST Parameter via {page_title} Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable on forms whose admin-authored confirmation message places the {page_title} Smart Tag inside an HTML attribute context.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 10:31 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More |
Affected:
0 , ≤ 2.0.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88996",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T10:31:56.123505Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:33:00.989Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz \u0026 More",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "2.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "UKO"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz \u0026 More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via \u0027page_title\u0027 POST Parameter via {page_title} Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable on forms whose admin-authored confirmation message places the {page_title} Smart Tag inside an HTML attribute context."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T07:40:24.474Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0a10570c-542a-494c-9dea-96a58b91139e?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/2.0.1.1/src/Frontend/Classic.php#L297"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/2.0.1.1/src/SmartTags/SmartTag/PageTitle.php#L33"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/2.0.1.1/src/SmartTags/SmartTags.php#L482"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/2.0.1.1/includes/class-process.php#L1718"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3709178%40wpforms-lite\u0026new=3709178%40wpforms-lite"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-10T16:23:00.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-24T19:08:46.000Z",
"value": "Disclosed"
}
],
"title": "WPForms \u003c= 2.0.2 - Reflected Cross-Site Scripting via \u0027page_title\u0027 POST Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-88996",
"datePublished": "2026-09-25T07:40:24.474Z",
"dateReserved": "2026-09-10T16:07:54.730Z",
"dateUpdated": "2026-09-25T10:33:00.989Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84909 (GCVE-0-2026-84909)
Vulnerability from cvelistv5 – Published: 2026-09-18 06:38 – Updated: 2026-09-18 14:31
VLAI
EPSS
VEX
Title
Custom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute
Summary
The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable on common installs where the admin has configured access tokens with zero or multiple legacy feeds, as this causes the ctf_statuses support_legacy_shortcode option to be set to boolean true by default, activating the unfiltered legacy shortcode attribute code path.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 14:16 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | Custom Twitter Feeds – A Tweets Widget or X Feed Widget |
Affected:
0 , ≤ 2.8.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84909",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T14:16:07.796663Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T14:31:44.098Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Custom Twitter Feeds \u2013 A Tweets Widget or X Feed Widget",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "2.8.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Custom Twitter Feeds \u2013 A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027buttoncolor\u0027 Shortcode Attribute in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable on common installs where the admin has configured access tokens with zero or multiple legacy feeds, as this causes the ctf_statuses support_legacy_shortcode option to be set to boolean true by default, activating the unfiltered legacy shortcode attribute code path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T06:38:55.694Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b1a9d042-c0c0-477a-8cdf-9fb9d2239059?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.8.0/inc/CtfFeed.php#L2338"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.8.0/inc/CTF_Parse.php#L551"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.8.0/inc/CtfFeed.php#L2001"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.8.0/inc/CTF_Settings.php#L293"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.8.0/inc/CTF_Settings.php#L234"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.8.0/inc/CtfFeed.php#L139"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.8.0/custom-twitter-feed.php#L432"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3695675%40custom-twitter-feeds\u0026old=3665650%40custom-twitter-feeds"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-02T15:57:47.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-17T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Custom Twitter Feeds \u003c= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027buttoncolor\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-84909",
"datePublished": "2026-09-18T06:38:55.694Z",
"dateReserved": "2026-09-02T15:42:41.203Z",
"dateUpdated": "2026-09-18T14:31:44.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77189 (GCVE-0-2026-77189)
Vulnerability from cvelistv5 – Published: 2026-09-01 05:30 – Updated: 2026-09-02 17:57
VLAI
EPSS
VEX
Title
Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute
Summary
The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The [charitable_donors] shortcode is accessible to Contributor-level users via draft or pending post previews, providing an authenticated but low-privileged entry point for exploitation.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 17:57 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) |
Affected:
0 , ≤ 1.8.12.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77189",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T17:57:23.398544Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T17:57:36.245Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Charitable \u2013 Donation \u0026 Fundraising Platform (Donation Forms, Recurring Donations \u0026 Fundraising Campaigns)",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "1.8.12.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Charitable \u2013 Donation \u0026 Fundraising Platform (Donation Forms, Recurring Donations \u0026 Fundraising Campaigns) plugin for WordPress is vulnerable to generic SQL Injection via \u0027order\u0027 Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The [charitable_donors] shortcode is accessible to Contributor-level users via draft or pending post previews, providing an authenticated but low-privileged entry point for exploitation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T05:30:40.881Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1cfc48bc-1768-49ef-bb22-7fa2c6691b23?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.12.1/includes/abstracts/abstract-class-charitable-query.php#L443"
},
{
"url": "https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.12.1/includes/abstracts/abstract-class-charitable-query.php#L194"
},
{
"url": "https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.12.1/includes/queries/class-charitable-donor-query.php#L60"
},
{
"url": "https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.12.1/includes/shortcodes/class-charitable-donors-shortcode.php#L52"
},
{
"url": "https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.12.1/includes/shortcodes/class-charitable-donors-shortcode.php#L171"
},
{
"url": "https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.12.1/includes/shortcodes/charitable-shortcodes-hooks.php#L37"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3662994%40charitable\u0026new=3662994%40charitable"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-20T16:54:34.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-08-31T17:03:35.000Z",
"value": "Disclosed"
}
],
"title": "Charitable \u003c= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via \u0027order\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-77189",
"datePublished": "2026-09-01T05:30:40.881Z",
"dateReserved": "2026-08-20T16:39:24.018Z",
"dateUpdated": "2026-09-02T17:57:36.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3423 (GCVE-0-2026-3423)
Vulnerability from cvelistv5 – Published: 2026-08-28 11:29 – Updated: 2026-08-28 16:09
VLAI
EPSS
VEX
Title
Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description
Summary
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page displaying the gallery with a description enabled.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 16:09 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More |
Affected:
0 , ≤ 1.12.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3423",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T16:09:01.557156Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T16:09:20.421Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows \u0026 More",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "1.12.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lord willmore"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery \u0027description\u0027 configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page displaying the gallery with a description enabled."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T11:29:28.138Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/17de5b96-7a61-4f37-a921-6a023cc40812?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/envira-gallery-lite/trunk/includes/global/shortcode.php#L807"
},
{
"url": "https://plugins.trac.wordpress.org/browser/envira-gallery-lite/trunk/includes/global/rest.php#L192"
},
{
"url": "https://plugins.trac.wordpress.org/browser/envira-gallery-lite/trunk/includes/global/rest.php#L239"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3514026/envira-gallery-lite/trunk/includes/global/shortcode.php?old=3465371\u0026old_path=envira-gallery-lite%2Ftrunk%2Fincludes%2Fglobal%2Fshortcode.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-02T04:05:51.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-08-27T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Envira Gallery \u003c= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-3423",
"datePublished": "2026-08-28T11:29:28.138Z",
"dateReserved": "2026-03-02T03:50:27.235Z",
"dateUpdated": "2026-08-28T16:09:20.421Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16775 (GCVE-0-2026-16775)
Vulnerability from cvelistv5 – Published: 2026-08-16 05:27 – Updated: 2026-08-17 17:10
VLAI
EPSS
VEX
Title
Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Summary
The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Attribute in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 17:09 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | Smash Balloon Social Post Feed – Simple Social Feeds for WordPress |
Affected:
0 , ≤ 4.9.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16775",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T17:09:34.670925Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T17:10:39.060Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Smash Balloon Social Post Feed \u2013 Simple Social Feeds for WordPress",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "4.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Smash Balloon Social Post Feed \u2013 Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027id\u0027 Shortcode Attribute in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-16T05:27:30.012Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ae039144-2c02-4a00-9fff-f4e90a6a8236?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.9.0/inc/CFF_Shortcode.php#L1149"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.9.0/inc/CFF_Shortcode.php#L312"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.9.0/inc/CFF_FB_Settings.php#L59"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3640517/custom-facebook-feed/trunk/inc/CFF_Shortcode.php?old=3465306\u0026old_path=custom-facebook-feed%2Ftrunk%2Finc%2FCFF_Shortcode.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-23T17:25:15.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-08-15T16:27:31.000Z",
"value": "Disclosed"
}
],
"title": "Smash Balloon Social Post Feed \u003c= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027id\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-16775",
"datePublished": "2026-08-16T05:27:30.012Z",
"dateReserved": "2026-07-23T17:10:06.554Z",
"dateUpdated": "2026-08-17T17:10:39.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15452 (GCVE-0-2026-15452)
Vulnerability from cvelistv5 – Published: 2026-08-05 09:26 – Updated: 2026-08-05 14:26
VLAI
EPSS
VEX
Title
Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String
Summary
The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query String in all versions up to, and including, 6.11.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 14:25 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | Smash Balloon Social Photo Feed – Easy Social Feeds Plugin |
Affected:
0 , ≤ 6.11.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15452",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T14:25:54.740470Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T14:26:41.490Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Smash Balloon Social Photo Feed \u2013 Easy Social Feeds Plugin",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "6.11.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tarc\u00edsio Luchesi De Almeida Silva (Poystick)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Smash Balloon Social Photo Feed \u2013 Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query String in all versions up to, and including, 6.11.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T09:26:25.631Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/33f1d8b9-3561-4347-8267-8c36d4c9071f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.3/admin/SBI_Callout.php#L448"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.3/admin/SBI_Callout.php#L361"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.3/admin/SBI_Callout.php#L386"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.3/admin/SBI_Callout.php#L319"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.0/admin/SBI_Callout.php#L448"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.0/admin/SBI_Callout.php#L361"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.0/admin/SBI_Callout.php#L386"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.0/admin/SBI_Callout.php#L319"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3619076/instagram-feed/trunk/admin/SBI_Callout.php?old=3481379\u0026old_path=instagram-feed%2Ftrunk%2Fadmin%2FSBI_Callout.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-10T19:51:12.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-08-04T20:42:08.000Z",
"value": "Disclosed"
}
],
"title": "Smash Balloon Social Photo Feed \u003c= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15452",
"datePublished": "2026-08-05T09:26:25.631Z",
"dateReserved": "2026-07-10T19:35:50.380Z",
"dateUpdated": "2026-08-05T14:26:41.490Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12476 (GCVE-0-2026-12476)
Vulnerability from cvelistv5 – Published: 2026-07-29 02:31 – Updated: 2026-07-29 12:22
VLAI
EPSS
VEX
Title
Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter
Summary
The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edd_do_ajax_import_file_upload() function , which only checks the client-supplied $_FILES['edd-import-file']['type'] Content-Type header against an allow-list of CSV mime types, then uses raw move_uploaded_file() (bypassing wp_handle_upload()'s core MIME enforcement) to write the file under its original extension into the web-accessible wp-content/uploads/edd/exports/ directory. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-29 12:22 UTC
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | Easy Digital Downloads – eCommerce Payments and Subscriptions made easy |
Affected:
0 , ≤ 3.6.9
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12476",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T12:22:04.545877Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T12:22:13.311Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "3.6.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tal Kantor"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edd_do_ajax_import_file_upload() function , which only checks the client-supplied $_FILES[\u0027edd-import-file\u0027][\u0027type\u0027] Content-Type header against an allow-list of CSV mime types, then uses raw move_uploaded_file() (bypassing wp_handle_upload()\u0027s core MIME enforcement) to write the file under its original extension into the web-accessible wp-content/uploads/edd/exports/ directory. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to upload arbitrary files on the affected site\u0027s server which may make remote code execution possible."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T02:31:38.774Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5b0c8edd-b392-4d23-bde3-0521eeedc5a0?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.6.8/includes/admin/import/import-functions.php#L92"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.6.8/includes/admin/import/import-functions.php#L68"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.6.8/includes/admin/import/import-functions.php#L87"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.6.7/includes/admin/import/import-functions.php#L92"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.6.7/includes/admin/import/import-functions.php#L68"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.6.7/includes/admin/import/import-functions.php#L87"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3625073/easy-digital-downloads/trunk/includes/admin/import/import-functions.php?old=3577787\u0026old_path=easy-digital-downloads%2Ftrunk%2Fincludes%2Fadmin%2Fimport%2Fimport-functions.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-16T20:40:23.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-28T13:30:14.000Z",
"value": "Disclosed"
}
],
"title": "Easy Digital Downloads \u003c= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via \u0027edd-import-file\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12476",
"datePublished": "2026-07-29T02:31:38.774Z",
"dateReserved": "2026-06-16T20:25:13.528Z",
"dateUpdated": "2026-07-29T12:22:13.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15782 (GCVE-0-2026-15782)
Vulnerability from cvelistv5 – Published: 2026-07-21 05:35 – Updated: 2026-07-21 13:27
VLAI
EPSS
VEX
Title
WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content
Summary
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content in all versions up to, and including, 2.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the OptinMonster plugin to be installed and configured with an active inline campaign that outputs matching #om-{id} markup on the target page, as the WPForms handler only fires when OptinMonster emits its 'om.Campaign.load' event.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-21 13:27 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More |
Affected:
0 , ≤ 2.0.0.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15782",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-21T13:27:39.279188Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T13:27:49.495Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz \u0026 More",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "2.0.0.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Asaf Mozes"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz \u0026 More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content in all versions up to, and including, 2.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the OptinMonster plugin to be installed and configured with an active inline campaign that outputs matching #om-{id} markup on the target page, as the WPForms handler only fires when OptinMonster emits its \u0027om.Campaign.load\u0027 event."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T05:35:28.946Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6d5264a1-dabf-4630-9871-ab6e14817768?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.2.1/assets/js/frontend/wpforms.min.js#L5"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.4/assets/js/frontend/wpforms.min.js#L5"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3610719/wpforms-lite/trunk/assets/js/frontend/wpforms.min.js?old=3586095\u0026old_path=wpforms-lite%2Ftrunk%2Fassets%2Fjs%2Ffrontend%2Fwpforms.min.js"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-14T19:12:07.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-20T16:53:08.000Z",
"value": "Disclosed"
}
],
"title": "WPForms \u003c= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15782",
"datePublished": "2026-07-21T05:35:28.946Z",
"dateReserved": "2026-07-14T18:56:43.945Z",
"dateUpdated": "2026-07-21T13:27:49.495Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12002 (GCVE-0-2026-12002)
Vulnerability from cvelistv5 – Published: 2026-07-08 12:33 – Updated: 2026-07-08 13:03
VLAI
EPSS
VEX
Title
Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter
Summary
The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.11.1. This is due to missing or incorrect nonce validation on the maybe_connection_data function. This makes it possible for unauthenticated attackers to overwrite the site's Instagram and Facebook oEmbed access tokens via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-08 13:02 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | Smash Balloon Social Photo Feed – Easy Social Feeds Plugin |
Affected:
0 , ≤ 6.11.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12002",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-08T13:02:53.626151Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:04.692Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Smash Balloon Social Photo Feed \u2013 Easy Social Feeds Plugin",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "6.11.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "normaandersonfrank"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Smash Balloon Social Photo Feed \u2013 Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.11.1. This is due to missing or incorrect nonce validation on the maybe_connection_data function. This makes it possible for unauthenticated attackers to overwrite the site\u0027s Instagram and Facebook oEmbed access tokens via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T12:33:16.785Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/abe6366a-3729-474f-8920-b5ed2eeab906?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3575933/instagram-feed/trunk/admin/SBI_oEmbeds.php?old=3289310\u0026old_path=instagram-feed%2Ftrunk%2Fadmin%2FSBI_oEmbeds.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-06T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-06-11T17:14:54.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-08T00:00:58.000Z",
"value": "Disclosed"
}
],
"title": "Smash Balloon Social Photo Feed \u2013 Easy Social Feeds Plugin \u003c= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via \u0027sbi_access_token\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12002",
"datePublished": "2026-07-08T12:33:16.785Z",
"dateReserved": "2026-06-11T16:59:38.484Z",
"dateUpdated": "2026-07-08T13:03:04.692Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12127 (GCVE-0-2026-12127)
Vulnerability from cvelistv5 – Published: 2026-07-01 04:32 – Updated: 2026-07-01 10:42
VLAI
EPSS
VEX
Title
WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name
Summary
The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Improper Neutralization of CRLF Sequences ('CRLF Injection') in all versions up to, and including, 1.10.2 This is due to `get_reply_to_address()` processing the Reply-To display name through smart-tag expansion with context `'notification'` instead of `'notification-reply-to'`, which bypasses email-address validation while `wpforms_sanitize_textarea_field()` intentionally preserves CR/LF characters that are never stripped before the display name is concatenated into the raw `Reply-To:` mail header string. This makes it possible for unauthenticated attackers to inject arbitrary additional email headers — such as `Bcc:` — into outgoing notification emails, silently blind-copying all notification email copies to an attacker-controlled address. Exploitation requires that a form notification is configured to use a Paragraph Text (textarea) field as the Reply-To display name via a Smart Tag.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-01 10:31 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
11 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More |
Affected:
0 , ≤ 1.10.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12127",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-01T10:31:09.519094Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T10:42:10.985Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz \u0026 More",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "1.10.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jack Pas (Dark.)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPForms \u2013 Easy Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Surveys, \u0026 More plugin for WordPress is vulnerable to Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027) in all versions up to, and including, 1.10.2 This is due to `get_reply_to_address()` processing the Reply-To display name through smart-tag expansion with context `\u0027notification\u0027` instead of `\u0027notification-reply-to\u0027`, which bypasses email-address validation while `wpforms_sanitize_textarea_field()` intentionally preserves CR/LF characters that are never stripped before the display name is concatenated into the raw `Reply-To:` mail header string. This makes it possible for unauthenticated attackers to inject arbitrary additional email headers \u2014 such as `Bcc:` \u2014 into outgoing notification emails, silently blind-copying all notification email copies to an attacker-controlled address. Exploitation requires that a form notification is configured to use a Paragraph Text (textarea) field as the Reply-To display name via a Smart Tag."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93 Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T04:32:27.607Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d5a51c22-c4ca-4897-ad7e-c5df00b07fe0?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.1.1/src/Emails/Mailer.php#L368"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.1.1/src/Emails/Notifications.php#L1098"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.1.1/src/Emails/Notifications.php#L1138"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.1.1/includes/fields/class-textarea.php#L326"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/src/Emails/Mailer.php#L368"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/src/Emails/Notifications.php#L1098"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/src/Emails/Notifications.php#L1138"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/includes/fields/class-textarea.php#L326"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3586095/wpforms-lite/trunk/src/Emails/Mailer.php"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fwpforms-lite/tags/1.10.2\u0026new_path=%2Fwpforms-lite/tags/1.10.2.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-12T15:48:56.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-06-30T16:02:50.000Z",
"value": "Disclosed"
}
],
"title": "WPForms \u003c= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12127",
"datePublished": "2026-07-01T04:32:27.607Z",
"dateReserved": "2026-06-12T15:16:37.220Z",
"dateUpdated": "2026-07-01T10:42:10.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}