Search
Find a vulnerability
Search criteria
11584 vulnerabilities
CVE-2026-107657 (GCVE-0-2026-107657)
Vulnerability from cvelistv5 – Published: 2026-10-10 08:26 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
Summary
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name, e.g. profile_test>' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have configured a text-type custom user attribute whose display format places %value% inside an HTML attribute context (e.g., the documented pattern <a href="%value%">Custom link</a>), and for front-end user profiles to be enabled — both of which reflect the plugin's standard, documented configuration.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:10 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hivepress | HivePress – Business Directory, Listings & Classified Ads Plugin |
Affected:
0 , ≤ 1.7.31
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107657",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:10:57.052125Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:43.229Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HivePress \u2013 Business Directory, Listings \u0026 Classified Ads Plugin",
"vendor": "hivepress",
"versions": [
{
"lessThanOrEqual": "1.7.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adrien Brunner"
}
],
"descriptions": [
{
"lang": "en",
"value": "The HivePress \u2013 Business Directory, Listings \u0026 Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027\u003ccustom user attribute field name, e.g. profile_test\u003e\u0027 parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have configured a text-type custom user attribute whose display format places %value% inside an HTML attribute context (e.g., the documented pattern \u0026lt;a href=\"%value%\"\u0026gt;Custom link\u0026lt;/a\u0026gt;), and for front-end user profiles to be enabled \u2014 both of which reflect the plugin\u0027s standard, documented configuration."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T08:26:40.211Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d0e73b59-58d7-4f4b-b7f3-568190be9b09?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/helpers.php#L382"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/fields/class-field.php#L561"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/fields/class-text.php#L197"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/components/class-attribute.php#L1298"
},
{
"url": "https://github.com/hivepress/hivepress/releases/tag/1.7.32"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-08T14:51:42.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:43:31.000Z",
"value": "Disclosed"
}
],
"title": "HivePress \u003c= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-107657",
"datePublished": "2026-10-10T08:26:40.211Z",
"dateReserved": "2026-10-08T14:36:30.619Z",
"dateUpdated": "2026-10-11T12:13:43.229Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4791 (GCVE-0-2026-4791)
Vulnerability from cvelistv5 – Published: 2026-10-10 08:26 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
PeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute
Summary
The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `logout-url` shortcode's 'button' attribute in all versions up to, and including, 8.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:11 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| peprodev | PeproDev Ultimate Profile Solutions |
Affected:
0 , ≤ 8.2.36
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4791",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:11:04.351202Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:43.385Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PeproDev Ultimate Profile Solutions",
"vendor": "peprodev",
"versions": [
{
"lessThanOrEqual": "8.2.36",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zaim"
}
],
"descriptions": [
{
"lang": "en",
"value": "The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `logout-url` shortcode\u0027s \u0027button\u0027 attribute in all versions up to, and including, 8.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T08:26:39.840Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b33f655a-ad13-45d8-bad9-e7c2599c2490?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3719931/peprodev-ups"
},
{
"url": "https://plugins.trac.wordpress.org/browser/peprodev-ups/tags/8.2.7/login/login.php#L1110"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-24T21:28:32.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:48:38.000Z",
"value": "Disclosed"
}
],
"title": "PeproDev Ultimate Profile Solutions \u003c= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027button\u0027 Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-4791",
"datePublished": "2026-10-10T08:26:39.840Z",
"dateReserved": "2026-03-24T21:11:06.306Z",
"dateUpdated": "2026-10-11T12:13:43.385Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104722 (GCVE-0-2026-104722)
Vulnerability from cvelistv5 – Published: 2026-10-10 08:26 – Updated: 2026-10-11 16:55
VLAI
EPSS
VEX
Title
Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.2 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter
Summary
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSD_Menus_IX_CSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:36 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| webilia | Listdom: AI-powered Business Directory with Classifieds Ads Listings |
Affected:
0 , ≤ 6.1.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104722",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T16:36:49.142653Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:55:14.975Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Listdom: AI-powered Business Directory with Classifieds Ads Listings",
"vendor": "webilia",
"versions": [
{
"lessThanOrEqual": "6.1.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSD_Menus_IX_CSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T08:26:39.464Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4696e474-07b6-4362-afe1-2847e24c08b8?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/listdom/tags/6.1.2/app/includes/menus/ix/csv.php#L294"
},
{
"url": "https://plugins.trac.wordpress.org/browser/listdom/tags/6.1.2/app/includes/menus/ix/csv.php#L232"
},
{
"url": "https://plugins.trac.wordpress.org/browser/listdom/tags/6.1.2/app/includes/menus/ix/csv.php#L241"
},
{
"url": "https://plugins.trac.wordpress.org/browser/listdom/tags/6.1.2/app/includes/file.php#L25"
},
{
"url": "https://wordpress.org/plugins/listdom/"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3726849/listdom/trunk/app/includes/menus/ix/csv.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-02T11:59:51.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:43:23.000Z",
"value": "Disclosed"
}
],
"title": "Listdom: AI-powered Business Directory with Classifieds Ads Listings \u003c= 6.1.2 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via \u0027ix[file]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-104722",
"datePublished": "2026-10-10T08:26:39.464Z",
"dateReserved": "2026-10-02T11:44:39.625Z",
"dateUpdated": "2026-10-11T16:55:14.975Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91136 (GCVE-0-2026-91136)
Vulnerability from cvelistv5 – Published: 2026-10-10 08:26 – Updated: 2026-10-11 16:55
VLAI
EPSS
VEX
Title
Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter
Summary
The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback (SVGAnimatorController::index_permission) returning true unconditionally combined with insufficient validation of the 'svg_image' input — sanitize_text_field() and esc_html() do not restrict filesystem paths, the file:// stream wrapper, or arbitrary URLs — before it is passed to file_get_contents() (with a wp_remote_get() fallback) and the raw response body is returned in the JSON 'html' field. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server which may make remote code execution possible.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:37 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Divi Essential | Divi Plus |
Affected:
0 , ≤ 2.4.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91136",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T16:37:00.835599Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:55:15.122Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Divi Plus",
"vendor": "Divi Essential",
"versions": [
{
"lessThanOrEqual": "2.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ShinThink"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the \u0027svg_image\u0027 parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint\u0027s permission callback (SVGAnimatorController::index_permission) returning true unconditionally combined with insufficient validation of the \u0027svg_image\u0027 input \u2014 sanitize_text_field() and esc_html() do not restrict filesystem paths, the file:// stream wrapper, or arbitrary URLs \u2014 before it is passed to file_get_contents() (with a wp_remote_get() fallback) and the raw response body is returned in the JSON \u0027html\u0027 field. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site\u0027s server which may make remote code execution possible."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T08:26:38.959Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2c0bbdf6-afaf-4194-ada2-24d142892c32?source=cve"
},
{
"url": "https://diviplus.io/changelog/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-30T19:29:57.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:42:56.000Z",
"value": "Disclosed"
}
],
"title": "Divi Plus \u003c= 2.4.0 - Unauthenticated Arbitrary File Read via \u0027svg_image\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-91136",
"datePublished": "2026-10-10T08:26:38.959Z",
"dateReserved": "2026-09-14T19:44:56.205Z",
"dateUpdated": "2026-10-11T16:55:15.122Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103478 (GCVE-0-2026-103478)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:41 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter
Summary
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkout[billing][phone] (and state / taxid / email)' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:11 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Premium Packages – Sell Digital Products Securely |
Affected:
0 , ≤ 7.2.6
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-103478",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:11:11.873018Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:43.531Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Premium Packages \u2013 Sell Digital Products Securely",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "7.2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Premium Packages \u2013 Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027checkout[billing][phone] (and state / taxid / email)\u0027 parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:48.934Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e961f5b3-0efc-40c7-87a8-48290357dd2e?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/templates/dashboard/billing-info.php#L125"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/templates/dashboard/billing-info.php#L108"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/templates/dashboard/billing-info.php#L115"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/templates/dashboard/billing-info.php#L132"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/src/Customer/BillingInfoService.php#L265"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/src/Customer/BillingInfoService.php#L424"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/src/Customer/BillingInfoService.php#L190"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3724154/wpdm-premium-packages/trunk/templates/dashboard/billing-info.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-30T16:28:50.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:08:31.000Z",
"value": "Disclosed"
}
],
"title": "Premium Packages \u003c= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \u0027checkout[billing][phone]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-103478",
"datePublished": "2026-10-10T07:41:48.934Z",
"dateReserved": "2026-09-30T16:13:38.557Z",
"dateUpdated": "2026-10-11T12:13:43.531Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93746 (GCVE-0-2026-93746)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:41 – Updated: 2026-10-11 16:55
VLAI
EPSS
VEX
Title
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter
Summary
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order's printable documents when the attacker-supplied (base64-encoded) 'email' equals the order's billing email — a non-secret identifier — instead of requiring the WooCommerce order_key. This makes it possible for unauthenticated attackers, when the site is configured to allow guest access to documents ('wt_pklist_print_button_access_for' != 'logged_in'), to retrieve any other customer's invoice, packing slip, delivery note, dispatch label or shipping label — including customer name, billing/shipping address, phone number, purchased products, prices, taxes and invoice metadata — by knowing the target order ID and the associated billing email address.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:37 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| webtoffee | WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels |
Affected:
0 , ≤ 5.0.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93746",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T16:37:08.285423Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:55:15.249Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes \u0026 Shipping Labels",
"vendor": "webtoffee",
"versions": [
{
"lessThanOrEqual": "5.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Brian Mungai"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes \u0026 Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the \u0027email\u0027 parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order\u0027s printable documents when the attacker-supplied (base64-encoded) \u0027email\u0027 equals the order\u0027s billing email \u2014 a non-secret identifier \u2014 instead of requiring the WooCommerce order_key. This makes it possible for unauthenticated attackers, when the site is configured to allow guest access to documents (\u0027wt_pklist_print_button_access_for\u0027 != \u0027logged_in\u0027), to retrieve any other customer\u0027s invoice, packing slip, delivery note, dispatch label or shipping label \u2014 including customer name, billing/shipping address, phone number, purchased products, prices, taxes and invoice metadata \u2014 by knowing the target order ID and the associated billing email address."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:48.536Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cf5ccfe6-c0e3-412f-9a93-2ccabb9997e7?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L1149"
},
{
"url": "https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L1128"
},
{
"url": "https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L1127"
},
{
"url": "https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L990"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3718644%40print-invoices-packing-slip-labels-for-woocommerce%2Ftags%2F5.0.3\u0026old=3707093%40print-invoices-packing-slip-labels-for-woocommerce%2Ftags%2F5.0.2"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T16:22:09.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:11:05.000Z",
"value": "Disclosed"
}
],
"title": "WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes \u0026 Shipping Labels \u003c= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via \u0027email\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-93746",
"datePublished": "2026-10-10T07:41:48.536Z",
"dateReserved": "2026-09-18T16:07:05.185Z",
"dateUpdated": "2026-10-11T16:55:15.249Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97340 (GCVE-0-2026-97340)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:41 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field
Summary
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields (author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, author_email) in versions up to, and including, 7.16.1. Avada registers these fields through the user_contactmethods filter and, on the author archive, emits them inside an anchor href using only esc_attr() in Fusion_Social_Icon::get_markup(), which escapes HTML metacharacters but does not reject dangerous URL schemes such as javascript:. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses their author page and clicks the injected social icon (a click is required, and the site must have 'Open Social Icons in a New Window' set to Off so the browser doesn't block the javascript: URL from opening in a new tab).
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:11 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ThemeFusion | Avada | Website Builder For WordPress & WooCommerce |
Affected:
0 , ≤ 7.16.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-97340",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:11:18.947998Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:43.659Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Avada | Website Builder For WordPress \u0026 WooCommerce",
"vendor": "ThemeFusion",
"versions": [
{
"lessThanOrEqual": "7.16.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Muhamad Visat"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Avada | Website Builder For WordPress \u0026 WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile \u0027Author Page\u0027 social link contact-method fields (author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, author_email) in versions up to, and including, 7.16.1. Avada registers these fields through the user_contactmethods filter and, on the author archive, emits them inside an anchor href using only esc_attr() in Fusion_Social_Icon::get_markup(), which escapes HTML metacharacters but does not reject dangerous URL schemes such as javascript:. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses their author page and clicks the injected social icon (a click is required, and the site must have \u0027Open Social Icons in a New Window\u0027 set to Off so the browser doesn\u0027t block the javascript: URL from opening in a new tab)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:48.155Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cbd47a59-5a9e-4eb2-9152-2cd47fc38ae2?source=cve"
},
{
"url": "https://avada.com/blog/version-7-16-2-security-update/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-24T12:39:00.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:26:37.000Z",
"value": "Disclosed"
}
],
"title": "Avada | Website Builder For WordPress \u0026 WooCommerce \u003c= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \u0027author_facebook\u0027 User Profile Field"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-97340",
"datePublished": "2026-10-10T07:41:48.155Z",
"dateReserved": "2026-09-24T12:23:53.982Z",
"dateUpdated": "2026-10-11T12:13:43.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102291 (GCVE-0-2026-102291)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:41 – Updated: 2026-10-11 16:55
VLAI
EPSS
VEX
Title
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'
Summary
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.3.1 This is due to the plugin substituting a user's `display_name` into the composed page markup unfiltered and then running the whole result through `do_shortcode()` in `TheFrontend::replace_content()`. Because `display_name` is writable by any user on their own account through the core profile form, this makes it possible for authenticated attackers with Subscriber-level access and above to execute arbitrary shortcodes. Where the page is a users collection — an ordinary team or member-directory page — the shortcode runs in the request of every visitor, including unauthenticated ones. Requires a published page with a Kirki element whose dynamic content is bound to the `display_name` user field.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:37 UTC
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeum | Kirki – Freeform Page Builder, Website Builder & Customizer |
Affected:
0 , ≤ 6.3.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102291",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T16:37:18.881293Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:55:15.382Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Kirki \u2013 Freeform Page Builder, Website Builder \u0026 Customizer",
"vendor": "themeum",
"versions": [
{
"lessThanOrEqual": "6.3.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "dzaku"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Kirki \u2013 Freeform Page Builder, Website Builder \u0026 Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.3.1 This is due to the plugin substituting a user\u0027s `display_name` into the composed page markup unfiltered and then running the whole result through `do_shortcode()` in `TheFrontend::replace_content()`. Because `display_name` is writable by any user on their own account through the core profile form, this makes it possible for authenticated attackers with Subscriber-level access and above to execute arbitrary shortcodes. Where the page is a users collection \u2014 an ordinary team or member-directory page \u2014 the shortcode runs in the request of every visitor, including unauthenticated ones. Requires a published page with a Kirki element whose dynamic content is bound to the `display_name` user field."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:47.748Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bed93040-a843-417e-89b4-5ab3cba788aa?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/Frontend/TheFrontend.php#L144"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/Frontend/Preview/Utils.php#L408"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/Frontend/Preview/Utils.php#L308"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/Frontend/Preview/Utils.php#L334"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/HelperFunctions.php#L1117"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/Manager/PluginShortcode.php#L40"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3718900%40kirki%2Ftags%2F6.3.2\u0026old=3697265%40kirki%2Ftags%2F6.3.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-28T20:50:31.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T18:47:02.000Z",
"value": "Disclosed"
}
],
"title": "Kirki \u2013 Freeform Page Builder, Website Builder \u0026 Customizer \u003c= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via \u0027display_name\u0027"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-102291",
"datePublished": "2026-10-10T07:41:47.748Z",
"dateReserved": "2026-09-28T20:34:15.636Z",
"dateUpdated": "2026-10-11T16:55:15.382Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104759 (GCVE-0-2026-104759)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:41 – Updated: 2026-10-11 16:55
VLAI
EPSS
VEX
Title
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification
Summary
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to `Id_Token_Service_Deprecated::process_openidconnect_token()` using the incompatible WordPress core `wp_verify_nonce()` function to validate a nonce produced by `Nonce_Service::create_nonce()` — a 64-character hex value that `wp_verify_nonce()` can never successfully verify — causing the nonce check to silently fail without terminating authentication, so execution continues into `authenticate_oidc_user()` with the attacker-supplied `id_token`. This makes it possible for unauthenticated attackers who have obtained a previously-issued, valid `id_token` for a target account to replay that token and authenticate as any WordPress user, including administrators, resulting in full site takeover. This vulnerability is only exploitable when the `use_id_token_parser_v2` plugin option is enabled, as this is the configuration that routes token processing through the deprecated parser containing the broken nonce check.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:37 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpo365 | WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) |
Affected:
0 , ≤ 44.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104759",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T16:37:26.741155Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:55:15.511Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)",
"vendor": "wpo365",
"versions": [
{
"lessThanOrEqual": "44.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to `Id_Token_Service_Deprecated::process_openidconnect_token()` using the incompatible WordPress core `wp_verify_nonce()` function to validate a nonce produced by `Nonce_Service::create_nonce()` \u2014 a 64-character hex value that `wp_verify_nonce()` can never successfully verify \u2014 causing the nonce check to silently fail without terminating authentication, so execution continues into `authenticate_oidc_user()` with the attacker-supplied `id_token`. This makes it possible for unauthenticated attackers who have obtained a previously-issued, valid `id_token` for a target account to replay that token and authenticate as any WordPress user, including administrators, resulting in full site takeover. This vulnerability is only exploitable when the `use_id_token_parser_v2` plugin option is enabled, as this is the configuration that routes token processing through the deprecated parser containing the broken nonce check."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:47.371Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aad7ddac-ed12-4263-8e68-64b1fca8dfad?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpo365-login/tags/44.1/Services/Id_Token_Service_Deprecated.php#L110"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpo365-login/tags/44.1/Services/Router_Service.php#L275"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpo365-login/tags/44.1/Services/Id_Token_Service.php#L107"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpo365-login/tags/44.1/Services/Nonce_Service.php#L72"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3727410/wpo365-login"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3727410%40wpo365-login%2Ftags%2F45.0\u0026old=3682496%40wpo365-login%2Ftags%2F44.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-02T12:42:33.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:11:01.000Z",
"value": "Disclosed"
}
],
"title": "WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) \u003c= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-104759",
"datePublished": "2026-10-10T07:41:47.371Z",
"dateReserved": "2026-10-02T12:27:26.024Z",
"dateUpdated": "2026-10-11T16:55:15.511Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102774 (GCVE-0-2026-102774)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:41 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
SureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content
Summary
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The entity-encoded payload bypasses server-side wp_kses filtering because kses permits the img/alt tag combination and does not normalize entities inside attribute values; the decode occurs client-side when GLightbox reads the .alt DOM property and assigns the result to innerHTML.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:11 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| brainstormforce | SureDash – Community, Courses & Member Dashboard |
Affected:
0 , ≤ 1.12.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102774",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:11:26.143958Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:43.777Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SureDash \u2013 Community, Courses \u0026 Member Dashboard",
"vendor": "brainstormforce",
"versions": [
{
"lessThanOrEqual": "1.12.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "dzaku"
}
],
"descriptions": [
{
"lang": "en",
"value": "The SureDash \u2013 Community, Courses \u0026 Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image \u0027alt\u0027 Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The entity-encoded payload bypasses server-side wp_kses filtering because kses permits the img/alt tag combination and does not normalize entities inside attribute values; the decode occurs client-side when GLightbox reads the .alt DOM property and assigns the result to innerHTML."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:46.988Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a8b5b389-85f4-4cc5-9796-55b611af7916?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/assets/js/minified/lightbox.min.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/core/routers/misc.php#L59"
},
{
"url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/core/routes.php#L101"
},
{
"url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/inc/services/router.php#L127"
},
{
"url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/inc/utils/post-meta.php#L377"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3724179%40suredash%2Ftags%2F1.12.2\u0026old=3694773%40suredash%2Ftags%2F1.12.0"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-29T16:56:52.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:23:30.000Z",
"value": "Disclosed"
}
],
"title": "SureDash \u003c= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image \u0027alt\u0027 Attribute in Community Post Content"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-102774",
"datePublished": "2026-10-10T07:41:46.988Z",
"dateReserved": "2026-09-29T16:41:19.801Z",
"dateUpdated": "2026-10-11T12:13:43.777Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104728 (GCVE-0-2026-104728)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:41 – Updated: 2026-10-11 16:55
VLAI
EPSS
VEX
Title
AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action
Summary
The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate all Fluent Forms records, including form IDs and titles, from the fluentform_forms database table.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:40 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rubengc | AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI |
Affected:
0 , ≤ 5.8.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104728",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T16:40:10.050228Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:55:15.624Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AutomatorWP \u2013 No-Code Workflow Automation, Integration \u0026 Webhooks Plugin, now with AI",
"vendor": "rubengc",
"versions": [
{
"lessThanOrEqual": "5.8.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The AutomatorWP \u2013 No-Code Workflow Automation, Integration \u0026 Webhooks Plugin, now with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate all Fluent Forms records, including form IDs and titles, from the fluentform_forms database table."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:46.607Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a5d421d0-4658-4203-8c74-2eb744ea34be?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/integrations/fluentform/includes/ajax-functions.php#L16"
},
{
"url": "https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/integrations/fluentform/includes/ajax-functions.php#L48"
},
{
"url": "https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/includes/scripts.php#L161"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3656285"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-09T19:31:43.000Z",
"value": "Disclosed"
}
],
"title": "AutomatorWP \u003c= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-104728",
"datePublished": "2026-10-10T07:41:46.607Z",
"dateReserved": "2026-10-02T11:47:04.862Z",
"dateUpdated": "2026-10-11T16:55:15.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96653 (GCVE-0-2026-96653)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:41 – Updated: 2026-10-11 16:55
VLAI
EPSS
VEX
Title
WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)
Summary
The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'display_name' Profile Field (Second-Order) in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order injection: a Subscriber stores a display_name containing a single quote via their own profile, which WordPress preserves verbatim; the payload is then triggered when WdkCachedUserEditor::update_listings_user_editor() re-reads that stored value and passes it unsanitized to the SQL sink.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:40 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpdirectorykit | WP Directory Kit |
Affected:
0 , ≤ 1.5.9
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96653",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T16:40:18.468077Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:55:15.746Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP Directory Kit",
"vendor": "wpdirectorykit",
"versions": [
{
"lessThanOrEqual": "1.5.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tarc\u00edsio Luchesi De Almeida Silva (Poystick)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via \u0027display_name\u0027 Profile Field (Second-Order) in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order injection: a Subscriber stores a display_name containing a single quote via their own profile, which WordPress preserves verbatim; the payload is then triggered when WdkCachedUserEditor::update_listings_user_editor() re-reads that stored value and passes it unsanitized to the SQL sink."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:46.242Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/87aa7d7e-f6f4-42c1-9b15-2fcab6750cd3?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdirectorykit/trunk/vendor/Winter_MVC/core/database.php#L553"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdirectorykit/trunk/extensions/wdk-cached-user-editor.php#L52"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdirectorykit/trunk/extensions/wdk-cached-user-editor.php#L21"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-23T14:57:16.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:09:45.000Z",
"value": "Disclosed"
}
],
"title": "WP Directory Kit \u003c= 1.5.9 - Authenticated (Subscriber+) SQL Injection via \u0027display_name\u0027 Profile Field (Second-Order)"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-96653",
"datePublished": "2026-10-10T07:41:46.242Z",
"dateReserved": "2026-09-23T14:42:12.165Z",
"dateUpdated": "2026-10-11T16:55:15.746Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100178 (GCVE-0-2026-100178)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:41 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter
Summary
The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'adverts_location' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:11 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| gwin | WPAdverts – Classifieds Plugin |
Affected:
0 , ≤ 2.3.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-100178",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:11:33.193306Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:43.901Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPAdverts \u2013 Classifieds Plugin",
"vendor": "gwin",
"versions": [
{
"lessThanOrEqual": "2.3.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Morato Antoine"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPAdverts \u2013 Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027adverts_location\u0027 parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:45.869Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84d362e2-a0ba-48e6-b4f5-46e080a7eee1?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.4/includes/functions-blocks.php#L483"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.4/includes/functions-blocks.php#L467"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.4/blocks/list/templates/list-item.php#L36"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.4/includes/functions.php#L1878"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.4/includes/functions.php#L1961"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.4/includes/defaults.php#L150"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.4/blocks/publish/class-publish-engine.php#L422"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpadverts/trunk/readme.txt?rev=3732587"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3732587/wpadverts/trunk/includes/functions-blocks.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-25T13:50:48.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:25:05.000Z",
"value": "Disclosed"
}
],
"title": "WPAdverts \u003c= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via \u0027adverts_location\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-100178",
"datePublished": "2026-10-10T07:41:45.869Z",
"dateReserved": "2026-09-25T13:35:41.978Z",
"dateUpdated": "2026-10-11T12:13:43.901Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96765 (GCVE-0-2026-96765)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:41 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)
Summary
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored in the wpo365_errors transient for up to three days by submitting a crafted unauthenticated request with a forged id_token whose base64url-decoded unique_name or iss claim contains malicious HTML, requiring no prior authentication or user interaction beyond an administrator later visiting the WPO365 wizard page.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:11 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpo365 | WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) |
Affected:
0 , ≤ 44.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96765",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:11:40.305116Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:44.019Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)",
"vendor": "wpo365",
"versions": [
{
"lessThanOrEqual": "44.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sebastian Albrecht (mySebbe)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027id_token\u0027 parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored in the wpo365_errors transient for up to three days by submitting a crafted unauthenticated request with a forged id_token whose base64url-decoded unique_name or iss claim contains malicious HTML, requiring no prior authentication or user interaction beyond an administrator later visiting the WPO365 wizard page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:45.478Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7d6509b7-c1c1-44ef-9a86-d77cfb7fd5bd?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpo365-login/tags/44.1/apps/dist/wizard-chunk-BpsKdXb9.js#L350"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpo365-login/tags/44.1/Services/Id_Token_Service.php#L491"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpo365-login/tags/44.1/Services/Log_Service.php#L80"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpo365-login/tags/44.1/Core/Script_Helpers.php#L142"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpo365-login/tags/44.1/Services/Router_Service.php#L97"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpo365-login/tags/44.1/Services/Request_Service.php#L54"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3727410/wpo365-login"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpo365-login/tags/45.0/apps/dist/wizard-chunk-BpsKdXb9.js"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-23T16:19:51.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:22:22.000Z",
"value": "Disclosed"
}
],
"title": "WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) \u003c= 44.1 - Unauthenticated Stored Cross-Site Scripting via \u0027id_token\u0027 Parameter (iss / unique_name JWT claims)"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-96765",
"datePublished": "2026-10-10T07:41:45.478Z",
"dateReserved": "2026-09-23T16:04:46.323Z",
"dateUpdated": "2026-10-11T12:13:44.019Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97396 (GCVE-0-2026-97396)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:41 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint
Summary
The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:11 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| retainful | Email Marketing for WordPress and WooCommerce – Retainful |
Affected:
0 , ≤ 1.0.10
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-97396",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:11:47.215661Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:44.153Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Email Marketing for WordPress and WooCommerce \u2013 Retainful",
"vendor": "retainful",
"versions": [
{
"lessThanOrEqual": "1.0.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Trithem"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Email Marketing for WordPress and WooCommerce \u2013 Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027data\u0027 parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:45.092Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5d2baf5d-a8a6-41db-8364-3a4b166b81cb?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/retainful/tags/1.0.9/App/Controllers/RestApi.php#L991"
},
{
"url": "https://plugins.trac.wordpress.org/browser/retainful/tags/1.0.9/App/Helpers/Auth.php#L68"
},
{
"url": "https://plugins.trac.wordpress.org/browser/retainful/tags/1.0.9/App/Controllers/RestApi.php#L382"
},
{
"url": "https://plugins.trac.wordpress.org/browser/retainful/tags/1.0.9/App/Controllers/Store/Common.php#L62"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3728354/retainful/trunk/App/Controllers/RestApi.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-25T05:54:01.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:23:34.000Z",
"value": "Disclosed"
}
],
"title": "Email Marketing for WordPress and WooCommerce \u003c= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \u0027data\u0027 Parameter to /updateOptions REST Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-97396",
"datePublished": "2026-10-10T07:41:45.092Z",
"dateReserved": "2026-09-24T14:27:28.705Z",
"dateUpdated": "2026-10-11T12:13:44.153Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104803 (GCVE-0-2026-104803)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:41 – Updated: 2026-10-11 16:55
VLAI
EPSS
VEX
Title
WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback
Summary
The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters of the social-login callback handler registered on the `init` hook. The vulnerability exists because the `login` function's social-login flow performs no nonce validation, no OAuth state verification, and no per-visitor namespace isolation in the session store, allowing an unauthenticated attacker to issue a crafted GET request that writes an attacker-named, attacker-valued entry into the global session namespace (bypassing the per-visitor prefix by prepending an underscore), then issue a second GET request triggering `weapp_new_user()` to read that forged entry and resolve the attacker-supplied `openid` value to a bound WordPress account before `wp_set_auth_cookie()` establishes a fully authenticated session. This makes it possible for unauthenticated attackers to log in as any WordPress user — including administrators — whose bound social provider identifier (openid/unionid) is known or discoverable. Successful exploitation requires that the target site has at least one social provider configured (which activates the vulnerable handler) and that the attacker knows or can enumerate the victim account's bound openid or unionid.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:40 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| whyun | WPCOM Member |
Affected:
0 , ≤ 1.7.27
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104803",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T16:40:29.424306Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:55:15.868Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPCOM Member",
"vendor": "whyun",
"versions": [
{
"lessThanOrEqual": "1.7.27",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mohamed Khater"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters of the social-login callback handler registered on the `init` hook. The vulnerability exists because the `login` function\u0027s social-login flow performs no nonce validation, no OAuth state verification, and no per-visitor namespace isolation in the session store, allowing an unauthenticated attacker to issue a crafted GET request that writes an attacker-named, attacker-valued entry into the global session namespace (bypassing the per-visitor prefix by prepending an underscore), then issue a second GET request triggering `weapp_new_user()` to read that forged entry and resolve the attacker-supplied `openid` value to a bound WordPress account before `wp_set_auth_cookie()` establishes a fully authenticated session. This makes it possible for unauthenticated attackers to log in as any WordPress user \u2014 including administrators \u2014 whose bound social provider identifier (openid/unionid) is known or discoverable. Successful exploitation requires that the target site has at least one social provider configured (which activates the vulnerable handler) and that the attacker knows or can enumerate the victim account\u0027s bound openid or unionid."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:44.669Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3dee7f76-bd66-4e54-8ef6-bbf581ebcc11?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.27/includes/social-login.php#L1235"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.27/includes/social-login.php#L91"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.27/includes/social-login.php#L674"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.27/includes/class-sesstion.php#L13"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpcom-member/trunk/includes/social-login.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-02T13:35:49.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:08:23.000Z",
"value": "Disclosed"
}
],
"title": "WPCOM Member \u003c= 1.7.27 - Unauthenticated Authentication Bypass via \u0027uuid\u0027 and \u0027code\u0027 Parameters on Social-Login Callback"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-104803",
"datePublished": "2026-10-10T07:41:44.669Z",
"dateReserved": "2026-10-02T13:20:56.523Z",
"dateUpdated": "2026-10-11T16:55:15.868Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101921 (GCVE-0-2026-101921)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:41 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute
Summary
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag (e.g. "x")' parameter in all versions up to, and including, 2.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that a site administrator has previously saved a form whose description embeds a {query_var} Smart Tag inside an iframe srcdoc attribute and has enabled Show Description on a public-facing page.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:11 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smub | WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More |
Affected:
0 , ≤ 2.0.2.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101921",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:11:54.362686Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:44.291Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz \u0026 More",
"vendor": "smub",
"versions": [
{
"lessThanOrEqual": "2.0.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "UKO"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz \u0026 More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u0027attacker-chosen key referenced by the smart tag (e.g. \"x\")\u0027 parameter in all versions up to, and including, 2.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that a site administrator has previously saved a form whose description embeds a {query_var} Smart Tag inside an iframe srcdoc attribute and has enabled Show Description on a public-facing page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:44.285Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/39e1abcf-c3b6-4c53-a3dc-8a5741f24cca?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/2.0.2.1/src/SmartTags/SmartTags.php#L673"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/2.0.2.1/src/SmartTags/SmartTag/QueryVar.php#L34"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/2.0.2.1/src/Frontend/Classic.php#L323"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3730630%40wpforms-lite\u0026old=3709178%40wpforms-lite"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3730630/wpforms-lite/trunk/src/SmartTags/SmartTags.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-28T16:15:25.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:10:54.000Z",
"value": "Disclosed"
}
],
"title": "WPForms \u003c= 2.0.2.1 - Reflected Cross-Site Scripting via \u0027query_var\u0027 Smart Tag in iframe srcdoc Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-101921",
"datePublished": "2026-10-10T07:41:44.285Z",
"dateReserved": "2026-09-28T16:00:15.271Z",
"dateUpdated": "2026-10-11T12:13:44.291Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101920 (GCVE-0-2026-101920)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:41 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
Molongui Authorship <= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute
Summary
The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment (href attribute inside comment content)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable in the free build because the plugin's author-filter rewriter never appends the ?m_bm=true marker to its own anchors (Plugin::has_pro() returns false), meaning every href the byline script selects and rewrites is fully attacker-controlled.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:12 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| molongui | Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress |
Affected:
0 , ≤ 5.2.12
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101920",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:12:01.797319Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:44.419Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Molongui Authorship \u2013 Author Boxes, Guest Authors \u0026 Co-Authors for WordPress",
"vendor": "molongui",
"versions": [
{
"lessThanOrEqual": "5.2.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "crow"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Molongui Authorship \u2013 Author Boxes, Guest Authors \u0026 Co-Authors for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the \u0027comment (href attribute inside comment content)\u0027 parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable in the free build because the plugin\u0027s author-filter rewriter never appends the ?m_bm=true marker to its own anchors (Plugin::has_pro() returns false), meaning every href the byline script selects and rewrites is fully attacker-controlled."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:43.905Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1bf63dd3-9fd1-4b72-b7e0-48155312c48f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/molongui-authorship/tags/5.2.12/assets/js/byline.4cc4.min.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/molongui-authorship/tags/5.2.12/includes/author-filters.php#L29"
},
{
"url": "https://plugins.trac.wordpress.org/browser/molongui-authorship/tags/5.2.12/includes/author-filters.php#L464"
},
{
"url": "https://plugins.trac.wordpress.org/browser/molongui-authorship/tags/5.3.0/assets/js/byline.849a.min.js"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-01T21:23:57.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:41:21.000Z",
"value": "Disclosed"
}
],
"title": "Molongui Authorship \u003c= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-101920",
"datePublished": "2026-10-10T07:41:43.905Z",
"dateReserved": "2026-09-28T16:00:01.736Z",
"dateUpdated": "2026-10-11T12:13:44.419Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96662 (GCVE-0-2026-96662)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:41 – Updated: 2026-10-11 16:55
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:39 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96662",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T16:39:57.704939Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:55:15.993Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zickzick2"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via \u0027booking[service_id]\u0027 Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:43.527Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/18c1a5a0-dee0-45ee-9e8b-0937b392eccd?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/models/model.php#L403"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/helpers/connector_helper.php#L212"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/helpers/steps_helper.php#L1825"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/helpers/steps_helper.php#L1231"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/controllers/steps_controller.php#L356"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/controllers/steps_controller.php#L22"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/latepoint.php#L1072"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3718438%40latepoint\u0026new=3718438%40latepoint"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-23T15:06:47.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:23:35.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.2 - Unauthenticated SQL Injection via \u0027booking[service_id]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-96662",
"datePublished": "2026-10-10T07:41:43.527Z",
"dateReserved": "2026-09-23T14:51:55.113Z",
"dateUpdated": "2026-10-11T16:55:15.993Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100147 (GCVE-0-2026-100147)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:41 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)
Summary
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shipping_first_name' parameter in all versions up to, and including, 3.16.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:12 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| teamfunnelkit | FunnelKit – Funnel Builder for WooCommerce Checkout |
Affected:
0 , ≤ 3.16.0.5
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-100147",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:12:10.253950Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:44.537Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FunnelKit \u2013 Funnel Builder for WooCommerce Checkout",
"vendor": "teamfunnelkit",
"versions": [
{
"lessThanOrEqual": "3.16.0.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "crow"
}
],
"descriptions": [
{
"lang": "en",
"value": "The FunnelKit \u2013 Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027shipping_first_name\u0027 parameter in all versions up to, and including, 3.16.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:43.163Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1807b544-e5fd-403b-85a6-e20bd4f10dec?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wffn-ecomm-tracking.php#L211"
},
{
"url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wffn-ecomm-tracking.php#L1114"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3733861/"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3733886/funnel-builder/trunk/modules/thankyou-pages/includes/class-wffn-ecomm-tracking.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-25T11:56:10.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:41:06.000Z",
"value": "Disclosed"
}
],
"title": "FunnelKit \u003c= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-100147",
"datePublished": "2026-10-10T07:41:43.163Z",
"dateReserved": "2026-09-25T11:41:04.142Z",
"dateUpdated": "2026-10-11T12:13:44.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96563 (GCVE-0-2026-96563)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:41 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
Motors <= 1.4.123 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter
Summary
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up to, and including, 1.4.123 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required by the stm_ajax_add_a_car AJAX handler is emitted in wp_footer on every page, making it accessible to any authenticated user and removing any practical barrier to exploitation at the Subscriber level.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:12 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| stylemix | Motors – Car Dealership & Classified Listings Plugin |
Affected:
0 , ≤ 1.4.123
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96563",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:12:17.338521Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:44.695Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Motors \u2013 Car Dealership \u0026 Classified Listings Plugin",
"vendor": "stylemix",
"versions": [
{
"lessThanOrEqual": "1.4.123",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kamil B."
}
],
"descriptions": [
{
"lang": "en",
"value": "The Motors \u2013 Car Dealership \u0026 Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027stm_f_s\u0027 parameter in all versions up to, and including, 1.4.123 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required by the stm_ajax_add_a_car AJAX handler is emitted in wp_footer on every page, making it accessible to any authenticated user and removing any practical barrier to exploitation at the Subscriber level."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:42.772Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/14bb850e-df8a-46f0-b320-d8aedd763901?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/assets/js/frontend/init.js#L311"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/assets/js/frontend/init.js#L337"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/assets/js/frontend/filter.js#L724"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/assets/js/frontend/filter.js#L751"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/includes/vehicle_functions.php#L1432"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/includes/vehicle_functions.php#L1199"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-23T13:43:33.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:21:17.000Z",
"value": "Disclosed"
}
],
"title": "Motors \u003c= 1.4.123 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \u0027stm_f_s\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-96563",
"datePublished": "2026-10-10T07:41:42.772Z",
"dateReserved": "2026-09-23T13:18:29.927Z",
"dateUpdated": "2026-10-11T12:13:44.695Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96278 (GCVE-0-2026-96278)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:41 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History
Summary
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass works because esc_url_raw() strips literal angle brackets but retains HTML entities, which wppaEntityDecode() silently converts back to live HTML tags before jQuery('#wppa-modal-container').html() renders them.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:12 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| opajaap | WP Photo Album Plus |
Affected:
0 , ≤ 9.3.03.002
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96278",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:12:24.479846Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:44.831Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP Photo Album Plus",
"vendor": "opajaap",
"versions": [
{
"lessThanOrEqual": "9.3.03.002",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "nh4tvd"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass works because esc_url_raw() strips literal angle brackets but retains HTML entities, which wppaEntityDecode() silently converts back to live HTML tags before jQuery(\u0027#wppa-modal-container\u0027).html() renders them."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:42.244Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/095e93d0-ad0d-4613-887e-5e47a2ef2b96?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.3.02.003/wppa-maintenance.php#L1851"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.3.02.003/wppa-session.php#L141"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.3.02.003/wppa-input.php#L479"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.3.02.003/js/wppa-admin-scripts.js#L1249"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-22T20:51:17.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T18:46:24.000Z",
"value": "Disclosed"
}
],
"title": "WP Photo Album Plus \u003c= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-96278",
"datePublished": "2026-10-10T07:41:42.244Z",
"dateReserved": "2026-09-22T20:43:20.770Z",
"dateUpdated": "2026-10-11T12:13:44.831Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103427 (GCVE-0-2026-103427)
Vulnerability from cvelistv5 – Published: 2026-10-10 06:40 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field
Summary
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'country' parameter in all versions up to, and including, 4.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated attackers may also exploit this vulnerability when the plugin's Enable Free Membership feature is turned on, as it permits anonymous front-end registration and profile submission.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:12 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpinsider-1 | Simple Membership |
Affected:
0 , ≤ 4.8.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-103427",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:12:31.753980Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:44.961Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Simple Membership",
"vendor": "wpinsider-1",
"versions": [
{
"lessThanOrEqual": "4.8.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Maciej Komorowski"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027country\u0027 parameter in all versions up to, and including, 4.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated attackers may also exploit this vulnerability when the plugin\u0027s Enable Free Membership feature is turned on, as it permits anonymous front-end registration and profile submission."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T06:40:16.716Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fbebb9d4-c445-473d-a5f6-beac00ebe7aa?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/simple-membership/tags/4.8.4/classes/class.swpm-utils-misc.php#L1060"
},
{
"url": "https://plugins.trac.wordpress.org/browser/simple-membership/tags/4.8.4/views/admin_member_form_common_part.php#L42"
},
{
"url": "https://plugins.trac.wordpress.org/browser/simple-membership/tags/4.8.4/classes/class.swpm-form.php#L158"
},
{
"url": "https://downloads.wordpress.org/plugin/simple-membership.4.8.5.zip"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-30T15:10:54.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T17:40:22.000Z",
"value": "Disclosed"
}
],
"title": "Simple Membership \u003c= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-103427",
"datePublished": "2026-10-10T06:40:16.716Z",
"dateReserved": "2026-09-30T14:55:37.102Z",
"dateUpdated": "2026-10-11T12:13:44.961Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96572 (GCVE-0-2026-96572)
Vulnerability from cvelistv5 – Published: 2026-10-10 06:40 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
WP Meteor Website Speed Optimization Addon <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
Summary
The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.4.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered via the comment author name field, which must clear WordPress's comment moderation workflow before being displayed, though this represents a display prerequisite rather than any sanitization control.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:12 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| aguidrevitch | WP Meteor Website Speed Optimization Addon |
Affected:
0 , ≤ 3.4.18
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96572",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:12:38.951551Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:45.122Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP Meteor Website Speed Optimization Addon",
"vendor": "aguidrevitch",
"versions": [
{
"lessThanOrEqual": "3.4.18",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "theviper17y"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.4.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered via the comment author name field, which must clear WordPress\u0027s comment moderation workflow before being displayed, though this represents a display prerequisite rather than any sanitization control."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T06:40:16.314Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f54e358c-3bdf-426a-854a-d1bc8ff19afd?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-meteor/tags/3.4.18/blocker/FirstInteraction/UltimateReorder.php#L178"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-meteor/tags/3.4.18/blocker/FirstInteraction/UltimateReorder.php#L169"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-meteor/tags/3.4.18/frontend/Rewrite.php#L93"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-meteor/tags/3.4.18/frontend/Rewrite.php#L41"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3726637"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3726637/wp-meteor/trunk/blocker/FirstInteraction/UltimateReorder.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-23T13:43:39.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T18:28:39.000Z",
"value": "Disclosed"
}
],
"title": "WP Meteor Website Speed Optimization Addon \u003c= 3.4.18 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-96572",
"datePublished": "2026-10-10T06:40:16.314Z",
"dateReserved": "2026-09-23T13:25:43.487Z",
"dateUpdated": "2026-10-11T12:13:45.122Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104006 (GCVE-0-2026-104006)
Vulnerability from cvelistv5 – Published: 2026-10-10 06:40 – Updated: 2026-10-11 16:55
VLAI
EPSS
VEX
Title
SpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check
Summary
The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 via the 'comment_author_*, comment_author_email_*' parameter. This makes it possible for unauthenticated attackers to extract the full name and email address of returning commenters pre-filled into comment form input fields and persisted as the site-wide cached page by any unauthenticated attacker requesting the same public URL. The read-side handler in advanced-cache.php correctly skips cached delivery for requests carrying comment_author_* cookies, but this check is absent on the write path, meaning the cache poisoning is invisible to the victim commenter yet fully exploitable by any unauthenticated attacker with no cookies.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:40 UTC
CWE
- CWE-524 - Use of Cache Containing Sensitive Information
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| softaculous | SpeedyCache – Cache, Optimization, Performance |
Affected:
0 , ≤ 1.4.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104006",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T16:40:05.364510Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:55:16.112Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SpeedyCache \u2013 Cache, Optimization, Performance",
"vendor": "softaculous",
"versions": [
{
"lessThanOrEqual": "1.4.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kuba"
}
],
"descriptions": [
{
"lang": "en",
"value": "The SpeedyCache \u2013 Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 via the \u0027comment_author_*, comment_author_email_*\u0027 parameter. This makes it possible for unauthenticated attackers to extract the full name and email address of returning commenters pre-filled into comment form input fields and persisted as the site-wide cached page by any unauthenticated attacker requesting the same public URL. The read-side handler in advanced-cache.php correctly skips cached delivery for requests carrying comment_author_* cookies, but this check is absent on the write path, meaning the cache poisoning is invisible to the victim commenter yet fully exploitable by any unauthenticated attacker with no cookies."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-524",
"description": "CWE-524 Use of Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T06:40:15.885Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c6b8d5ca-34e2-4d25-9185-7fcee790379d?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/speedycache/tags/1.4.2/main/cache.php#L151"
},
{
"url": "https://plugins.trac.wordpress.org/browser/speedycache/tags/1.4.2/main/cache.php#L91"
},
{
"url": "https://plugins.trac.wordpress.org/browser/speedycache/tags/1.4.2/main/cache.php#L214"
},
{
"url": "https://plugins.trac.wordpress.org/browser/speedycache/tags/1.4.2/main/advanced-cache.php#L108"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3734609/speedycache"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3734608/speedycache/trunk/main/cache.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-01T16:42:08.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T17:42:19.000Z",
"value": "Disclosed"
}
],
"title": "SpeedyCache \u003c= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-104006",
"datePublished": "2026-10-10T06:40:15.885Z",
"dateReserved": "2026-10-01T16:26:50.185Z",
"dateUpdated": "2026-10-11T16:55:16.112Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3717 (GCVE-0-2026-3717)
Vulnerability from cvelistv5 – Published: 2026-10-10 06:40 – Updated: 2026-10-11 16:55
VLAI
EPSS
VEX
Title
CV Builder – Professional Resume Builder SaaS <= 1.3.1 - Missing Authorization to Unauthenticated PNG File Upload
Summary
The CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulnerable to unauthorized arbitrary file upload due to a missing capability check on the 'wp_save_signature_image' function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to upload arbitrary content to the WordPress uploads directory as png files.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:39 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bestwpdeveloper | WP CV Builder |
Affected:
0 , ≤ 1.3.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3717",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T16:39:50.325062Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:55:16.236Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP CV Builder",
"vendor": "bestwpdeveloper",
"versions": [
{
"lessThanOrEqual": "1.3.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Teerachai Somprasong"
}
],
"descriptions": [
{
"lang": "en",
"value": "The CV Builder \u2013 Professional Resume Builder SaaS plugin for WordPress is vulnerable to unauthorized arbitrary file upload due to a missing capability check on the \u0027wp_save_signature_image\u0027 function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to upload arbitrary content to the WordPress uploads directory as png files."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T06:40:15.481Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b7384260-96cd-4451-84ec-ce0fb7d38a9f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3480946/cv-builder"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-02-19T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-10-09T17:49:55.000Z",
"value": "Disclosed"
}
],
"title": "CV Builder \u2013 Professional Resume Builder SaaS \u003c= 1.3.1 - Missing Authorization to Unauthenticated PNG File Upload"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-3717",
"datePublished": "2026-10-10T06:40:15.481Z",
"dateReserved": "2026-03-07T11:30:11.944Z",
"dateUpdated": "2026-10-11T16:55:16.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107742 (GCVE-0-2026-107742)
Vulnerability from cvelistv5 – Published: 2026-10-10 06:40 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
Summary
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 2.34.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because a comment author Name value containing ' src=' and an event-handler payload contains no HTML tags or quote characters, allowing it to survive WordPress core's sanitize_text_field and land verbatim inside the alt attribute, where the plugin's own str_replace subsequently injects the single quote that breaks out of the attribute context.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:12 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| 10web | 10Web Booster – Website speed optimization, Cache & Page Speed optimizer |
Affected:
0 , ≤ 2.34.8
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107742",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:12:45.986657Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:45.257Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "10Web Booster \u2013 Website speed optimization, Cache \u0026 Page Speed optimizer",
"vendor": "10web",
"versions": [
{
"lessThanOrEqual": "2.34.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "daroo"
}
],
"descriptions": [
{
"lang": "en",
"value": "The 10Web Booster \u2013 Website speed optimization, Cache \u0026 Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027author\u0027 parameter in all versions up to, and including, 2.34.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because a comment author Name value containing \u0027 src=\u0027 and an event-handler payload contains no HTML tags or quote characters, allowing it to survive WordPress core\u0027s sanitize_text_field and land verbatim inside the alt attribute, where the plugin\u0027s own str_replace subsequently injects the single quote that breaks out of the attribute context."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T06:40:15.105Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b14945a5-c5e7-45cb-b2cc-8d1a265b6c52?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.8/includes/OptimizerImages.php#L445"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.8/includes/OptimizerImages.php#L310"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.8/includes/OptimizerImages.php#L186"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.8/tenweb_speed_optimizer.php#L175"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.10"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-08T18:07:14.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T17:45:10.000Z",
"value": "Disclosed"
}
],
"title": "10Web Booster \u003c= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-107742",
"datePublished": "2026-10-10T06:40:15.105Z",
"dateReserved": "2026-10-08T18:02:59.202Z",
"dateUpdated": "2026-10-11T12:13:45.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100196 (GCVE-0-2026-100196)
Vulnerability from cvelistv5 – Published: 2026-10-10 06:40 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content
Summary
The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment_content (rendered inline into the page HTML)' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core's wp_kses_data allow-list does not strip the crafted payload on save because it uses only permitted tags and attributes; the event handler is concealed inside a broken attribute region and is only promoted to a real DOM attribute by the plugin's render-time str_replace transformation. Additionally, a site administrator must approve the crafted comment before the payload is served to other visitors.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:12 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wp_media | LazyLoad Plugin – Lazy Load Images, Videos, and Iframes |
Affected:
0 , ≤ 2.4.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-100196",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:12:53.059527Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:45.392Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LazyLoad Plugin \u2013 Lazy Load Images, Videos, and Iframes",
"vendor": "wp_media",
"versions": [
{
"lessThanOrEqual": "2.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "theviper17y"
}
],
"descriptions": [
{
"lang": "en",
"value": "The LazyLoad Plugin \u2013 Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027comment_content (rendered inline into the page HTML)\u0027 parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core\u0027s wp_kses_data allow-list does not strip the crafted payload on save because it uses only permitted tags and attributes; the event handler is concealed inside a broken attribute region and is only promoted to a real DOM attribute by the plugin\u0027s render-time str_replace transformation. Additionally, a site administrator must approve the crafted comment before the payload is served to other visitors."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T06:40:14.705Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/af1060c6-9247-4059-ad6e-993fb7cee6d4?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/rocket-lazy-load/tags/2.4.0/src/Dependencies/RocketLazyload/Image.php#L118"
},
{
"url": "https://plugins.trac.wordpress.org/browser/rocket-lazy-load/tags/2.4.0/src/Dependencies/RocketLazyload/Image.php#L115"
},
{
"url": "https://plugins.trac.wordpress.org/browser/rocket-lazy-load/tags/2.4.0/src/Dependencies/RocketLazyload/Image.php#L116"
},
{
"url": "https://plugins.trac.wordpress.org/browser/rocket-lazy-load/tags/2.4.0/src/Dependencies/RocketLazyload/Image.php#L70"
},
{
"url": "https://plugins.trac.wordpress.org/browser/rocket-lazy-load/tags/2.4.0/src/Subscriber/LazyloadSubscriber.php#L326"
},
{
"url": "https://plugins.trac.wordpress.org/browser/rocket-lazy-load/tags/2.4.0/src/Subscriber/LazyloadSubscriber.php#L313"
},
{
"url": "https://plugins.trac.wordpress.org/browser/rocket-lazy-load/tags/2.4.0/src/Subscriber/LazyloadSubscriber.php#L82"
},
{
"url": "https://wordpress.org/plugins/rocket-lazy-load/"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3730807%40rocket-lazy-load%2Ftags%2F2.4.1\u0026old=3380138%40rocket-lazy-load%2Ftags%2F2.4.0"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-28T14:18:12.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T17:33:54.000Z",
"value": "Disclosed"
}
],
"title": "LazyLoad Plugin \u003c= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-100196",
"datePublished": "2026-10-10T06:40:14.705Z",
"dateReserved": "2026-09-25T14:49:45.612Z",
"dateUpdated": "2026-10-11T12:13:45.392Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102402 (GCVE-0-2026-102402)
Vulnerability from cvelistv5 – Published: 2026-10-10 06:40 – Updated: 2026-10-10 06:40
VLAI
EPSS
VEX
Title
Team <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode
Summary
The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttp_filter_taxonomy (meta of the attacker-chosen post)' parameter in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| techlabpro1 | Team – Team Members Showcase Plugin |
Affected:
0 , ≤ 6.0.2
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Team \u2013 Team Members Showcase Plugin",
"vendor": "techlabpro1",
"versions": [
{
"lessThanOrEqual": "6.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Team \u2013 Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027ttp_filter_taxonomy (meta of the attacker-chosen post)\u0027 parameter in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T06:40:14.291Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a6c976fd-c35c-40ac-8151-565a7dd746ca?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tlp-team/tags/6.0.2/app/Controllers/Frontend/Shortcode.php#L434"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tlp-team/tags/6.0.2/app/Controllers/Frontend/Shortcode.php#L947"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tlp-team/tags/6.0.2/app/Controllers/Frontend/Shortcode.php#L266"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-29T00:31:43.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T17:44:32.000Z",
"value": "Disclosed"
}
],
"title": "Team \u003c= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027ttp_filter_taxonomy\u0027 Post Meta via [tlpteam] Shortcode"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-102402",
"datePublished": "2026-10-10T06:40:14.291Z",
"dateReserved": "2026-09-29T00:16:28.245Z",
"dateUpdated": "2026-10-10T06:40:14.291Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6243 (GCVE-0-2026-6243)
Vulnerability from cvelistv5 – Published: 2026-10-10 06:40 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
Summary
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'get_dynamic_values' function performing text-level find-and-replace operations on post content without HTML-aware parsing. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:13 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| shabti | Frontend Admin by DynamiApps |
Affected:
0 , ≤ 3.28.36
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6243",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:13:28.978609Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:45.517Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Frontend Admin by DynamiApps",
"vendor": "shabti",
"versions": [
{
"lessThanOrEqual": "3.28.36",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Muhammad Yudha - DJ"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the \u0027get_dynamic_values\u0027 function performing text-level find-and-replace operations on post content without HTML-aware parsing. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T06:40:13.833Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9efd645d-817c-4148-b62f-86be90c543b4?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3519460/acf-frontend-form-element"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-11T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-04-13T17:32:01.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T17:51:02.000Z",
"value": "Disclosed"
}
],
"title": "Frontend Admin by DynamiApps \u003c= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-6243",
"datePublished": "2026-10-10T06:40:13.833Z",
"dateReserved": "2026-04-13T17:16:30.790Z",
"dateUpdated": "2026-10-11T12:13:45.517Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}