Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
10683 vulnerabilities
CVE-2026-12231 (GCVE-0-2026-12231)
Vulnerability from cvelistv5 – Published: 2026-08-02 08:33 – Updated: 2026-08-03 19:53
VLAI
EPSS
VEX
Title
Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'
Summary
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exad_infobox_image’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| timstrifler | Exclusive Addons for Elementor |
Affected:
0 , ≤ 2.7.9.8
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12231",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T19:52:43.457887Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T19:53:13.087Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Exclusive Addons for Elementor",
"vendor": "timstrifler",
"versions": [
{
"lessThanOrEqual": "2.7.9.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dmitrii Ignatyev"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018 exad_infobox_image\u2019 parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-02T08:33:00.095Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9b9d66db-53a8-4d93-9222-6f9649a7d842?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/exclusive-addons-for-elementor/tags/2.7.9.8/elements/infobox/infobox.php#L1019-L1095"
},
{
"url": "https://plugins.trac.wordpress.org/browser/exclusive-addons-for-elementor/tags/2.7.9.8/elements/infobox/infobox.php#L1082"
},
{
"url": "https://plugins.trac.wordpress.org/browser/exclusive-addons-for-elementor/tags/2.7.9.8/elements/infobox/infobox.php#L975"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3583929/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-01T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Exclusive Addons for Elementor \u003c= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027exad_infobox_image\u0027"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12231",
"datePublished": "2026-08-02T08:33:00.095Z",
"dateReserved": "2026-06-14T22:09:03.060Z",
"dateUpdated": "2026-08-03T19:53:13.087Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13339 (GCVE-0-2026-13339)
Vulnerability from cvelistv5 – Published: 2026-08-01 23:29 – Updated: 2026-08-03 15:37
VLAI
EPSS
VEX
Title
CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter
Summary
The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_content' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is exploitable by unauthenticated attackers because the required nonce is publicly emitted into the markup of any page rendering the CubeWP posts shortcode or widget with AJAX loading enabled, making it harvestable by any guest visitor before submitting the AJAX request.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cubewp1211 | CubeWP Framework |
Affected:
0 , ≤ 1.1.30
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13339",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T13:44:03.845797Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T15:37:36.562Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CubeWP Framework",
"vendor": "cubewp1211",
"versions": [
{
"lessThanOrEqual": "1.1.30",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nhien Pham (nhienit)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the \u0027cubewp_get_svg_content\u0027 function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is exploitable by unauthenticated attackers because the required nonce is publicly emitted into the markup of any page rendering the CubeWP posts shortcode or widget with AJAX loading enabled, making it harvestable by any guest visitor before submitting the AJAX request."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T23:29:35.617Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7ea72320-0e1e-45e3-987d-9ab7eecf1aee?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cubewp-framework/tags/1.1.30/cube/functions/admin-functions.php#L1170"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3627738/cubewp-framework"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-25T14:16:56.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-08-01T10:44:26.000Z",
"value": "Disclosed"
}
],
"title": "CubeWP Framework \u003c= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-13339",
"datePublished": "2026-08-01T23:29:35.617Z",
"dateReserved": "2026-06-25T14:01:39.269Z",
"dateUpdated": "2026-08-03T15:37:36.562Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8457 (GCVE-0-2026-8457)
Vulnerability from cvelistv5 – Published: 2026-08-01 23:29 – Updated: 2026-08-03 18:55
VLAI
EPSS
VEX
Title
WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT
Summary
The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple id_token and decoding only its base64 payload without verifying the JWT signature against Apple's public keys or validating the issuer, audience, or expiry claims, combined with the security nonce required to invoke the login flow being publicly exposed to unauthenticated users via a localized JavaScript object on the login page. This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including administrators — by supplying a forged id_token whose payload contains the target user's email address, as that email is used without any role exclusion to resolve a WordPress account and immediately issue an authenticated session for it.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-289 - Authentication Bypass by Alternate Name
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WPWeb | WooCommerce - Social Login |
Affected:
0 , ≤ 2.8.7
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8457",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T18:55:32.670795Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T18:55:40.237Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WooCommerce - Social Login",
"vendor": "WPWeb",
"versions": [
{
"lessThanOrEqual": "2.8.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Rafie Muhammad"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin\u0027s Apple login handler accepting the Apple id_token and decoding only its base64 payload without verifying the JWT signature against Apple\u0027s public keys or validating the issuer, audience, or expiry claims, combined with the security nonce required to invoke the login flow being publicly exposed to unauthenticated users via a localized JavaScript object on the login page. This makes it possible for unauthenticated attackers to log in as any existing WordPress user \u2014 including administrators \u2014 by supplying a forged id_token whose payload contains the target user\u0027s email address, as that email is used without any role exclusion to resolve a WordPress account and immediately issue an authenticated session for it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-289",
"description": "CWE-289 Authentication Bypass by Alternate Name",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T23:29:35.254Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/53e83037-2cc5-4dc9-b55d-03829df12a65?source=cve"
},
{
"url": "https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-14T14:59:00.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-08-01T11:09:08.000Z",
"value": "Disclosed"
}
],
"title": "WooCommerce - Social Login \u003c= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple \u0027id_token\u0027 JWT"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-8457",
"datePublished": "2026-08-01T23:29:35.254Z",
"dateReserved": "2026-05-13T05:50:34.984Z",
"dateUpdated": "2026-08-03T18:55:40.237Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18352 (GCVE-0-2026-18352)
Vulnerability from cvelistv5 – Published: 2026-08-01 23:29 – Updated: 2026-08-03 15:52
VLAI
EPSS
VEX
Title
User Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter
Summary
The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is possible because when attachment_url_to_postid() returns 0 for a traversal path, the plugin falls back to the global post set by a valid ?attachment_id parameter supplied by the attacker, causing the access check to pass against a legitimate public attachment while the file streamed is the attacker-chosen path.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| gm_alex | User Access Manager |
Affected:
0 , ≤ 2.3.15
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18352",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T15:51:51.845826Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T15:52:06.324Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "User Access Manager",
"vendor": "gm_alex",
"versions": [
{
"lessThanOrEqual": "2.3.15",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Supakiad S. (m3ez)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the \u0027uamgetfile\u0027 parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is possible because when attachment_url_to_postid() returns 0 for a traversal path, the plugin falls back to the global post set by a valid ?attachment_id parameter supplied by the attacker, causing the access check to pass against a legitimate public attachment while the file streamed is the attacker-chosen path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T23:29:34.756Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4e88efe0-ffad-4d66-bb03-3f3a9dcbe5b1?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-access-manager/tags/2.3.14/src/UserAccessManager.php%3A512-516"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-access-manager/tags/2.3.14/src/Controller/BaseControllerTrait.php%3A22-50"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-access-manager/tags/2.3.14/src/Controller/Frontend/RedirectController.php%3A50-99%2C119-141%2C245-252"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-access-manager/tags/2.3.14/src/File/FileHandler.php%3A79-124%2C270-294"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3628895/user-access-manager"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-30T06:45:32.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-08-01T11:07:06.000Z",
"value": "Disclosed"
}
],
"title": "User Access Manager \u003c= 2.3.15 - Unauthenticated Arbitrary File Read via \u0027uamgetfile\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-18352",
"datePublished": "2026-08-01T23:29:34.756Z",
"dateReserved": "2026-07-30T06:30:04.352Z",
"dateUpdated": "2026-08-03T15:52:06.324Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16635 (GCVE-0-2026-16635)
Vulnerability from cvelistv5 – Published: 2026-08-01 08:32 – Updated: 2026-08-03 15:38
VLAI
EPSS
VEX
Title
Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field
Summary
The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the `maybe_update_user_role()` function passing an attacker-controlled Gravity Forms field value (`$lead[$feed->user_role_field_id]`) directly into `WP_User::set_role()` without any allowlist validation, capability comparison, or permission check to constrain which roles can be assigned. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their own WordPress account to Administrator by tampering with the role field value in a form submission. Exploitation requires that an administrator has already configured a Pronamic Pay payment feed in Gravity Forms with the **Update User Role** option enabled and mapped to a form field; once that configuration is in place, no further preconditions exist to prevent an authenticated attacker from exploiting this vulnerability.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pronamic | Pronamic Pay |
Affected:
0 , ≤ 10.1.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16635",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T13:44:14.473068Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T15:38:33.517Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Pronamic Pay",
"vendor": "pronamic",
"versions": [
{
"lessThanOrEqual": "10.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Afan"
},
{
"lang": "en",
"type": "finder",
"value": "moonge"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the `maybe_update_user_role()` function passing an attacker-controlled Gravity Forms field value (`$lead[$feed-\u003euser_role_field_id]`) directly into `WP_User::set_role()` without any allowlist validation, capability comparison, or permission check to constrain which roles can be assigned. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their own WordPress account to Administrator by tampering with the role field value in a form submission. Exploitation requires that an administrator has already configured a Pronamic Pay payment feed in Gravity Forms with the **Update User Role** option enabled and mapped to a form field; once that configuration is in place, no further preconditions exist to prevent an authenticated attacker from exploiting this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T08:32:29.692Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d42b8856-e5d0-4122-98a4-8c959832b271?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/pronamic-ideal/tags/10.1.0/packages/wp-pay-extensions/gravityforms/src/Extension.php#L379"
},
{
"url": "https://plugins.trac.wordpress.org/browser/pronamic-ideal/tags/10.1.0/packages/wp-pay-extensions/gravityforms/src/Extension.php#L376"
},
{
"url": "https://plugins.trac.wordpress.org/browser/pronamic-ideal/tags/10.1.0/packages/wp-pay-extensions/gravityforms/src/Extension.php#L988"
},
{
"url": "https://plugins.trac.wordpress.org/browser/pronamic-ideal/tags/10.1.0/packages/wp-pay-extensions/gravityforms/src/Extension.php#L144"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fpronamic-ideal/tags/10.1.0\u0026new_path=%2Fpronamic-ideal/tags/10.2.0"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3630401/pronamic-ideal/trunk/packages/wp-pay-extensions/gravityforms/src/Extension.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-22T16:57:11.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T20:28:17.000Z",
"value": "Disclosed"
}
],
"title": "Pronamic Pay \u003c= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms \u0027Update user role\u0027 Field"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-16635",
"datePublished": "2026-08-01T08:32:29.692Z",
"dateReserved": "2026-07-22T16:41:01.494Z",
"dateUpdated": "2026-08-03T15:38:33.517Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18344 (GCVE-0-2026-18344)
Vulnerability from cvelistv5 – Published: 2026-08-01 08:32 – Updated: 2026-08-03 19:28
VLAI
EPSS
VEX
Title
Responsive Thumbnail Slider < 1.1.53 - Reflected Cross-Site Scripting via 'id' Parameter
Summary
The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding, 1.1.53. This is due to insufficient input sanitization and output escaping in the responsive_thumbnail_image_management() function, which echoes $_GET['id'] directly into a double-quoted HTML attribute with no esc_attr() call. The only guard is a loose PHP numeric comparison ($_GET['id']>0) that a string beginning with a numeric prefix trivially satisfies, and the addslashes() applied by wp_magic_quotes() is inert in HTML-attribute context because backslash is not an HTML escape character. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| nik00726 | Responsive Thumbnail Slider |
Affected:
0 , < 1.1.53
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18344",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T19:28:09.009999Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T19:28:19.629Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Responsive Thumbnail Slider",
"vendor": "nik00726",
"versions": [
{
"lessThan": "1.1.53",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u0027id\u0027 parameter in versions up to, and excluding, 1.1.53. This is due to insufficient input sanitization and output escaping in the responsive_thumbnail_image_management() function, which echoes $_GET[\u0027id\u0027] directly into a double-quoted HTML attribute with no esc_attr() call. The only guard is a loose PHP numeric comparison ($_GET[\u0027id\u0027]\u003e0) that a string beginning with a numeric prefix trivially satisfies, and the addslashes() applied by wp_magic_quotes() is inert in HTML-attribute context because backslash is not an HTML escape character. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T08:32:29.326Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c7370cbc-f681-49d7-9330-762443202529?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-responsive-thumbnail-slider/trunk/wp-responsive-images-thumbnail-slider.php#L1275"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-responsive-thumbnail-slider/trunk/wp-responsive-images-thumbnail-slider.php#L1274"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-29T22:23:30.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T19:57:41.000Z",
"value": "Disclosed"
}
],
"title": "Responsive Thumbnail Slider \u003c 1.1.53 - Reflected Cross-Site Scripting via \u0027id\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-18344",
"datePublished": "2026-08-01T08:32:29.326Z",
"dateReserved": "2026-07-29T22:08:20.674Z",
"dateUpdated": "2026-08-03T19:28:19.629Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15644 (GCVE-0-2026-15644)
Vulnerability from cvelistv5 – Published: 2026-08-01 08:32 – Updated: 2026-08-03 19:27
VLAI
EPSS
VEX
Title
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
Summary
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codesupplyco | Powerkit – Supercharge your WordPress Site |
Affected:
0 , ≤ 3.1.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15644",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T19:27:14.935285Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T19:27:23.906Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Powerkit \u2013 Supercharge your WordPress Site",
"vendor": "codesupplyco",
"versions": [
{
"lessThanOrEqual": "3.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Powerkit \u2013 Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027style\u0027 Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T08:32:28.962Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ae04e9f2-0260-44bd-9439-cabf9d00fc2c?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/powerkit/tags/3.0.9/modules/basic-elements/templates/separators.php#L67"
},
{
"url": "https://plugins.trac.wordpress.org/browser/powerkit/tags/3.1.0/modules/basic-elements/templates/separators.php#L67"
},
{
"url": "https://plugins.trac.wordpress.org/browser/powerkit/tags/3.1.0/modules/basic-elements/public/class-powerkit-basic-elements-public.php#L113"
},
{
"url": "https://plugins.trac.wordpress.org/browser/powerkit/tags/3.1.0/modules/basic-elements/public/class-powerkit-basic-elements-public.php#L126"
},
{
"url": "https://plugins.trac.wordpress.org/browser/powerkit/tags/3.0.9/modules/basic-elements/public/class-powerkit-basic-elements-public.php#L113"
},
{
"url": "https://plugins.trac.wordpress.org/browser/powerkit/tags/3.0.9/modules/basic-elements/public/class-powerkit-basic-elements-public.php#L126"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3629599/powerkit"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-13T19:12:28.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T19:55:01.000Z",
"value": "Disclosed"
}
],
"title": "Powerkit \u003c= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027style\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15644",
"datePublished": "2026-08-01T08:32:28.962Z",
"dateReserved": "2026-07-13T18:57:18.185Z",
"dateUpdated": "2026-08-03T19:27:23.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6453 (GCVE-0-2026-6453)
Vulnerability from cvelistv5 – Published: 2026-08-01 08:32 – Updated: 2026-08-03 18:39
VLAI
EPSS
VEX
Title
CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter
Summary
The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewp_remove_relation() AJAX function, specifically the use of wp_unslash() on the relation_id parameter before interpolating it directly into a raw SQL query without using $wpdb->prepare(). The wp_unslash() call explicitly removes the backslash escaping that WordPress's wp_magic_quotes() adds to all $_POST data, neutralizing the only layer of SQL injection protection. The sanitize_text_field() function applied afterward offers no SQL protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries to the existing query.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cubewp1211 | CubeWP Framework |
Affected:
0 , ≤ 1.1.30
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6453",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T18:39:48.465932Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T18:39:59.351Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CubeWP Framework",
"vendor": "cubewp1211",
"versions": [
{
"lessThanOrEqual": "1.1.30",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Louis Deschanel (JeanJeanLeHaxor)"
},
{
"lang": "en",
"type": "finder",
"value": "Pascal SUN"
}
],
"descriptions": [
{
"lang": "en",
"value": "The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewp_remove_relation() AJAX function, specifically the use of wp_unslash() on the relation_id parameter before interpolating it directly into a raw SQL query without using $wpdb-\u003eprepare(). The wp_unslash() call explicitly removes the backslash escaping that WordPress\u0027s wp_magic_quotes() adds to all $_POST data, neutralizing the only layer of SQL injection protection. The sanitize_text_field() function applied afterward offers no SQL protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries to the existing query."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T08:32:28.613Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a4647620-e06a-49d5-8f9d-a59cb5a999b1?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cubewp-framework/trunk/cube/functions/admin-functions.php#L2655"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cubewp-framework/trunk/cube/modules/custom-fields/class-cubewp-relationships.php#L261"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cubewp-framework/tags/1.1.29/cube/modules/custom-fields/class-cubewp-relationships.php#L261"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cubewp-framework/trunk/cube/modules/custom-fields/class-cubewp-relationships.php#L251"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cubewp-framework/tags/1.1.29/cube/modules/custom-fields/class-cubewp-relationships.php#L251"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cubewp-framework/tags/1.1.29/cube/functions/admin-functions.php#L2655"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3627740%40cubewp-framework\u0026new=3627740%40cubewp-framework"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-16T20:09:12.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T20:01:04.000Z",
"value": "Disclosed"
}
],
"title": "CubeWP Framework \u003c= 1.1.30 - Authenticated (Subscriber+) SQL Injection via \u0027relation_id\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-6453",
"datePublished": "2026-08-01T08:32:28.613Z",
"dateReserved": "2026-04-16T19:53:58.136Z",
"dateUpdated": "2026-08-03T18:39:59.351Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14073 (GCVE-0-2025-14073)
Vulnerability from cvelistv5 – Published: 2026-08-01 08:32 – Updated: 2026-08-03 19:12
VLAI
EPSS
VEX
Title
WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure
Summary
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the `enqueue_paypal_insights_script_on_order_received()` function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to obtain sensitive order information including order keys, which can then be leveraged to access full customer billing details (name, email, phone, address) via the WooCommerce Store API within a 10-minute grace period after order creation.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| woocommerce | WooCommerce PayPal Payments |
Affected:
0 , ≤ 3.3.2
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14073",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T19:11:58.110937Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T19:12:08.961Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WooCommerce PayPal Payments",
"vendor": "woocommerce",
"versions": [
{
"lessThanOrEqual": "3.3.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Drew Webber (mcdruid)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the `enqueue_paypal_insights_script_on_order_received()` function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to obtain sensitive order information including order keys, which can then be leveraged to access full customer billing details (name, email, phone, address) via the WooCommerce Store API within a 10-minute grace period after order creation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T08:32:28.242Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a2919bbc-c4c2-4b52-90ec-2471218cd7d1?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-paypal-payments/tags/3.3.0/modules/ppcp-axo/src/AxoModule.php#L362"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fwoocommerce-paypal-payments/tags/3.3.2\u0026new_path=%2Fwoocommerce-paypal-payments/tags/3.4.0"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3458079/woocommerce-paypal-payments/trunk/modules/ppcp-axo/src/AxoModule.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-12-04T22:23:35.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T19:56:35.000Z",
"value": "Disclosed"
}
],
"title": "WooCommerce PayPal Payments \u003c= 3.3.2 - Unauthenticated Sensitive Information Disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-14073",
"datePublished": "2026-08-01T08:32:28.242Z",
"dateReserved": "2025-12-04T22:08:18.909Z",
"dateUpdated": "2026-08-03T19:12:08.961Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17555 (GCVE-0-2026-17555)
Vulnerability from cvelistv5 – Published: 2026-08-01 08:32 – Updated: 2026-08-03 18:01
VLAI
EPSS
VEX
Title
WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter
Summary
The WPvivid Backup & Migration plugin for WordPress is vulnerable to SQL Injection via the export_data parameter in versions up to, and including, 0.9.131. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The values are received in prepare_export_post(), passed through sanitize_text_field() and stripslashes(), JSON-decoded, and the attacker-controlled JSON object keys are collected as $posts_ids without integer casting. They are stored in the export task options and later joined with commas and interpolated directly into a `WHERE ID IN (...)` clause inside a $wpdb->get_results() call in export_post_to_xml() (unquoted, numeric context), with no $wpdb->prepare() or esc_sql(). This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpvividplugins | WPvivid — Backup, Migration & Staging |
Affected:
0 , ≤ 0.9.131
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17555",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T18:01:03.846540Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T18:01:35.590Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPvivid \u2014 Backup, Migration \u0026 Staging",
"vendor": "wpvividplugins",
"versions": [
{
"lessThanOrEqual": "0.9.131",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPvivid Backup \u0026 Migration plugin for WordPress is vulnerable to SQL Injection via the export_data parameter in versions up to, and including, 0.9.131. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The values are received in prepare_export_post(), passed through sanitize_text_field() and stripslashes(), JSON-decoded, and the attacker-controlled JSON object keys are collected as $posts_ids without integer casting. They are stored in the export task options and later joined with commas and interpolated directly into a `WHERE ID IN (...)` clause inside a $wpdb-\u003eget_results() call in export_post_to_xml() (unquoted, numeric context), with no $wpdb-\u003eprepare() or esc_sql(). This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T08:32:27.889Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7130f325-a0c4-479d-ac85-94542bdb5a79?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.131/includes/class-wpvivid-exporter.php#L1398"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.131/includes/class-wpvivid-exporter.php#L1409"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.131/includes/class-wpvivid-export-import.php#L1129"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3627791%40wpvivid-backuprestore\u0026new=3627791%40wpvivid-backuprestore"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-31T19:54:10.000Z",
"value": "Disclosed"
}
],
"title": "WPvivid \u003c= 0.9.131 - Authenticated (Administrator+) SQL Injection via \u0027export_data\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-17555",
"datePublished": "2026-08-01T08:32:27.889Z",
"dateReserved": "2026-07-27T12:52:12.175Z",
"dateUpdated": "2026-08-03T18:01:35.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17571 (GCVE-0-2026-17571)
Vulnerability from cvelistv5 – Published: 2026-08-01 08:32 – Updated: 2026-08-03 19:02
VLAI
EPSS
VEX
Title
Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'
Summary
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'param' in all versions up to, and including, 6.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpmanageninja | Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder |
Affected:
0 , ≤ 6.2.8
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17571",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T19:02:02.985156Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T19:02:11.226Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, \u0026 Conversational Form Builder",
"vendor": "wpmanageninja",
"versions": [
{
"lessThanOrEqual": "6.2.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Osvaldo Noe Gonzalez Del Rio (Os)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, \u0026 Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via \u0027param\u0027 in all versions up to, and including, 6.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T08:32:27.506Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/547008fe-2585-4089-a710-71a83ae3d829?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/app/Modules/Component/Component.php#L1456"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/app/Modules/Component/Component.php#L1452"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Ffluentform/tags/6.2.8\u0026new_path=%2Ffluentform/tags/6.2.9"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3625751/fluentform/trunk/app/Modules/Component/Component.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-27T15:21:42.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T19:54:23.000Z",
"value": "Disclosed"
}
],
"title": "Fluent Forms \u003c= 6.2.8 - Reflected Cross-Site Scripting via \u0027param\u0027"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-17571",
"datePublished": "2026-08-01T08:32:27.506Z",
"dateReserved": "2026-07-27T15:06:12.769Z",
"dateUpdated": "2026-08-03T19:02:11.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15964 (GCVE-0-2026-15964)
Vulnerability from cvelistv5 – Published: 2026-08-01 08:32 – Updated: 2026-08-03 18:39
VLAI
EPSS
VEX
Title
Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change
Summary
The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the `ssoprocess_ajax()` function — registered on `wp_ajax_nopriv_ssoprocess_ajax` and therefore reachable without authentication — accepting an attacker-supplied `email` parameter with the `setnewpassword` operation and calling `reset_password()` on the resolved account without any ownership token, email confirmation link, or capability check. The sole guard is a call to `check_ajax_referer()`, which provides no authorization barrier because the `ssoajaxnonce` nonce is publicly broadcast on every front-end page via `wp_localize_script()` into the `SSOPWDREQUIREMENT` JavaScript object; since WordPress computes nonces for logged-out visitors against a shared anonymous session context, any unauthenticated visitor can scrape a valid nonce from the homepage and use it to authenticate the request. This makes it possible for unauthenticated attackers to change the password of any WordPress account, including administrator accounts, enabling complete site takeover.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-620 - Unverified Password Change
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| britcoder | Single Sign On For TNG |
Affected:
0 , ≤ 2.0.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15964",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T18:39:18.090314Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T18:39:30.723Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Single Sign On For TNG",
"vendor": "britcoder",
"versions": [
{
"lessThanOrEqual": "2.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "andrea bocchetti"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the `ssoprocess_ajax()` function \u2014 registered on `wp_ajax_nopriv_ssoprocess_ajax` and therefore reachable without authentication \u2014 accepting an attacker-supplied `email` parameter with the `setnewpassword` operation and calling `reset_password()` on the resolved account without any ownership token, email confirmation link, or capability check. The sole guard is a call to `check_ajax_referer()`, which provides no authorization barrier because the `ssoajaxnonce` nonce is publicly broadcast on every front-end page via `wp_localize_script()` into the `SSOPWDREQUIREMENT` JavaScript object; since WordPress computes nonces for logged-out visitors against a shared anonymous session context, any unauthenticated visitor can scrape a valid nonce from the homepage and use it to authenticate the request. This makes it possible for unauthenticated attackers to change the password of any WordPress account, including administrator accounts, enabling complete site takeover."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "CWE-620 Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T08:32:27.015Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1d8d393e-764c-491d-8afb-7d4f8d0c387a?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/single-sign-on-for-tng/tags/2.0.0/single-sign-on-for-tng.php#L120"
},
{
"url": "https://plugins.trac.wordpress.org/browser/single-sign-on-for-tng/tags/2.0.0/single-sign-on-for-tng.php#L102"
},
{
"url": "https://plugins.trac.wordpress.org/browser/single-sign-on-for-tng/tags/2.0.0/single-sign-on-for-tng.php#L69"
},
{
"url": "https://plugins.trac.wordpress.org/browser/single-sign-on-for-tng/tags/2.0.0/single-sign-on-for-tng.php#L96"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3624827%40single-sign-on-for-tng\u0026new=3624827%40single-sign-on-for-tng"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-16T17:27:44.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T20:08:40.000Z",
"value": "Disclosed"
}
],
"title": "Single Sign On For TNG \u003c= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15964",
"datePublished": "2026-08-01T08:32:27.015Z",
"dateReserved": "2026-07-16T15:00:32.244Z",
"dateUpdated": "2026-08-03T18:39:30.723Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15649 (GCVE-0-2026-15649)
Vulnerability from cvelistv5 – Published: 2026-08-01 07:49 – Updated: 2026-08-03 18:00
VLAI
EPSS
VEX
Title
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Summary
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codesupplyco | Powerkit – Supercharge your WordPress Site |
Affected:
0 , ≤ 3.1.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15649",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T18:00:45.711432Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T18:00:56.582Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Powerkit \u2013 Supercharge your WordPress Site",
"vendor": "codesupplyco",
"versions": [
{
"lessThanOrEqual": "3.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Powerkit \u2013 Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T07:49:53.866Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f86c6ada-112b-4b1f-b1ac-7dd4920953c8?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/powerkit/tags/3.1.0/modules/basic-elements/templates/progressbars.php#L109"
},
{
"url": "https://plugins.trac.wordpress.org/browser/powerkit/tags/3.1.0/modules/basic-elements/public/class-powerkit-basic-elements-public.php#L83"
},
{
"url": "https://plugins.trac.wordpress.org/browser/powerkit/tags/3.0.9/modules/basic-elements/templates/progressbars.php#L109"
},
{
"url": "https://plugins.trac.wordpress.org/browser/powerkit/tags/3.0.9/modules/basic-elements/public/class-powerkit-basic-elements-public.php#L83"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3629599/powerkit"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-13T19:27:57.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T19:47:12.000Z",
"value": "Disclosed"
}
],
"title": "Powerkit \u003c= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15649",
"datePublished": "2026-08-01T07:49:53.866Z",
"dateReserved": "2026-07-13T19:12:48.045Z",
"dateUpdated": "2026-08-03T18:00:56.582Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16091 (GCVE-0-2026-16091)
Vulnerability from cvelistv5 – Published: 2026-08-01 07:49 – Updated: 2026-08-03 18:52
VLAI
EPSS
VEX
Title
GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode
Summary
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gamipress_rank' Shortcode in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rubengc | GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress |
Affected:
0 , ≤ 7.9.9.1
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16091",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T18:52:14.510424Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T18:52:22.593Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "GamiPress \u2013 Gamification plugin to reward points, achievements, badges \u0026 ranks in WordPress",
"vendor": "rubengc",
"versions": [
{
"lessThanOrEqual": "7.9.9.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The GamiPress \u2013 Gamification plugin to reward points, achievements, badges \u0026 ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027gamipress_rank\u0027 Shortcode in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T07:49:53.479Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d9f257a9-d447-407c-83ae-3cc99254be3f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.9/includes/filters.php#L1899"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.9/includes/shortcodes/gamipress_rank.php#L197"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.9/includes/shortcodes/gamipress_rank.php#L203"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.9/includes/template-functions.php#L74"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.9/templates/rank.php#L162"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3619577%40gamipress\u0026new=3619577%40gamipress"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-31T19:27:48.000Z",
"value": "Disclosed"
}
],
"title": "GamiPress \u003c= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027gamipress_rank\u0027 Shortcode"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-16091",
"datePublished": "2026-08-01T07:49:53.479Z",
"dateReserved": "2026-07-17T14:06:35.858Z",
"dateUpdated": "2026-08-03T18:52:22.593Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17580 (GCVE-0-2026-17580)
Vulnerability from cvelistv5 – Published: 2026-08-01 07:49 – Updated: 2026-08-03 19:09
VLAI
EPSS
VEX
Title
Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints
Summary
The Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the register_rest_routes. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive admin-authored editor content — including template markup, CSS code, JavaScript code, and PHP controller variables — for any Layout or Post Selection post on the site.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-862 - Missing Authorization
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wplakeorg | Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… |
Affected:
0 , ≤ 3.9.1
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17580",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T19:09:31.822274Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T19:09:40.911Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Advanced Views \u2013 Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver\u2026",
"vendor": "wplakeorg",
"versions": [
{
"lessThanOrEqual": "3.9.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Advanced Views \u2013 Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver\u2026 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the register_rest_routes. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive admin-authored editor content \u2014 including template markup, CSS code, JavaScript code, and PHP controller variables \u2014 for any Layout or Post Selection post on the site."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T07:49:53.096Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d352e4d1-92ab-482b-8fce-90ee3e22ba3c?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/acf-views/tags/3.9.0/src/Cpt/Base/Cpt/Cpt_Interactive_Fields.php#L98"
},
{
"url": "https://plugins.trac.wordpress.org/browser/acf-views/tags/3.9.1/src/Cpt/Base/Cpt/Cpt_Interactive_Fields.php#L98"
},
{
"url": "https://plugins.trac.wordpress.org/browser/acf-views/tags/3.9.1/src/Cpt/Base/Cpt/Cpt_Interactive_Fields.php#L77"
},
{
"url": "https://plugins.trac.wordpress.org/browser/acf-views/tags/3.9.1/src/Cpt/Layouts/Cpt/Layout_Interactive_Fields.php#L74"
},
{
"url": "https://plugins.trac.wordpress.org/browser/acf-views/tags/3.9.1/src/Cpt/Post_Selections/Cpt/Selection_Interactive_Fields.php#L30"
},
{
"url": "https://plugins.trac.wordpress.org/browser/acf-views/tags/3.9.0/src/Cpt/Base/Cpt/Cpt_Interactive_Fields.php#L77"
},
{
"url": "https://plugins.trac.wordpress.org/browser/acf-views/tags/3.9.0/src/Cpt/Layouts/Cpt/Layout_Interactive_Fields.php#L74"
},
{
"url": "https://plugins.trac.wordpress.org/browser/acf-views/tags/3.9.0/src/Cpt/Post_Selections/Cpt/Selection_Interactive_Fields.php#L30"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3626967%40acf-views\u0026new=3626967%40acf-views"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-27T16:02:23.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T19:18:52.000Z",
"value": "Disclosed"
}
],
"title": "Advanced Views \u003c= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via \u0027view-refresh\u0027 and \u0027card-refresh\u0027 REST Endpoints"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-17580",
"datePublished": "2026-08-01T07:49:53.096Z",
"dateReserved": "2026-07-27T15:47:15.890Z",
"dateUpdated": "2026-08-03T19:09:40.911Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15950 (GCVE-0-2026-15950)
Vulnerability from cvelistv5 – Published: 2026-08-01 07:49 – Updated: 2026-08-03 19:26
VLAI
EPSS
VEX
Title
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute
Summary
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cozythemes | Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates |
Affected:
0 , ≤ 2.2.11
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15950",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T19:26:46.215240Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T19:26:55.873Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cozy Blocks \u2013 Page Builder for Gutenberg Editor \u0026 FSE with 700+ Patterns, 58 Blocks \u0026 Templates",
"vendor": "cozythemes",
"versions": [
{
"lessThanOrEqual": "2.2.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Cozy Blocks \u2013 Page Builder for Gutenberg Editor \u0026 FSE with 600+ Patterns, 58 Blocks \u0026 Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027layoutCircle.alignment\u0027 Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T07:49:52.697Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cc751980-987f-49c5-a9fb-16ba219c174a?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/blocks/progress-bar/render.php#L117"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/blocks/progress-bar/render.php#L158"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3619461%40cozy-addons\u0026new=3619461%40cozy-addons"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-16T13:20:29.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T19:29:28.000Z",
"value": "Disclosed"
}
],
"title": "Cozy Blocks \u003c= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027layoutCircle.alignment\u0027 Block Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15950",
"datePublished": "2026-08-01T07:49:52.697Z",
"dateReserved": "2026-07-16T13:05:18.708Z",
"dateUpdated": "2026-08-03T19:26:55.873Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18059 (GCVE-0-2026-18059)
Vulnerability from cvelistv5 – Published: 2026-08-01 07:49 – Updated: 2026-08-03 18:38
VLAI
EPSS
VEX
Title
PixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation
Summary
The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata — including product names, product IDs, quantities, per-item prices, order totals, currency, and order/transaction IDs — for any existing order by supplying an invalid or arbitrary order key. This is exploitable against any known or enumerated order ID, as the plugin resolves the order from the URL path variable alone and emits the full woo_purchase tracking payload into the page HTML via the pysOptions JavaScript object across its Facebook, Google Analytics, and Google Tag Manager integrations regardless of key validity.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
12 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| pixelyoursite | PixelYourSite – Your smart PIXEL (TAG) & API Manager |
Affected:
0 , ≤ 11.2.1
(semver)
|
|
| pixelyoursite | PixelYourSite Pro – Your smart PIXEL (TAG) Manager |
Affected:
0 , < 12.6.1
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18059",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T18:38:42.951018Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T18:38:53.179Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PixelYourSite \u2013 Your smart PIXEL (TAG) \u0026 API Manager",
"vendor": "pixelyoursite",
"versions": [
{
"lessThanOrEqual": "11.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PixelYourSite Pro \u2013 Your smart PIXEL (TAG) Manager",
"vendor": "pixelyoursite",
"versions": [
{
"lessThan": "12.6.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Win3"
}
],
"descriptions": [
{
"lang": "en",
"value": "The PixelYourSite \u2013 Your smart PIXEL (TAG) \u0026 API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata \u2014 including product names, product IDs, quantities, per-item prices, order totals, currency, and order/transaction IDs \u2014 for any existing order by supplying an invalid or arbitrary order key. This is exploitable against any known or enumerated order ID, as the plugin resolves the order from the URL path variable alone and emits the full woo_purchase tracking payload into the page HTML via the pysOptions JavaScript object across its Facebook, Google Analytics, and Google Tag Manager integrations regardless of key validity."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T07:49:52.317Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca14ec54-0864-47f7-9653-1fe04e2875de?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.2.1/modules/facebook/facebook.php#L696"
},
{
"url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.2.1/modules/google_analytics/ga.php#L843"
},
{
"url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.2.1/modules/google_gtm/gtm.php#L1083"
},
{
"url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.2.1/includes/functions-woo.php#L244"
},
{
"url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.2.1/includes/class-pys.php#L1112"
},
{
"url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.2.0.5/modules/facebook/facebook.php#L696"
},
{
"url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.2.0.5/modules/google_analytics/ga.php#L843"
},
{
"url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.2.0.5/modules/google_gtm/gtm.php#L1083"
},
{
"url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.2.0.5/includes/functions-woo.php#L244"
},
{
"url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.2.0.5/includes/class-pys.php#L1112"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3629756%40pixelyoursite\u0026new=3629756%40pixelyoursite"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-28T14:05:11.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T19:45:43.000Z",
"value": "Disclosed"
}
],
"title": "PixelYourSite \u003c= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-18059",
"datePublished": "2026-08-01T07:49:52.317Z",
"dateReserved": "2026-07-28T13:50:01.828Z",
"dateUpdated": "2026-08-03T18:38:53.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15052 (GCVE-0-2026-15052)
Vulnerability from cvelistv5 – Published: 2026-08-01 07:49 – Updated: 2026-08-03 18:58
VLAI
EPSS
VEX
Title
MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting via Form Field Values
Summary
The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| umarbajwa | MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder |
Affected:
0 , ≤ 4.3.3
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15052",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T18:57:55.566442Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T18:58:05.886Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder",
"vendor": "umarbajwa",
"versions": [
{
"lessThanOrEqual": "4.3.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "she11f"
}
],
"descriptions": [
{
"lang": "en",
"value": "The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T07:49:51.938Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c3d2425e-69e5-4efe-bbc6-0ef121e74341?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mailchimp-subscribe-sm/tags/4.3.3/integrations/form-builder-database/extension.php#L179"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mailchimp-subscribe-sm/tags/4.3.3/integrations/form-builder-database/extension.php#L127"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mailchimp-subscribe-sm/tags/4.3.3/admin/classes/ajax-requests-class.php#L1224"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mailchimp-subscribe-sm/tags/4.3.3/admin/classes/ajax-requests-class.php#L2311"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mailchimp-subscribe-sm/tags/4.3.3/admin/classes/ajax-requests-class.php#L906"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3627272%40mailchimp-subscribe-sm\u0026new=3627272%40mailchimp-subscribe-sm"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-08T21:30:26.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T19:41:41.000Z",
"value": "Disclosed"
}
],
"title": "MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder \u003c= 4.3.3 - Unauthenticated Stored Cross-Site Scripting via Form Field Values"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15052",
"datePublished": "2026-08-01T07:49:51.938Z",
"dateReserved": "2026-07-08T13:23:30.631Z",
"dateUpdated": "2026-08-03T18:58:05.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15450 (GCVE-0-2026-15450)
Vulnerability from cvelistv5 – Published: 2026-08-01 07:49 – Updated: 2026-08-03 19:25
VLAI
EPSS
VEX
Title
NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter
Summary
The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the delete_file() AJAX handler retrieving a file path from the database and passing it directly to unlink() with no validation (no realpath(), basename(), or allowlist check), combined with the insert_record() AJAX handler that lets the same authenticated user store an arbitrary value in the target 'location' column (wp_kses() only strips HTML tags and does not neutralize path traversal or absolute paths). This makes it possible for authenticated attackers, with admin-level access and above, to delete arbitrary files on the affected site's server, including wp-config. When the plugin's user-level option is configured to something else, this may be exploitable with lower privileges.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| webaways | NEX-Forms – Ultimate Forms Plugin for WordPress |
Affected:
0 , ≤ 9.2.3
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15450",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T19:25:48.263863Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T19:25:59.037Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NEX-Forms \u2013 Ultimate Forms Plugin for WordPress",
"vendor": "webaways",
"versions": [
{
"lessThanOrEqual": "9.2.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Nex Forms \u2013 Ultimate Form Builder \u2013 Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the delete_file() AJAX handler retrieving a file path from the database and passing it directly to unlink() with no validation (no realpath(), basename(), or allowlist check), combined with the insert_record() AJAX handler that lets the same authenticated user store an arbitrary value in the target \u0027location\u0027 column (wp_kses() only strips HTML tags and does not neutralize path traversal or absolute paths). This makes it possible for authenticated attackers, with admin-level access and above, to delete arbitrary files on the affected site\u0027s server, including wp-config. When the plugin\u0027s user-level option is configured to something else, this may be exploitable with lower privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T07:49:51.535Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb5c8cb3-df67-4f2c-869a-48e34f5619ff?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.3/includes/classes/class.db.php#L805"
},
{
"url": "https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.3/includes/classes/class.db.php#L269"
},
{
"url": "https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.3/includes/classes/class.db.php#L273"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3625615%40nex-forms-express-wp-form-builder\u0026new=3625615%40nex-forms-express-wp-form-builder"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-10T19:42:41.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T19:42:18.000Z",
"value": "Disclosed"
}
],
"title": "NEX-Forms \u003c= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via \u0027location\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15450",
"datePublished": "2026-08-01T07:49:51.535Z",
"dateReserved": "2026-07-10T19:27:33.129Z",
"dateUpdated": "2026-08-03T19:25:59.037Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17605 (GCVE-0-2026-17605)
Vulnerability from cvelistv5 – Published: 2026-08-01 07:49 – Updated: 2026-08-03 19:25
VLAI
EPSS
VEX
Title
Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field
Summary
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaid_payment_form_element function. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| stiofansisland | Payment forms, Buy now buttons, and Invoicing System | GetPaid |
Affected:
0 , ≤ 2.8.56
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17605",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T19:25:11.741214Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T19:25:21.461Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Payment forms, Buy now buttons, and Invoicing System | GetPaid",
"vendor": "stiofansisland",
"versions": [
{
"lessThanOrEqual": "2.8.56",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaid_payment_form_element function. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-98",
"description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T07:49:51.153Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/baca279b-0c42-48a9-930a-8d0525066e0a?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.54/includes/wpinv-template-functions.php#L1458"
},
{
"url": "https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.56/includes/wpinv-template-functions.php#L1458"
},
{
"url": "https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.56/includes/wpinv-template-functions.php#L1432"
},
{
"url": "https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.56/includes/admin/meta-boxes/class-getpaid-meta-box-payment-form.php#L131"
},
{
"url": "https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.56/includes/admin/class-getpaid-metaboxes.php#L257"
},
{
"url": "https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.54/includes/wpinv-template-functions.php#L1432"
},
{
"url": "https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.54/includes/admin/meta-boxes/class-getpaid-meta-box-payment-form.php#L131"
},
{
"url": "https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.54/includes/admin/class-getpaid-metaboxes.php#L257"
},
{
"url": "https://github.com/AyeCode/invoicing/commit/80625ba90241840e46b0bc5400f100e6d38ee85c"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-27T16:48:35.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T19:44:03.000Z",
"value": "Disclosed"
}
],
"title": "Payment forms, Buy now buttons, and Invoicing System | GetPaid \u003c= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form \u0027type\u0027 Element Field"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-17605",
"datePublished": "2026-08-01T07:49:51.153Z",
"dateReserved": "2026-07-27T16:33:27.183Z",
"dateUpdated": "2026-08-03T19:25:21.461Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15951 (GCVE-0-2026-15951)
Vulnerability from cvelistv5 – Published: 2026-08-01 07:49 – Updated: 2026-08-03 18:38
VLAI
EPSS
VEX
Title
Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter
Summary
The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in versions up to, and including, 1.0.12. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the Icegram_Mailer_Logs_Table::get_logs() function, where each element of the `fields` array received from $_REQUEST['data'] is joined verbatim into the SELECT clause via implode() with no whitelist, escaping, or prepared-statement placeholder. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| icegram | Icegram Mailer – Reliable Email Deliverability, No-code SMTP Replacement & Email logs |
Affected:
0 , ≤ 1.0.12
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15951",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T18:38:14.318533Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T18:38:23.595Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Icegram Mailer \u2013 Reliable Email Deliverability, No-code SMTP Replacement \u0026 Email logs",
"vendor": "icegram",
"versions": [
{
"lessThanOrEqual": "1.0.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the \u0027fields\u0027 parameter in versions up to, and including, 1.0.12. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the Icegram_Mailer_Logs_Table::get_logs() function, where each element of the `fields` array received from $_REQUEST[\u0027data\u0027] is joined verbatim into the SELECT clause via implode() with no whitelist, escaping, or prepared-statement placeholder. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T07:49:50.727Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9e4cff1c-6a01-4725-9e37-f48b5de16d9b?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/icegram-mailer/tags/1.0.12/includes/db/class-icegram-mailer-logs-table.php#L109"
},
{
"url": "https://plugins.trac.wordpress.org/browser/icegram-mailer/tags/1.0.12/includes/controllers/class-icegram-mailer-dashboard-controller.php#L26"
},
{
"url": "https://plugins.trac.wordpress.org/browser/icegram-mailer/tags/1.0.12/includes/class-icegram-mailer-router.php#L44"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3627122%40icegram-mailer\u0026new=3627122%40icegram-mailer"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-16T13:28:59.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T19:33:07.000Z",
"value": "Disclosed"
}
],
"title": "Icegram Mailer \u003c= 1.0.12 - Authenticated (Administrator+) SQL Injection via \u0027fields\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15951",
"datePublished": "2026-08-01T07:49:50.727Z",
"dateReserved": "2026-07-16T13:12:54.122Z",
"dateUpdated": "2026-08-03T18:38:23.595Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16144 (GCVE-0-2026-16144)
Vulnerability from cvelistv5 – Published: 2026-08-01 07:49 – Updated: 2026-08-03 19:22
VLAI
EPSS
VEX
Title
Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter
Summary
The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys ('thisPermalink', 'entryCounter', or 'submission_link'), as check_if_placeholders_changed() only processes POST keys present in the form's field_type_map.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
12 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpchill | Kali Forms — Contact Form & Drag-and-Drop Builder |
Affected:
0 , ≤ 2.4.20
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16144",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T19:22:31.712704Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T19:22:40.521Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Kali Forms \u2014 Contact Form \u0026 Drag-and-Drop Builder",
"vendor": "wpchill",
"versions": [
{
"lessThanOrEqual": "2.4.20",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Kali Forms \u2014 Contact Form \u0026 Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the \u0027thisPermalink\u0027 field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys (\u0027thisPermalink\u0027, \u0027entryCounter\u0027, or \u0027submission_link\u0027), as check_if_placeholders_changed() only processes POST keys present in the form\u0027s field_type_map."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T07:49:50.355Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9d692aff-8bb2-45bb-9caf-bc33d3ed5b10?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.20/Inc/Frontend/class-form-processor.php#L1033"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.20/Inc/Frontend/class-form-processor.php#L172"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.20/Inc/Frontend/class-form-processor.php#L277"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.20/Inc/Frontend/class-form-processor.php#L976"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.20/Inc/Frontend/class-form-processor.php#L90"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.19/Inc/Frontend/class-form-processor.php#L1033"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.19/Inc/Frontend/class-form-processor.php#L172"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.19/Inc/Frontend/class-form-processor.php#L277"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.19/Inc/Frontend/class-form-processor.php#L976"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.19/Inc/Frontend/class-form-processor.php#L90"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3623024%40kali-forms\u0026new=3623024%40kali-forms"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-17T18:00:17.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T19:40:39.000Z",
"value": "Disclosed"
}
],
"title": "Kali Forms \u003c= 2.4.20 - Unauthenticated Remote Code Execution via \u0027thisPermalink\u0027 Field Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-16144",
"datePublished": "2026-08-01T07:49:50.355Z",
"dateReserved": "2026-07-17T17:45:06.586Z",
"dateUpdated": "2026-08-03T19:22:40.521Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15018 (GCVE-0-2026-15018)
Vulnerability from cvelistv5 – Published: 2026-08-01 07:49 – Updated: 2026-08-03 17:59
VLAI
EPSS
VEX
Title
Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter
Summary
The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a trigger.txt file to be present in the plugin's directory (/wp-content/plugins/database-collation-fix/trigger.txt), a condition created by DesktopServer integration events such as site creation, copy, import, move, export, or deploy.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davejesch | Database Collation Fix |
Affected:
0 , ≤ 1.2.10
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15018",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T17:58:46.361042Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T17:59:21.993Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Database Collation Fix",
"vendor": "davejesch",
"versions": [
{
"lessThanOrEqual": "1.2.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nabil Irawan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the \u0027force-collation-algorithm\u0027 parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a trigger.txt file to be present in the plugin\u0027s directory (/wp-content/plugins/database-collation-fix/trigger.txt), a condition created by DesktopServer integration events such as site creation, copy, import, move, export, or deploy."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T07:49:49.957Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/874c1ba5-1bbd-43ac-bc5c-901638fa56ef?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/database-collation-fix/trunk/databasecollationfix.php#L148"
},
{
"url": "https://plugins.trac.wordpress.org/browser/database-collation-fix/trunk/databasecollationfix.php#L131"
},
{
"url": "https://plugins.trac.wordpress.org/browser/database-collation-fix/trunk/databasecollationfix.php#L81"
},
{
"url": "https://plugins.trac.wordpress.org/browser/database-collation-fix/trunk/databasecollationfix.php#L251"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3602218%40database-collation-fix\u0026new=3602218%40database-collation-fix"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-31T19:22:46.000Z",
"value": "Disclosed"
}
],
"title": "Database Collation Fix \u003c= 1.2.10 - Unauthenticated SQL Injection via \u0027force-collation-algorithm\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15018",
"datePublished": "2026-08-01T07:49:49.957Z",
"dateReserved": "2026-07-07T23:30:22.187Z",
"dateUpdated": "2026-08-03T17:59:21.993Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16614 (GCVE-0-2026-16614)
Vulnerability from cvelistv5 – Published: 2026-08-01 07:49 – Updated: 2026-08-03 18:37
VLAI
EPSS
VEX
Title
GSheetConnector <= 5.2.1 - Authenticated (Administrator+) SQL Injection via 's' Parameter
Summary
The GSheetConnector – CF7 Google Sheets Connector with Real-Time Sync plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 5.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. wp_unslash() strips magic-quote protection and sanitize_text_field() does not escape SQL metacharacters, leaving single quotes and other SQL metacharacters intact before the value is interpolated into the query.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| westerndeal | GSheetConnector – CF7 Google Sheets Connector |
Affected:
0 , ≤ 5.2.1
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16614",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T18:37:41.546287Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T18:37:54.304Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "GSheetConnector \u2013 CF7 Google Sheets Connector",
"vendor": "westerndeal",
"versions": [
{
"lessThanOrEqual": "5.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The GSheetConnector \u2013 CF7 Google Sheets Connector with Real-Time Sync plugin for WordPress is vulnerable to generic SQL Injection via the \u0027s\u0027 parameter in all versions up to, and including, 5.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. wp_unslash() strips magic-quote protection and sanitize_text_field() does not escape SQL metacharacters, leaving single quotes and other SQL metacharacters intact before the value is interpolated into the query."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T07:49:49.590Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/83455de5-4fb2-4782-8063-646d3daf29e5?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cf7-google-sheets-connector/tags/5.1.7/includes/pages/class-gs-cf7db-formEntryList.php#L64"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cf7-google-sheets-connector/tags/5.1.7/includes/pages/class-gs-cf7db-formEntryList.php#L34"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cf7-google-sheets-connector/tags/5.1.7/includes/pages/gs-cf7db.php#L340"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3628480%40cf7-google-sheets-connector\u0026new=3628480%40cf7-google-sheets-connector"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-28T13:39:06.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T19:30:52.000Z",
"value": "Disclosed"
}
],
"title": "GSheetConnector \u003c= 5.2.1 - Authenticated (Administrator+) SQL Injection via \u0027s\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-16614",
"datePublished": "2026-08-01T07:49:49.590Z",
"dateReserved": "2026-07-22T14:36:47.065Z",
"dateUpdated": "2026-08-03T18:37:54.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11995 (GCVE-0-2026-11995)
Vulnerability from cvelistv5 – Published: 2026-08-01 07:49 – Updated: 2026-08-03 18:37
VLAI
EPSS
VEX
Title
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_bulk_action()
Summary
The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.9.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the read/unread status of or permanently trash arbitrary form submission entries belonging to any form. The nonce issued by check_ajax_referer() does not function as an authorization barrier because the nonce action 'gutena_Forms' is emitted to unauthenticated visitors via wp_localize_script() on any public page that contains a Gutena Forms block, making it freely obtainable by anonymous attackers.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-862 - Missing Authorization
Assigner
References
12 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| saadiqbal | Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder |
Affected:
0 , ≤ 1.9.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11995",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T18:37:10.360416Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T18:37:21.490Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder",
"vendor": "saadiqbal",
"versions": [
{
"lessThanOrEqual": "1.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Endang Alfarisi"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.9.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the read/unread status of or permanently trash arbitrary form submission entries belonging to any form. The nonce issued by check_ajax_referer() does not function as an authorization barrier because the nonce action \u0027gutena_Forms\u0027 is emitted to unauthenticated visitors via wp_localize_script() on any public page that contains a Gutena Forms block, making it freely obtainable by anonymous attackers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T07:49:49.140Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/81557da6-c98a-4e71-ab88-e987a3650158?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gutena-forms/tags/1.9.0/includes/admin/class-manage-store.php#L62"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gutena-forms/tags/1.9.0/includes/admin/class-manage-store.php#L53"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gutena-forms/tags/1.9.0/includes/admin/class-manage-store.php#L38"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gutena-forms/tags/1.9.0/includes/admin/class-store.php#L130"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gutena-forms/tags/1.9.0/gutena-forms.php#L463"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gutena-forms/tags/1.7.1/includes/admin/class-manage-store.php#L62"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gutena-forms/tags/1.7.1/includes/admin/class-manage-store.php#L53"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gutena-forms/tags/1.7.1/includes/admin/class-manage-store.php#L38"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gutena-forms/tags/1.7.1/includes/admin/class-store.php#L130"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gutena-forms/tags/1.7.1/gutena-forms.php#L463"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3624033%40gutena-forms\u0026new=3624033%40gutena-forms"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-11T15:30:56.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T19:31:37.000Z",
"value": "Disclosed"
}
],
"title": "Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder \u003c= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_bulk_action()"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-11995",
"datePublished": "2026-08-01T07:49:49.140Z",
"dateReserved": "2026-06-11T15:15:35.975Z",
"dateUpdated": "2026-08-03T18:37:21.490Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16685 (GCVE-0-2026-16685)
Vulnerability from cvelistv5 – Published: 2026-08-01 07:49 – Updated: 2026-08-03 17:38
VLAI
EPSS
VEX
Title
Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute
Summary
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3.66 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post() does not neutralize the payload because it operates on post content at save time and does not process shortcode attribute values that are emitted unescaped at render time.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Download Manager |
Affected:
0 , ≤ 3.3.66
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16685",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T17:37:40.845674Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T17:38:14.207Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Download Manager",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "3.3.66",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027icon\u0027 Shortcode Attribute in all versions up to, and including, 3.3.66 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post() does not neutralize the payload because it operates on post content at save time and does not process shortcode attribute values that are emitted unescaped at render time."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T07:49:48.762Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a32393e-f233-4ab6-addc-9dd1e04c0e0a?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.64/src/__/UI.php#L81"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.66/src/__/UI.php#L81"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.66/src/Package/views/category-shortcode-toolbar.php#L36"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.66/src/Package/views/category-shortcode-toolbar.php#L17"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.66/src/Category/Shortcodes.php#L18"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.64/src/Package/views/category-shortcode-toolbar.php#L36"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.64/src/Package/views/category-shortcode-toolbar.php#L17"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.64/src/Category/Shortcodes.php#L18"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3628015%40download-manager\u0026new=3628015%40download-manager"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-22T22:55:00.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T19:29:43.000Z",
"value": "Disclosed"
}
],
"title": "Download Manager \u003c= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027icon\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-16685",
"datePublished": "2026-08-01T07:49:48.762Z",
"dateReserved": "2026-07-22T22:39:53.074Z",
"dateUpdated": "2026-08-03T17:38:14.207Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16090 (GCVE-0-2026-16090)
Vulnerability from cvelistv5 – Published: 2026-08-01 07:49 – Updated: 2026-08-03 17:36
VLAI
EPSS
VEX
Title
GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode
Summary
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute in 'gamipress_achievement' in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress save-time wp_kses_post does not neutralize this payload because the injected value is stored inside a shortcode attribute rather than as a raw HTML tag, and is only emitted into HTML at render time without escaping.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rubengc | GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress |
Affected:
0 , ≤ 7.9.9.1
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16090",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T17:35:55.694229Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T17:36:05.600Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "GamiPress \u2013 Gamification plugin to reward points, achievements, badges \u0026 ranks in WordPress",
"vendor": "rubengc",
"versions": [
{
"lessThanOrEqual": "7.9.9.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The GamiPress \u2013 Gamification plugin to reward points, achievements, badges \u0026 ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027heading_size\u0027 Shortcode Attribute in \u0027gamipress_achievement\u0027 in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress save-time wp_kses_post does not neutralize this payload because the injected value is stored inside a shortcode attribute rather than as a raw HTML tag, and is only emitted into HTML at render time without escaping."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T07:49:48.357Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/77727d02-796b-4c5b-ad5d-d1c366760abc?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.9/includes/filters.php#L542"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.9/includes/shortcodes/gamipress_achievement.php#L229"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3619577%40gamipress\u0026new=3619577%40gamipress"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-31T19:28:21.000Z",
"value": "Disclosed"
}
],
"title": "GamiPress \u003c= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-16090",
"datePublished": "2026-08-01T07:49:48.357Z",
"dateReserved": "2026-07-17T14:05:35.669Z",
"dateUpdated": "2026-08-03T17:36:05.600Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18062 (GCVE-0-2026-18062)
Vulnerability from cvelistv5 – Published: 2026-08-01 07:49 – Updated: 2026-08-03 15:38
VLAI
EPSS
VEX
Title
Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content
Summary
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image Content in all versions up to, and including, 3.7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only triggerable when the block's urlTransparent attribute is set to a non-empty value, as this is a required precondition for the vulnerable code path in build_html() to be reached.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| stellarwp | Kadence Blocks — Page Builder Toolkit for Gutenberg Editor |
Affected:
0 , ≤ 3.7.8.1
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18062",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T13:44:24.450295Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T15:38:36.792Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor",
"vendor": "stellarwp",
"versions": [
{
"lessThanOrEqual": "3.7.8.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "theviper17y"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image Content in all versions up to, and including, 3.7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only triggerable when the block\u0027s urlTransparent attribute is set to a non-empty value, as this is a required precondition for the vulnerable code path in build_html() to be reached."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T07:49:47.952Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/620bd934-327e-4509-a5e0-b910654af29b?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.7.8/includes/blocks/class-kadence-blocks-identity-block.php#L117"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.7.8/includes/blocks/class-kadence-blocks-identity-block.php#L108"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.7.8/includes/blocks/class-kadence-blocks-identity-block.php#L162"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.7.2/includes/blocks/class-kadence-blocks-identity-block.php#L117"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.7.2/includes/blocks/class-kadence-blocks-identity-block.php#L108"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.7.2/includes/blocks/class-kadence-blocks-identity-block.php#L162"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3627652%40kadence-blocks\u0026new=3627652%40kadence-blocks"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-28T14:17:05.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T19:39:46.000Z",
"value": "Disclosed"
}
],
"title": "Kadence Blocks \u003c= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-18062",
"datePublished": "2026-08-01T07:49:47.952Z",
"dateReserved": "2026-07-28T14:01:53.403Z",
"dateUpdated": "2026-08-03T15:38:36.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18435 (GCVE-0-2026-18435)
Vulnerability from cvelistv5 – Published: 2026-08-01 07:49 – Updated: 2026-08-03 17:35
VLAI
EPSS
VEX
Title
Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute
Summary
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'toggleIcon' Block Attribute in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| stellarwp | Kadence Blocks — Page Builder Toolkit for Gutenberg Editor |
Affected:
0 , ≤ 3.7.8
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18435",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T17:34:38.670941Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T17:35:46.899Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor",
"vendor": "stellarwp",
"versions": [
{
"lessThanOrEqual": "3.7.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027toggleIcon\u0027 Block Attribute in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T07:49:47.486Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5f346cc7-92ad-4f76-a71c-864c22ed56b5?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.7.8/includes/class-kadence-blocks-table-of-contents.php#L936"
},
{
"url": "https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.7.8/includes/blocks/class-kadence-blocks-table-of-contents-block.php#L293"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3624906%40kadence-blocks\u0026new=3624906%40kadence-blocks"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-30T20:23:14.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T19:39:02.000Z",
"value": "Disclosed"
}
],
"title": "Kadence Blocks \u003c= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027toggleIcon\u0027 Block Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-18435",
"datePublished": "2026-08-01T07:49:47.486Z",
"dateReserved": "2026-07-30T20:08:07.545Z",
"dateUpdated": "2026-08-03T17:35:46.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15645 (GCVE-0-2026-15645)
Vulnerability from cvelistv5 – Published: 2026-08-01 07:49 – Updated: 2026-08-03 15:38
VLAI
EPSS
VEX
Title
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Shortcode Attribute
Summary
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codesupplyco | Powerkit – Supercharge your WordPress Site |
Affected:
0 , ≤ 3.1.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15645",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T13:44:39.567146Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T15:38:39.885Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Powerkit \u2013 Supercharge your WordPress Site",
"vendor": "codesupplyco",
"versions": [
{
"lessThanOrEqual": "3.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Powerkit \u2013 Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027nav\u0027 Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T07:49:47.112Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5b33aa60-ac20-42c3-a3ab-b29ddfe2284a?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/powerkit/tags/3.0.9/modules/basic-elements/templates/tabs.php#L133"
},
{
"url": "https://plugins.trac.wordpress.org/browser/powerkit/tags/3.1.0/modules/basic-elements/templates/tabs.php#L133"
},
{
"url": "https://plugins.trac.wordpress.org/browser/powerkit/tags/3.1.0/modules/basic-elements/templates/tabs.php#L135"
},
{
"url": "https://plugins.trac.wordpress.org/browser/powerkit/tags/3.1.0/modules/basic-elements/public/class-powerkit-basic-elements-public.php#L113"
},
{
"url": "https://plugins.trac.wordpress.org/browser/powerkit/tags/3.0.9/modules/basic-elements/templates/tabs.php#L135"
},
{
"url": "https://plugins.trac.wordpress.org/browser/powerkit/tags/3.0.9/modules/basic-elements/public/class-powerkit-basic-elements-public.php#L113"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3629599/powerkit"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-13T19:13:29.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Powerkit \u003c= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027nav\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15645",
"datePublished": "2026-08-01T07:49:47.112Z",
"dateReserved": "2026-07-13T18:58:18.168Z",
"dateUpdated": "2026-08-03T15:38:39.885Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}