Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
11239 vulnerabilities
CVE-2026-9858 (GCVE-0-2026-9858)
Vulnerability from cvelistv5 – Published: 2026-09-19 08:27 – Updated: 2026-09-20 00:35
VLAI
EPSS
VEX
Title
Partial Shipment for Woocommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions
Summary
The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX actions. This is due to the AJAX handlers in woocommerce-partial-shipment.php (registered at lines 60–62 and implemented at lines 228, 263, and 291) lacking both capability checks and nonce verification, and not validating the calling user's ownership of the supplied order_id. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary order item details (names, quantities, shipped counts) belonging to any customer and to modify the shipment status / shipped quantities of any order, which can also trigger order status transitions via the wxp_order_status action.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:17 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpexpertshub | Partial Shipment for WooCommerce |
Affected:
0 , ≤ 3.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9858",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:17:03.223646Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-20T00:35:29.208Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Partial Shipment for WooCommerce",
"vendor": "wpexpertshub",
"versions": [
{
"lessThanOrEqual": "3.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Muhan Luo"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX actions. This is due to the AJAX handlers in woocommerce-partial-shipment.php (registered at lines 60\u201362 and implemented at lines 228, 263, and 291) lacking both capability checks and nonce verification, and not validating the calling user\u0027s ownership of the supplied order_id. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary order item details (names, quantities, shipped counts) belonging to any customer and to modify the shipment status / shipped quantities of any order, which can also trigger order status transitions via the wxp_order_status action."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T08:27:24.252Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d9278c56-b963-4d9b-ae5a-45dab44c701f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wc-partial-shipment/tags/3.4/woocommerce-partial-shipment.php#L291"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wc-partial-shipment/tags/3.4/woocommerce-partial-shipment.php#L228"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wc-partial-shipment/tags/3.4/woocommerce-partial-shipment.php#L263"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wc-partial-shipment/tags/3.4/woocommerce-partial-shipment.php#L60"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3561104%40wc-partial-shipment\u0026new=3561104%40wc-partial-shipment"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:59:23.000Z",
"value": "Disclosed"
}
],
"title": "Partial Shipment for Woocommerce \u003c= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-9858",
"datePublished": "2026-09-19T08:27:24.252Z",
"dateReserved": "2026-05-28T15:55:58.558Z",
"dateUpdated": "2026-09-20T00:35:29.208Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9613 (GCVE-0-2026-9613)
Vulnerability from cvelistv5 – Published: 2026-09-19 08:27 – Updated: 2026-09-19 13:51
VLAI
EPSS
VEX
Title
Datalogics Ecommerce Delivery <= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)
Summary
The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create and cancel real shipping orders through the external logistics API using the store's stored authentication token, modify arbitrary WooCommerce order post meta on any order, overwrite the plugin's stored API token, and trigger shipping notification emails to customers.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:17 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
18 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| datalogics | Datalogics Ecommerce Delivery – Datalogics |
Affected:
0 , ≤ 2.6.65
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9613",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:17:09.324009Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T13:51:18.728Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Datalogics Ecommerce Delivery \u2013 Datalogics",
"vendor": "datalogics",
"versions": [
{
"lessThanOrEqual": "2.6.65",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Benedictus Jovan (aillesiM)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Datalogics Ecommerce Delivery \u2013 Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create and cancel real shipping orders through the external logistics API using the store\u0027s stored authentication token, modify arbitrary WooCommerce order post meta on any order, overwrite the plugin\u0027s stored API token, and trigger shipping notification emails to customers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T08:27:23.913Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c0ed27b8-dbdc-4927-8019-52a622bfbff6?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L679"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L691"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L809"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L198"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L244"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L5"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L76"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L646"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L679"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L691"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L809"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L198"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L244"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L5"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L76"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L646"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3552733%40datalogics\u0026new=3552733%40datalogics"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:54:22.000Z",
"value": "Disclosed"
}
],
"title": "Datalogics Ecommerce Delivery \u003c= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-9613",
"datePublished": "2026-09-19T08:27:23.913Z",
"dateReserved": "2026-05-26T16:29:51.747Z",
"dateUpdated": "2026-09-19T13:51:18.728Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76579 (GCVE-0-2026-76579)
Vulnerability from cvelistv5 – Published: 2026-09-19 08:27 – Updated: 2026-09-19 13:51
VLAI
EPSS
VEX
Title
LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter
Summary
The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the attacker supply a validly signed 'esi' value in the GET query string while submitting a separate attacker-controlled 'esi' payload as a POST body field, relying on PHP's default $_REQUEST merge order to have the POST value take precedence at the point of execution.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:17 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| litespeedtech | LiteSpeed Cache |
Affected:
0 , ≤ 7.9
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76579",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:17:15.684976Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T13:51:18.872Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LiteSpeed Cache",
"vendor": "litespeedtech",
"versions": [
{
"lessThanOrEqual": "7.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "mak3bread"
}
],
"descriptions": [
{
"lang": "en",
"value": "The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u0027esi\u0027 parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the attacker supply a validly signed \u0027esi\u0027 value in the GET query string while submitting a separate attacker-controlled \u0027esi\u0027 payload as a POST body field, relying on PHP\u0027s default $_REQUEST merge order to have the POST value take precedence at the point of execution."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T08:27:23.566Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ba236f86-0434-4030-8e14-4db3919226eb?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9/src/esi.cls.php#L855"
},
{
"url": "https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9/src/esi.cls.php#L617"
},
{
"url": "https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9/src/esi.cls.php#L591"
},
{
"url": "https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9/src/esi.cls.php#L566"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3676856%40litespeed-cache%2Ftags%2F7.9.1\u0026old=3635849%40litespeed-cache%2Ftags%2F7.9"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3676856/litespeed-cache/trunk/src/esi.cls.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-19T14:18:31.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-18T19:46:10.000Z",
"value": "Disclosed"
}
],
"title": "LiteSpeed Cache \u003c= 7.9 - Reflected Cross-Site Scripting via ESI \u0027esi\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-76579",
"datePublished": "2026-09-19T08:27:23.566Z",
"dateReserved": "2026-08-19T14:03:14.526Z",
"dateUpdated": "2026-09-19T13:51:18.872Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1256 (GCVE-0-2026-1256)
Vulnerability from cvelistv5 – Published: 2026-09-19 08:27 – Updated: 2026-09-19 13:51
VLAI
EPSS
VEX
Title
YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input
Summary
The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary popups and inject malicious JavaScript that executes when the popup is displayed, leading to Stored XSS.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:17 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ysinnovations | YS LeadGen – Popup Builder, Popup Maker & Form Builder for WordPress | Lead Generation, Email Marketing, Sales, Conversions, Opt-Ins & Subscribers |
Affected:
0 , ≤ 2.1.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1256",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:17:19.796590Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T13:51:19.044Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "YS LeadGen \u2013 Popup Builder, Popup Maker \u0026 Form Builder for WordPress | Lead Generation, Email Marketing, Sales, Conversions, Opt-Ins \u0026 Subscribers",
"vendor": "ysinnovations",
"versions": [
{
"lessThanOrEqual": "2.1.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Athiwat Tiprasaharn (Jitlada)"
},
{
"lang": "en",
"type": "finder",
"value": "Itthidej Aramsri (Boeing777)"
},
{
"lang": "en",
"type": "finder",
"value": "Powpy"
},
{
"lang": "en",
"type": "finder",
"value": "Waris Damkham"
}
],
"descriptions": [
{
"lang": "en",
"value": "The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary popups and inject malicious JavaScript that executes when the popup is displayed, leading to Stored XSS."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T08:27:23.235Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b62b8619-4348-4cf7-a572-aa6df20bdc3a?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ysleadgen/tags/1.1.1/app/Controllers/Ajax.php#L37"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ysleadgen/tags/1.1.1/app/Controllers/Ajax.php#L38"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ysleadgen/tags/1.1.1/app/Controllers/Ajax.php#L36"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3577391"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:47:41.000Z",
"value": "Disclosed"
}
],
"title": "YS LeadGen \u2013 Popups, Opt-ins \u0026 Lead Capture \u003c= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-1256",
"datePublished": "2026-09-19T08:27:23.235Z",
"dateReserved": "2026-01-20T19:48:06.226Z",
"dateUpdated": "2026-09-19T13:51:19.044Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9766 (GCVE-0-2026-9766)
Vulnerability from cvelistv5 – Published: 2026-09-19 08:27 – Updated: 2026-09-19 13:51
VLAI
EPSS
VEX
Title
Empik for Woocommerce <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action
Summary
The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary WooCommerce product metadata, including Empik logistic class (_empik_logistic_klass), product state (_empik_product_state, _empik_product_state_all_variants), and Empik export and offer flags on any product in the store.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:17 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| empik | Empik for Woocommerce |
Affected:
0 , ≤ 1.5.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9766",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:17:25.326650Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T13:51:19.217Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Empik for Woocommerce",
"vendor": "empik",
"versions": [
{
"lessThanOrEqual": "1.5.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Benedictus Jovan (aillesiM)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary WooCommerce product metadata, including Empik logistic class (_empik_logistic_klass), product state (_empik_product_state, _empik_product_state_all_variants), and Empik export and offer flags on any product in the store."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T08:27:22.877Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a0a5259d-7340-48b5-a0cf-f68abdb21156?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/empik-for-woocommerce/tags/1.5.1/src/Wp_Admin/CSV/CSV_Ajax.php#L19"
},
{
"url": "https://plugins.trac.wordpress.org/browser/empik-for-woocommerce/tags/1.5.1/src/Wp_Admin/CSV/CSV_Ajax.php#L64"
},
{
"url": "https://plugins.trac.wordpress.org/browser/empik-for-woocommerce/tags/1.5.1/src/Wp_Admin/CSV/CSV_Ajax.php#L12"
},
{
"url": "https://plugins.trac.wordpress.org/browser/empik-for-woocommerce/tags/1.5.1/src/Wp_Admin/CSV/CSV_Import.php#L38"
},
{
"url": "https://plugins.trac.wordpress.org/browser/empik-for-woocommerce/tags/1.5.1/src/Wp_Admin/Products_List_Offers_import_Column.php#L29"
},
{
"url": "https://plugins.trac.wordpress.org/browser/empik-for-woocommerce/tags/1.5.1/src/Wp_Admin/Products_List_Product_import_Column.php#L28"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3592900%40empik-for-woocommerce\u0026new=3592900%40empik-for-woocommerce"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:57:52.000Z",
"value": "Disclosed"
}
],
"title": "Empik for Woocommerce \u003c= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-9766",
"datePublished": "2026-09-19T08:27:22.877Z",
"dateReserved": "2026-05-27T20:11:53.364Z",
"dateUpdated": "2026-09-19T13:51:19.217Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9289 (GCVE-0-2026-9289)
Vulnerability from cvelistv5 – Published: 2026-09-19 08:27 – Updated: 2026-09-19 13:51
VLAI
EPSS
VEX
Title
WordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints
Summary
The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes (jsonld/{id}, jsonld/http/{item_id}, jsonld/post-meta/{meta_key}, jsonld/meta/{meta_key}, and jsonld/{post_type}/{post_name}) with a permission_callback of '__return_true' and the downstream converter retrieving the post via get_post() without verifying the post status or the requesting user's capabilities. This makes it possible for unauthenticated attackers to read the title, content/description, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts by enumerating post IDs, bypassing WordPress core access controls.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:17 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wordlift | WordLift – AI powered SEO – Schema |
Affected:
0 , ≤ 3.54.10
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9289",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:17:34.628414Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T13:51:19.390Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WordLift \u2013 AI powered SEO \u2013 Schema",
"vendor": "wordlift",
"versions": [
{
"lessThanOrEqual": "3.54.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Benedictus Jovan (aillesiM)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WordLift \u2013 AI powered SEO \u2013 Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes (jsonld/{id}, jsonld/http/{item_id}, jsonld/post-meta/{meta_key}, jsonld/meta/{meta_key}, and jsonld/{post_type}/{post_name}) with a permission_callback of \u0027__return_true\u0027 and the downstream converter retrieving the post via get_post() without verifying the post status or the requesting user\u0027s capabilities. This makes it possible for unauthenticated attackers to read the title, content/description, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts by enumerating post IDs, bypassing WordPress core access controls."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T08:27:22.515Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/96d8da55-0706-42b6-8423-260f6138387d?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wordlift/tags/3.54.10/classes/jsonld/class-jsonld-endpoint.php#L131"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wordlift/tags/3.54.10/classes/jsonld/class-jsonld-endpoint.php#L57"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wordlift/tags/3.54.10/includes/class-wordlift-post-to-jsonld-converter.php#L81"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wordlift/tags/3.54.10/classes/jsonld/class-jsonld-by-id-endpoint.php#L112"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wordlift/tags/3.54.8/classes/jsonld/class-jsonld-endpoint.php#L131"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wordlift/tags/3.54.8/classes/jsonld/class-jsonld-endpoint.php#L57"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wordlift/tags/3.54.8/includes/class-wordlift-post-to-jsonld-converter.php#L81"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wordlift/tags/3.54.8/classes/jsonld/class-jsonld-by-id-endpoint.php#L112"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3597515%40wordlift\u0026new=3597515%40wordlift"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:56:54.000Z",
"value": "Disclosed"
}
],
"title": "WordLift \u003c= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-9289",
"datePublished": "2026-09-19T08:27:22.515Z",
"dateReserved": "2026-05-22T16:49:50.517Z",
"dateUpdated": "2026-09-19T13:51:19.390Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1255 (GCVE-0-2026-1255)
Vulnerability from cvelistv5 – Published: 2026-09-19 08:27 – Updated: 2026-09-19 13:51
VLAI
EPSS
VEX
Title
YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action
Summary
The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgen_get_captured_data' AJAX action being accessible to unauthenticated users. This makes it possible for unauthenticated attackers to retrieve all captured form submission data, including personally identifiable information (PII) such as names, email addresses, and message content submitted through YS LeadGen forms.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:17 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ysinnovations | YS LeadGen – Popup Builder, Popup Maker & Form Builder for WordPress | Lead Generation, Email Marketing, Sales, Conversions, Opt-Ins & Subscribers |
Affected:
0 , ≤ 2.1.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1255",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:17:43.110631Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T13:51:19.555Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "YS LeadGen \u2013 Popup Builder, Popup Maker \u0026 Form Builder for WordPress | Lead Generation, Email Marketing, Sales, Conversions, Opt-Ins \u0026 Subscribers",
"vendor": "ysinnovations",
"versions": [
{
"lessThanOrEqual": "2.1.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Athiwat Tiprasaharn (Jitlada)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the \u0027ysleadgen_get_captured_data\u0027 AJAX action being accessible to unauthenticated users. This makes it possible for unauthenticated attackers to retrieve all captured form submission data, including personally identifiable information (PII) such as names, email addresses, and message content submitted through YS LeadGen forms."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T08:27:22.176Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/66ca4e6a-e489-4c86-a9d4-1eb89c97cc1c?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ysleadgen/tags/1.1.1/app/Controllers/Ajax.php#L65"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3577391"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:45:55.000Z",
"value": "Disclosed"
}
],
"title": "YS LeadGen \u2013 Popups, Opt-ins \u0026 Lead Capture \u003c= 2.1.4 - Unauthenticated Information Disclosure in \u0027ysleadgen_get_captured_data\u0027 AJAX Action"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-1255",
"datePublished": "2026-09-19T08:27:22.176Z",
"dateReserved": "2026-01-20T19:42:52.022Z",
"dateUpdated": "2026-09-19T13:51:19.555Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18346 (GCVE-0-2026-18346)
Vulnerability from cvelistv5 – Published: 2026-09-19 08:27 – Updated: 2026-09-19 13:51
VLAI
EPSS
VEX
Title
TikTok <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter
Summary
The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stored TikTok integration access token in wp_options, hijacking the site's TikTok Business and product catalog integration. Successful exploitation requires the attacker to supply a valid TikTok OAuth auth_code issued for the merchant's registered TikTok app, as the plugin's token exchange must receive a message='OK' response from TikTok's API before the stored access token is overwritten.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:17 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tiktokbusinessplugin | TikTok |
Affected:
0 , ≤ 1.4.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18346",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:17:52.631463Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T13:51:19.729Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TikTok",
"vendor": "tiktokbusinessplugin",
"versions": [
{
"lessThanOrEqual": "1.4.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Hillary Mutai"
}
],
"descriptions": [
{
"lang": "en",
"value": "The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant\u0027s stored TikTok integration access token in wp_options, hijacking the site\u0027s TikTok Business and product catalog integration. Successful exploitation requires the attacker to supply a valid TikTok OAuth auth_code issued for the merchant\u0027s registered TikTok app, as the plugin\u0027s token exchange must receive a message=\u0027OK\u0027 response from TikTok\u0027s API before the stored access token is overwritten."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T08:27:21.808Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/31233f4e-4cd5-497f-9e8a-c65635596241?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tiktok-for-business/tags/1.4.0/admin/Tt4b_Menu_Class.php#L417"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tiktok-for-business/tags/1.4.0/admin/tt4b_menu.php#L13"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tiktok-for-business/tags/1.4.0/admin/Tt4b_Menu_Class.php#L397"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tiktok-for-business/tags/1.4.0/mapi/Tt4b_Mapi_Class.php#L332"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3699236%40tiktok-for-business\u0026new=3699236%40tiktok-for-business"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:51:26.000Z",
"value": "Disclosed"
}
],
"title": "TikTok \u003c= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via \u0027auth_code\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-18346",
"datePublished": "2026-09-19T08:27:21.808Z",
"dateReserved": "2026-07-29T22:33:17.256Z",
"dateUpdated": "2026-09-19T13:51:19.729Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8354 (GCVE-0-2026-8354)
Vulnerability from cvelistv5 – Published: 2026-09-19 08:27 – Updated: 2026-09-19 13:51
VLAI
EPSS
VEX
Title
Gum Addon for Elementor <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pop_tag' Widget Setting
Summary
The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pop_tag' parameter in all versions up to, and including, 1.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:18 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| celomitan | Gum Addon for Elementor |
Affected:
0 , ≤ 1.3.15
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8354",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:18:06.149349Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T13:51:19.907Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gum Addon for Elementor",
"vendor": "celomitan",
"versions": [
{
"lessThanOrEqual": "1.3.15",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Valatty"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027pop_tag\u0027 parameter in all versions up to, and including, 1.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T08:27:21.458Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/143c3a66-ac67-48e1-800f-8479fd963da3?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gum-elementor-addon/trunk/widgets/popover_btn.php#L767"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gum-elementor-addon/tags/1.3.15/widgets/popover_btn.php#L767"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gum-elementor-addon/trunk/widgets/popover_btn.php#L726"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gum-elementor-addon/tags/1.3.15/widgets/popover_btn.php#L726"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3556711%40gum-elementor-addon\u0026new=3556711%40gum-elementor-addon"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:58:44.000Z",
"value": "Disclosed"
}
],
"title": "Gum Addon for Elementor \u003c= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027pop_tag\u0027 Widget Setting"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-8354",
"datePublished": "2026-09-19T08:27:21.458Z",
"dateReserved": "2026-05-11T17:07:34.552Z",
"dateUpdated": "2026-09-19T13:51:19.907Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5410 (GCVE-0-2026-5410)
Vulnerability from cvelistv5 – Published: 2026-09-19 08:27 – Updated: 2026-09-19 13:51
VLAI
EPSS
VEX
Title
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input
Summary
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is due to insufficient input sanitization and output escaping. In the user_meta_save() function scalar values bypass the sanitization logic that only processes arrays, allowing the spinner field value to be stored in user meta without proper sanitization. Later, at line 56 of class-redux-spinner.php in the render() function, this value is rendered in an unquoted HTML attribute without escaping via '$data_string .= ' data-val=' . $this->value;'. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:17 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | Redux Framework |
Affected:
0 , ≤ 4.5.13
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5410",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:17:57.767016Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T13:51:20.094Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Redux Framework",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "4.5.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Luc Huynh from Noventiq RedTeam"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is due to insufficient input sanitization and output escaping. In the user_meta_save() function scalar values bypass the sanitization logic that only processes arrays, allowing the spinner field value to be stored in user meta without proper sanitization. Later, at line 56 of class-redux-spinner.php in the render() function, this value is rendered in an unquoted HTML attribute without escaping via \u0027$data_string .= \u0027 data-val=\u0027 . $this-\u003evalue;\u0027. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T08:27:20.952Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/116c57c2-6257-40b3-a838-194f8959be16?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/fields/spinner/class-redux-spinner.php#L56"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/fields/spinner/class-redux-spinner.php#L56"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/extensions/users/class-redux-extension-users.php#L1018"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/extensions/users/class-redux-extension-users.php#L1018"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3688279%40redux-framework%2Ftags%2F4.5.14\u0026old=3582185%40redux-framework%2Ftags%2F4.5.13"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3688279/redux-framework/trunk/redux-core/inc/extensions/users/class-redux-extension-users.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-02T07:19:19.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-18T19:55:15.000Z",
"value": "Disclosed"
}
],
"title": "Redux Framework \u003c= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-5410",
"datePublished": "2026-09-19T08:27:20.952Z",
"dateReserved": "2026-04-02T07:04:02.995Z",
"dateUpdated": "2026-09-19T13:51:20.094Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15098 (GCVE-0-2026-15098)
Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 13:51
VLAI
EPSS
VEX
Title
Real 3D Flipbook <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightboxtext' Shortcode Attribute
Summary
The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute (and other unsanitized attributes handled by on_shortcode()) in versions up to, and including, 5.1.1. This is due to insufficient input sanitization and output escaping in the on_shortcode() and print_global_options() functions: shortcode attribute values are copied verbatim into $this->flipbook_options and then emitted via wp_json_encode() inside a <script type="application/json"> block without the JSON_HEX_TAG flag, allowing a literal </script> byte sequence in the attribute value to break out of the JSON script context. Because WordPress's shortcode_parse_atts() applies stripcslashes() to attribute values, an attacker can encode the breakout tag as \x3c/script\x3e\x3cscript\x3e…\x3c/script\x3e, which survives the wp_kses_post save-time filter applied to Contributor content (the escape bytes are safe text characters, not HTML tags) and is decoded to real angle brackets at render time. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user (typically an Editor or Administrator previewing/moderating the pending post) accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:25 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| creativeinteractivemedia | Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder |
Affected:
0 , ≤ 5.1.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15098",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:25:50.121711Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T13:51:20.267Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Real3D Flipbook \u2013 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder",
"vendor": "creativeinteractivemedia",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027lightboxtext\u0027 shortcode attribute (and other unsanitized attributes handled by on_shortcode()) in versions up to, and including, 5.1.1. This is due to insufficient input sanitization and output escaping in the on_shortcode() and print_global_options() functions: shortcode attribute values are copied verbatim into $this-\u003eflipbook_options and then emitted via wp_json_encode() inside a \u003cscript type=\"application/json\"\u003e block without the JSON_HEX_TAG flag, allowing a literal \u003c/script\u003e byte sequence in the attribute value to break out of the JSON script context. Because WordPress\u0027s shortcode_parse_atts() applies stripcslashes() to attribute values, an attacker can encode the breakout tag as \\x3c/script\\x3e\\x3cscript\\x3e\u2026\\x3c/script\\x3e, which survives the wp_kses_post save-time filter applied to Contributor content (the escape bytes are safe text characters, not HTML tags) and is decoded to real angle brackets at render time. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user (typically an Editor or Administrator previewing/moderating the pending post) accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:21.282Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f6df3abe-ef27-46d7-bbdd-abd994fce132?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/real3d-flipbook-lite/tags/5.0/includes/Real3DFlipbook.php#L1668"
},
{
"url": "https://plugins.trac.wordpress.org/browser/real3d-flipbook-lite/tags/5.0/includes/Real3DFlipbook.php#L1468"
},
{
"url": "https://plugins.trac.wordpress.org/browser/real3d-flipbook-lite/tags/5.0/includes/Real3DFlipbook.php#L1224"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3643539%40real3d-flipbook-lite\u0026new=3643539%40real3d-flipbook-lite"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:23:09.000Z",
"value": "Disclosed"
}
],
"title": "Real 3D Flipbook \u003c= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027lightboxtext\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15098",
"datePublished": "2026-09-19T07:43:21.282Z",
"dateReserved": "2026-07-08T16:39:13.879Z",
"dateUpdated": "2026-09-19T13:51:20.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87917 (GCVE-0-2026-87917)
Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 13:51
VLAI
EPSS
VEX
Title
MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag
Summary
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:25 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| dvankooten | MC4WP: Mailchimp for WordPress |
Affected:
0 , ≤ 4.14.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87917",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:25:27.729206Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T13:51:20.441Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MC4WP: Mailchimp for WordPress",
"vendor": "dvankooten",
"versions": [
{
"lessThanOrEqual": "4.14.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "nism0"
}
],
"descriptions": [
{
"lang": "en",
"value": "The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via \u0027data\u0027 Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:20.939Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ee4f837a-d0b5-48df-8c96-2a294985612e?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.14.0/includes/class-dynamic-content-tags.php#L127"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.14.0/includes/forms/class-form-tags.php#L57"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.14.0/includes/forms/class-form-tags.php#L109"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3689679%40mailchimp-for-wp%2Ftags%2F4.14.1\u0026old=3655905%40mailchimp-for-wp%2Ftags%2F4.14.0"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3698084%40mailchimp-for-wp%2Ftags%2F4.14.1\u0026old=3655905%40mailchimp-for-wp%2Ftags%2F4.14.0"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-09T16:11:41.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-18T18:54:30.000Z",
"value": "Disclosed"
}
],
"title": "MC4WP: Mailchimp for WordPress \u003c= 4.14.0 - Reflected Cross-Site Scripting via \u0027data\u0027 Dynamic Content Tag"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-87917",
"datePublished": "2026-09-19T07:43:20.939Z",
"dateReserved": "2026-09-09T15:56:01.475Z",
"dateUpdated": "2026-09-19T13:51:20.441Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1984 (GCVE-0-2026-1984)
Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 13:51
VLAI
EPSS
VEX
Title
Ibtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action
Summary
The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepa_use_gt_editor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update or delete arbitrary post meta entries via the 'iepa_builder' meta key.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:25 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vowelweb | Ibtana – Ecommerce Product Addons |
Affected:
0 , ≤ 0.4.7.7
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1984",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:25:35.955700Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T13:51:20.591Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Ibtana \u2013 Ecommerce Product Addons",
"vendor": "vowelweb",
"versions": [
{
"lessThanOrEqual": "0.4.7.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Legion Hunter"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Ibtana \u2013 Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the \u0027iepa_use_gt_editor\u0027 AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update or delete arbitrary post meta entries via the \u0027iepa_builder\u0027 meta key."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:20.585Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e1e20253-4002-467a-9dca-10bc2bfe4514?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ibtana-ecommerce-product-addons/trunk/inc/class-pro.php#L58"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ibtana-ecommerce-product-addons/tags/0.4.7.5/inc/class-pro.php#L58"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ibtana-ecommerce-product-addons/trunk/inc/class-pro.php#L25"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3587239%40ibtana-ecommerce-product-addons\u0026new=3587239%40ibtana-ecommerce-product-addons"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:03:38.000Z",
"value": "Disclosed"
}
],
"title": "Ibtana \u2013 Ecommerce Product Addons \u003c= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via \u0027iepa_use_gt_editor\u0027 AJAX Action"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-1984",
"datePublished": "2026-09-19T07:43:20.585Z",
"dateReserved": "2026-02-05T14:54:33.493Z",
"dateUpdated": "2026-09-19T13:51:20.591Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9855 (GCVE-0-2026-9855)
Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 13:51
VLAI
EPSS
VEX
Title
Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter
Summary
The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'post_ID' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The capability check via current_user_can('edit_post', $id) is bypassable because WordPress internally casts $id to an integer for the permission evaluation while the full unsanitized string is preserved and passed to the SQL sink, and a valid nonce — which is also required — can be legitimately obtained by any Contributor-level user from the post edit screen.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:25 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hiroaki-miyashita | Custom Field Template |
Affected:
0 , ≤ 2.7.8
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9855",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:25:43.839923Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T13:51:20.741Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Custom Field Template",
"vendor": "hiroaki-miyashita",
"versions": [
{
"lessThanOrEqual": "2.7.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Luc Huynh from Noventiq RedTeam"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the \u0027post_ID\u0027 parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The capability check via current_user_can(\u0027edit_post\u0027, $id) is bypassable because WordPress internally casts $id to an integer for the permission evaluation while the full unsanitized string is preserved and passed to the SQL sink, and a valid nonce \u2014 which is also required \u2014 can be legitimately obtained by any Contributor-level user from the post edit screen."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:20.235Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ce924708-935a-45c0-8959-dd122632cef4?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.8/custom-field-template.php#L4442"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.8/custom-field-template.php#L3353"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.8/custom-field-template.php#L3479"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.8/custom-field-template.php#L105"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.7/custom-field-template.php#L4442"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.7/custom-field-template.php#L3353"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.7/custom-field-template.php#L3479"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.7/custom-field-template.php#L105"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3589466%40custom-field-template\u0026new=3589466%40custom-field-template"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T18:50:05.000Z",
"value": "Disclosed"
}
],
"title": "Custom Field Template \u003c= 2.7.8 - Authenticated (Contributor+) SQL Injection via \u0027post_ID\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-9855",
"datePublished": "2026-09-19T07:43:20.235Z",
"dateReserved": "2026-05-28T15:31:05.357Z",
"dateUpdated": "2026-09-19T13:51:20.741Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5400 (GCVE-0-2026-5400)
Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 13:51
VLAI
EPSS
VEX
Title
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input
Summary
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter values in versions up to, and including, 4.5.13 This is due to insufficient input sanitization of nested array values in the user_meta_save() function and unsafe output of filter CSS values in the render() function without proper escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:25 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | Redux Framework |
Affected:
0 , ≤ 4.5.13
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5400",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:25:56.982054Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T13:51:20.891Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Redux Framework",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "4.5.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "h0xilo"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter values in versions up to, and including, 4.5.13 This is due to insufficient input sanitization of nested array values in the user_meta_save() function and unsafe output of filter CSS values in the render() function without proper escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:19.874Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca5b1ff6-19c5-4384-ae63-faf1f40122e7?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/fields/media/class-redux-media.php#L233"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/fields/media/class-redux-media.php#L233"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/fields/media/class-redux-media.php#L337"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/fields/media/class-redux-media.php#L337"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/extensions/users/class-redux-extension-users.php#L1034"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/extensions/users/class-redux-extension-users.php#L1034"
},
{
"url": "https://github.com/reduxframework/redux-framework/pull/4112/changes"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3688279%40redux-framework%2Ftags%2F4.5.14\u0026old=3582185%40redux-framework%2Ftags%2F4.5.13"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3688279/redux-framework/trunk/redux-core/inc/fields/media/class-redux-media.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-02T06:50:46.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-18T19:01:22.000Z",
"value": "Disclosed"
}
],
"title": "Redux Framework \u003c= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-5400",
"datePublished": "2026-09-19T07:43:19.874Z",
"dateReserved": "2026-04-02T06:29:52.259Z",
"dateUpdated": "2026-09-19T13:51:20.891Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7527 (GCVE-0-2026-7527)
Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 14:01
VLAI
EPSS
VEX
Title
WP Ghost (Hide My WP Ghost) <= 7.0.02 - Unauthenticated Open Redirect via 'redirect_to' Parameter
Summary
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is due to the plugin not properly validating user input. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into clicking on a specially crafted link. Exploitation requires tricking a logged-in user into clicking a crafted logout URL; the victim is fully logged out via wp_logout() before the malicious redirect is issued, making the logout irreversible as part of the attack chain.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:26 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| johndarrel | Hide My WP Ghost – Security & Firewall |
Affected:
0 , ≤ 7.0.02
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7527",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:26:08.743717Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T14:01:21.774Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Hide My WP Ghost \u2013 Security \u0026 Firewall",
"vendor": "johndarrel",
"versions": [
{
"lessThanOrEqual": "7.0.02",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "s00me00ne"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP Ghost (Hide My WP Ghost) \u2013 Security \u0026 Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is due to the plugin not properly validating user input. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into clicking on a specially crafted link. Exploitation requires tricking a logged-in user into clicking a crafted logout URL; the victim is fully logged out via wp_logout() before the malicious redirect is issued, making the logout irreversible as part of the attack chain."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:19.540Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bd88ebd2-5584-4886-9c85-39a225cd00e9?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hide-my-wp/trunk/models/Rewrite.php#L1684"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hide-my-wp/tags/7.0.01/models/Rewrite.php#L1684"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hide-my-wp/trunk/models/Rewrite.php#L1679"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hide-my-wp/tags/7.0.01/models/Rewrite.php#L1679"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hide-my-wp/tags/5.5.02/models/Rewrite.php#L1684"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hide-my-wp/tags/5.5.02/models/Rewrite.php#L1679"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3556343"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:00:36.000Z",
"value": "Disclosed"
}
],
"title": "WP Ghost (Hide My WP Ghost) \u003c= 7.0.02 - Unauthenticated Open Redirect via \u0027redirect_to\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-7527",
"datePublished": "2026-09-19T07:43:19.540Z",
"dateReserved": "2026-04-30T17:29:33.893Z",
"dateUpdated": "2026-09-19T14:01:21.774Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85658 (GCVE-0-2026-85658)
Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 14:01
VLAI
EPSS
VEX
Title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)
Summary
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.17.2 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:26 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| properfraction | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress |
Affected:
0 , ≤ 4.17.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85658",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:26:03.166997Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T14:01:21.938Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile \u0026 Restrict Content \u2013 ProfilePress",
"vendor": "properfraction",
"versions": [
{
"lessThanOrEqual": "4.17.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Md. Moniruzzaman Prodhan (NomanProdhan)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile \u0026 Restrict Content \u2013 ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.17.2 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:19.179Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b8486d1d-8a76-446e-867b-8db32499ebf8?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.2/src/ShortcodeParser/Builder/FrontendProfileBuilder.php#L339"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.2/src/ShortcodeParser/FrontendProfileTag.php#L133"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.2/src/Themes/DragDrop/ProfileFieldListing.php#L146"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.2/src/Classes/EditUserProfile.php#L337"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.2/src/Functions/GlobalFunctions.php#L1715"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3682619%40wp-user-avatar%2Ftags%2F4.17.3\u0026old=3666803%40wp-user-avatar%2Ftags%2F4.17.2"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3682604/wp-user-avatar/trunk/src/ShortcodeParser/Builder/FrontendProfileBuilder.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-04T13:49:00.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-18T18:58:39.000Z",
"value": "Disclosed"
}
],
"title": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile \u0026 Restrict Content \u003c= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via \u0027eup_bio\u0027 Biography Field (Entity-Encoded Shortcode Bracket)"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-85658",
"datePublished": "2026-09-19T07:43:19.179Z",
"dateReserved": "2026-09-04T13:29:07.249Z",
"dateUpdated": "2026-09-19T14:01:21.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12402 (GCVE-0-2026-12402)
Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 14:01
VLAI
EPSS
VEX
Title
OTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting
Summary
The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and including, 2.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. On multisite installations where administrators do not hold the unfiltered_html capability, this vulnerability can be leveraged to target the network super administrator.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:26 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| xootix | OTP Login & Register Woocommerce |
Affected:
0 , ≤ 2.7.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12402",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:26:17.710763Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T14:01:22.108Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OTP Login \u0026 Register Woocommerce",
"vendor": "xootix",
"versions": [
{
"lessThanOrEqual": "2.7.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Luca Jungnickel"
}
],
"descriptions": [
{
"lang": "en",
"value": "The OTP Login \u0026 Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027fb-config\u0027 Setting in all versions up to, and including, 2.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. On multisite installations where administrators do not hold the unfiltered_html capability, this vulnerability can be leveraged to target the network super administrator."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:18.822Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ab4bfd2f-6277-47d6-80ac-957b93476ed1?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mobile-login-woocommerce/tags/2.7.2/includes/class-xoo-ml-frontend.php#L153"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mobile-login-woocommerce/tags/2.7.2/includes/xoo-framework/admin/class-xoo-admin-settings.php#L306"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mobile-login-woocommerce/tags/2.7.2/includes/xoo-framework/admin/class-xoo-admin-settings.php#L411"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3682327%40mobile-login-woocommerce\u0026new=3682327%40mobile-login-woocommerce"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-01T16:51:17.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-18T19:17:18.000Z",
"value": "Disclosed"
}
],
"title": "OTP Login \u0026 Register Woocommerce \u003c= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via \u0027fb-config\u0027 Setting"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12402",
"datePublished": "2026-09-19T07:43:18.822Z",
"dateReserved": "2026-06-16T13:37:28.167Z",
"dateUpdated": "2026-09-19T14:01:22.108Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75959 (GCVE-0-2026-75959)
Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 14:01
VLAI
EPSS
VEX
Title
GoPay for WooCommerce <= 1.0.36 - Authenticated (Shop Manager+) SQL Injection via 'log_table_filter' Parameter
Summary
The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'log_table_filter' parameter in all versions up to, and including, 1.0.36 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:39 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| gopayplugins | GoPay for WooCommerce |
Affected:
0 , ≤ 1.0.36
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75959",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:39:17.519869Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T14:01:22.276Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "GoPay for WooCommerce",
"vendor": "gopayplugins",
"versions": [
{
"lessThanOrEqual": "1.0.36",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the \u0027log_table_filter\u0027 parameter in all versions up to, and including, 1.0.36 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:18.486Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aa27c758-f02b-4120-bf66-b310720161b4?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gopay-gateway/tags/1.0.33/admin/views/log.php#L16"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gopay-gateway/tags/1.0.33/admin/views/log.php#L35"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gopay-gateway/tags/1.0.33/admin/views/log.php#L13"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gopay-gateway/tags/1.0.33/admin/class-gopay-gateway-admin.php#L83"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:09:45.000Z",
"value": "Disclosed"
}
],
"title": "GoPay for WooCommerce \u003c= 1.0.36 - Authenticated (Shop Manager+) SQL Injection via \u0027log_table_filter\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-75959",
"datePublished": "2026-09-19T07:43:18.486Z",
"dateReserved": "2026-08-18T16:29:29.890Z",
"dateUpdated": "2026-09-19T14:01:22.276Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13200 (GCVE-0-2026-13200)
Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 14:01
VLAI
EPSS
VEX
Title
Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parameter
Summary
The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable advanced-filter SQL branch is only entered when at least one of the following parameters is present in the request: linked_posts, created_after, created_before, missing_fields, post_id, a comma-separated type value, or exclude_type.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:39 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mischiefmarmot | Create |
Affected:
0 , ≤ 2.5.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13200",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:39:24.380502Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T14:01:22.473Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Create",
"vendor": "mischiefmarmot",
"versions": [
{
"lessThanOrEqual": "2.5.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Create plugin for WordPress is vulnerable to generic SQL Injection via the \u0027order\u0027 parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable advanced-filter SQL branch is only entered when at least one of the following parameters is present in the request: linked_posts, created_after, created_before, missing_fields, post_id, a comma-separated type value, or exclude_type."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:18.150Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9279e01d-53b8-4816-b405-0db2f984cb5a?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mediavine-create/tags/2.5.2/lib/creations/class-creations-api.php#L334"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mediavine-create/tags/2.5.2/lib/creations/class-creations-api.php#L329"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mediavine-create/tags/2.5.2/lib/db-interface/class-mv-dbi.php#L1022"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3627606%40mediavine-create\u0026new=3627606%40mediavine-create"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:11:33.000Z",
"value": "Disclosed"
}
],
"title": "Create \u003c= 2.5.3 - Authenticated (Author+) SQL Injection via \u0027order\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-13200",
"datePublished": "2026-09-19T07:43:18.150Z",
"dateReserved": "2026-06-24T13:56:57.028Z",
"dateUpdated": "2026-09-19T14:01:22.473Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1641 (GCVE-0-2026-1641)
Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 14:01
VLAI
EPSS
VEX
Title
Wow Elements Addons for Elementor <= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting
Summary
The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.11.2. This is due to the plugin passing user-controlled input from the 'Changelog File' setting directly to the wp_remote_get function without adequate validation or sanitization of the URL. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:23 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wowelements | Wow Elements Addons for Elementor |
Affected:
0 , ≤ 1.11.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1641",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:23:12.285133Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T14:01:22.660Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Wow Elements Addons for Elementor",
"vendor": "wowelements",
"versions": [
{
"lessThanOrEqual": "1.11.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Athiwat Tiprasaharn (Jitlada)"
},
{
"lang": "en",
"type": "finder",
"value": "Itthidej Aramsri (Boeing777)"
},
{
"lang": "en",
"type": "finder",
"value": "Waris Damkham"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.11.2. This is due to the plugin passing user-controlled input from the \u0027Changelog File\u0027 setting directly to the wp_remote_get function without adequate validation or sanitization of the URL. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:17.803Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8ded7bd6-3dd8-4659-9704-f197e7c2f941?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wow-elements-addons-for-elementor/trunk/includes/widgets/changelog.php#L786"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wow-elements-addons-for-elementor/tags/1.5.6/includes/widgets/changelog.php#L786"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3583568%40wow-elements-addons-for-elementor\u0026new=3583568%40wow-elements-addons-for-elementor"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:31:31.000Z",
"value": "Disclosed"
}
],
"title": "Wow Elements Addons for Elementor \u003c= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-1641",
"datePublished": "2026-09-19T07:43:17.803Z",
"dateReserved": "2026-01-29T18:17:44.069Z",
"dateUpdated": "2026-09-19T14:01:22.660Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2422 (GCVE-0-2026-2422)
Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 14:01
VLAI
EPSS
VEX
Title
WP Composer <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode
Summary
The WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pbwp_raw_shortcode' shortcode in all versions up to, and including, 1.0.5. This is due to the shortcode handler decoding Base64-encoded content and outputting it directly without any sanitization or escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The Base64 encoding allows the payload to bypass WordPress's KSES content filtering at save time, since the encoded string contains no harmful HTML characters.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:23 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ghozylab | WP Composer – The Easiest Page Builder |
Affected:
0 , ≤ 1.0.5
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2422",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:23:18.204757Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T14:01:22.841Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP Composer \u2013 The Easiest Page Builder",
"vendor": "ghozylab",
"versions": [
{
"lessThanOrEqual": "1.0.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Athiwat Tiprasaharn (Jitlada)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP Composer \u2013 The Easiest Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027pbwp_raw_shortcode\u0027 shortcode in all versions up to, and including, 1.0.5. This is due to the shortcode handler decoding Base64-encoded content and outputting it directly without any sanitization or escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The Base64 encoding allows the payload to bypass WordPress\u0027s KSES content filtering at save time, since the encoded string contains no harmful HTML characters."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:17.436Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7e328f1d-687d-424f-aab7-343bcece90cd?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/page-builder-wp/tags/1.0.5/inc/global/wpc-helpers.php#L3578"
},
{
"url": "https://plugins.trac.wordpress.org/browser/page-builder-wp/trunk/inc/global/wpc-helpers.php#L3578"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3482357%40page-builder-wp\u0026new=3482357%40page-builder-wp"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:18:29.000Z",
"value": "Disclosed"
}
],
"title": "WP Composer \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027pbwp_raw_shortcode\u0027 Shortcode"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-2422",
"datePublished": "2026-09-19T07:43:17.436Z",
"dateReserved": "2026-02-12T20:16:29.208Z",
"dateUpdated": "2026-09-19T14:01:22.841Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4327 (GCVE-0-2026-4327)
Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 14:01
VLAI
EPSS
VEX
Title
The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter
Summary
The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twiz_ajax_callback AJAX action's 'savesection' handler combined with the use of eval() to execute user-supplied 'custom logic' code on the frontend. The AJAX handler at twiz-ajax.php verifies a nonce but performs no current_user_can() capability check for the ACTION_SAVE_SECTION case. Furthermore, the nonce is exposed to any authenticated user through the directly-accessible twiz-ajax.js.php file which loads WordPress and outputs the nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP code via the twiz_custom_logic POST parameter when saving a section with output choice 'twiz_logic_output'.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:23 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
12 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sebwordpress | The Welcomizer |
Affected:
0 , ≤ 2.8.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4327",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:23:25.810413Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T14:01:23.048Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "The Welcomizer",
"vendor": "sebwordpress",
"versions": [
{
"lessThanOrEqual": "2.8.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nabil Irawan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twiz_ajax_callback AJAX action\u0027s \u0027savesection\u0027 handler combined with the use of eval() to execute user-supplied \u0027custom logic\u0027 code on the frontend. The AJAX handler at twiz-ajax.php verifies a nonce but performs no current_user_can() capability check for the ACTION_SAVE_SECTION case. Furthermore, the nonce is exposed to any authenticated user through the directly-accessible twiz-ajax.js.php file which loads WordPress and outputs the nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP code via the twiz_custom_logic POST parameter when saving a section with output choice \u0027twiz_logic_output\u0027."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:17.077Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/73fb7102-66ff-4309-a98f-bbbfd3ddbba6?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/trunk/includes/twiz.output.class.php#L828"
},
{
"url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/tags/2.8.1/includes/twiz.output.class.php#L828"
},
{
"url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/trunk/twiz-ajax.php#L148"
},
{
"url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/tags/2.8.1/twiz-ajax.php#L148"
},
{
"url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/trunk/includes/twiz.menu.class.php#L265"
},
{
"url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/tags/2.8.1/includes/twiz.menu.class.php#L265"
},
{
"url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/trunk/includes/twiz.menu.class.php#L507"
},
{
"url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/tags/2.8.1/includes/twiz.menu.class.php#L507"
},
{
"url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/trunk/includes/twiz.menu.class.php#L580"
},
{
"url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/tags/2.8.1/includes/twiz.menu.class.php#L580"
},
{
"url": "https://plugins.trac.wordpress.org/log/the-welcomizer/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:27:36.000Z",
"value": "Disclosed"
}
],
"title": "The Welcomizer \u003c= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via \u0027twiz_custom_logic\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-4327",
"datePublished": "2026-09-19T07:43:17.077Z",
"dateReserved": "2026-03-17T13:16:03.389Z",
"dateUpdated": "2026-09-19T14:01:23.048Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9232 (GCVE-0-2026-9232)
Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 14:01
VLAI
EPSS
VEX
Title
Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action
Summary
The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handle_customers_ajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset from the ea_customers table, including personally identifiable information such as names, email addresses, mobile numbers, dates of birth, and physical addresses.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:23 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| easyappointments | Easy Appointments |
Affected:
0 , ≤ 3.12.27
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9232",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:23:31.157740Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T14:01:23.219Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Easy Appointments",
"vendor": "easyappointments",
"versions": [
{
"lessThanOrEqual": "3.12.27",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ryoma Nishioka"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handle_customers_ajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset from the ea_customers table, including personally identifiable information such as names, email addresses, mobile numbers, dates of birth, and physical addresses."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:16.696Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6b9322d5-afa0-4f38-b5df-2344310f4119?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.25/src/ajax.php#L2656"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.25/src/ajax.php#L183"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.25/src/ajax.php#L115"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.22/src/ajax.php#L2656"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.22/src/ajax.php#L183"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.22/src/ajax.php#L115"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3595856"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T18:53:57.000Z",
"value": "Disclosed"
}
],
"title": "Easy Appointments \u003c= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-9232",
"datePublished": "2026-09-19T07:43:16.696Z",
"dateReserved": "2026-05-21T18:37:43.510Z",
"dateUpdated": "2026-09-19T14:01:23.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15463 (GCVE-0-2026-15463)
Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 14:01
VLAI
EPSS
VEX
Title
SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' and 'host' Parameters
Summary
The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is only exploitable when in the system_requirements stage.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:23 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sslzen | SSL Zen — SSL Certificate Installer & HTTPS Redirects |
Affected:
0 , ≤ 4.7.42
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15463",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:23:37.166546Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T14:01:23.380Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SSL Zen \u2014 SSL Certificate Installer \u0026 HTTPS Redirects",
"vendor": "sslzen",
"versions": [
{
"lessThanOrEqual": "4.7.42",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The SSL Zen \u2014 SSL Certificate Installer \u0026 HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u0027host\u0027 parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is only exploitable when in the system_requirements stage."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:16.326Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5e392d3c-4a3d-4b5b-a149-70c9b58dca1a?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ssl-zen/tags/4.7.41/ssl_zen/classes/class.ssl_zen_messages.php#L44"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ssl-zen/tags/4.7.41/ssl_zen/classes/class.ssl_zen_admin.php#L863"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3701590%40ssl-zen\u0026new=3701590%40ssl-zen"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:26:09.000Z",
"value": "Disclosed"
}
],
"title": "SSL Zen \u003c= 4.7.42 - Reflected Cross-Site Scripting via \u0027uri\u0027 and \u0027host\u0027 Parameters"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15463",
"datePublished": "2026-09-19T07:43:16.326Z",
"dateReserved": "2026-07-10T20:16:25.137Z",
"dateUpdated": "2026-09-19T14:01:23.380Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15946 (GCVE-0-2026-15946)
Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 14:01
VLAI
EPSS
VEX
Title
Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function
Summary
The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.23. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the whitelabel settings password to an attacker-controlled value, enabling them to unlock whitelabel-protected admin settings tabs including whitelabel, general, and advanced configuration.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:23 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| shahrukhlinkgraph | Search Atlas SEO – OTTO AI SEO Automation for WordPress |
Affected:
0 , ≤ 2.6.23
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15946",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:23:48.641031Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T14:01:23.525Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Search Atlas SEO \u2013 OTTO AI SEO Automation for WordPress",
"vendor": "shahrukhlinkgraph",
"versions": [
{
"lessThanOrEqual": "2.6.23",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Search Atlas SEO \u2013 Premier SEO Plugin for One-Click WP Publishing \u0026 Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.23. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the whitelabel settings password to an attacker-controlled value, enabling them to unlock whitelabel-protected admin settings tabs including whitelabel, general, and advanced configuration."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:15.963Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/56d839b0-b29d-4299-af77-1ce97a5925f6?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/metasync/tags/2.6.16/includes/class-metasync-connect-manager.php#L1049"
},
{
"url": "https://plugins.trac.wordpress.org/browser/metasync/tags/2.6.17/includes/class-metasync-connect-manager.php#L1049"
},
{
"url": "https://plugins.trac.wordpress.org/browser/metasync/tags/2.6.17/includes/class-metasync-settings-registration.php#L96"
},
{
"url": "https://plugins.trac.wordpress.org/browser/metasync/tags/2.6.17/admin/class-metasync-admin.php#L215"
},
{
"url": "https://plugins.trac.wordpress.org/browser/metasync/tags/2.6.16/includes/class-metasync-settings-registration.php#L96"
},
{
"url": "https://plugins.trac.wordpress.org/browser/metasync/tags/2.6.16/admin/class-metasync-admin.php#L215"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3676919"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:16:13.000Z",
"value": "Disclosed"
}
],
"title": "Search Atlas SEO \u003c= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15946",
"datePublished": "2026-09-19T07:43:15.963Z",
"dateReserved": "2026-07-16T12:57:00.242Z",
"dateUpdated": "2026-09-19T14:01:23.525Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6295 (GCVE-0-2026-6295)
Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 14:01
VLAI
EPSS
VEX
Title
WP Optimizer <= 2.5.0 - Authenticated (Administrator+) SQL Injection via 's' Parameter
Summary
The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parse_key_compare_field() method that, when the user-supplied value matches the regex ^[(\s]*SELECT\s+, wraps the value in parentheses and embeds it directly into the SQL string without any escaping or quoting. While the normal LIKE code path correctly uses esc_sql($wpdb->esc_like(...)) and wraps the value in single quotes, this branch completely bypasses those protections. Because the attack payload (SELECT ...) contains no single quotes, WordPress's wp_magic_quotes() provides no protection. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary SQL subqueries — including time-based blind payloads — that can be used to extract sensitive information from the database.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:23 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sh1zen | WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals |
Affected:
0 , ≤ 2.5.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6295",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:23:44.016400Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T14:01:23.686Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP Optimizer \u2013 PageSpeed, Cache, Minify \u0026 Core Web Vitals",
"vendor": "sh1zen",
"versions": [
{
"lessThanOrEqual": "2.5.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "san6051"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the \u0027s\u0027 parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parse_key_compare_field() method that, when the user-supplied value matches the regex ^[(\\s]*SELECT\\s+, wraps the value in parentheses and embeds it directly into the SQL string without any escaping or quoting. While the normal LIKE code path correctly uses esc_sql($wpdb-\u003eesc_like(...)) and wraps the value in single quotes, this branch completely bypasses those protections. Because the attack payload (SELECT ...) contains no single quotes, WordPress\u0027s wp_magic_quotes() provides no protection. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary SQL subqueries \u2014 including time-based blind payloads \u2014 that can be used to extract sensitive information from the database."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:15.623Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4da302ab-8a5d-481b-8b28-a798e0982893?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimizer/trunk/vendors/wps-framework/Query.class.php#L455"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimizer/tags/2.3.8/vendors/wps-framework/Query.class.php#L455"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimizer/trunk/modules/supporters/activity-log/ActivityLog_Table.class.php#L343"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimizer/tags/2.3.8/modules/supporters/activity-log/ActivityLog_Table.class.php#L343"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3508033"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:42:56.000Z",
"value": "Disclosed"
}
],
"title": "WP Optimizer \u003c= 2.5.0 - Authenticated (Administrator+) SQL Injection via \u0027s\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-6295",
"datePublished": "2026-09-19T07:43:15.623Z",
"dateReserved": "2026-04-14T18:07:55.496Z",
"dateUpdated": "2026-09-19T14:01:23.686Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13191 (GCVE-0-2026-13191)
Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 14:01
VLAI
EPSS
VEX
Title
Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order_by' Parameter
Summary
The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The REST endpoint permission callback defaults to the publish_posts capability, meaning any Author-level user or above can reach the vulnerable code path without any additional preconditions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:23 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mischiefmarmot | Create |
Affected:
0 , ≤ 2.5.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13191",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:23:56.695986Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T14:01:23.837Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Create",
"vendor": "mischiefmarmot",
"versions": [
{
"lessThanOrEqual": "2.5.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Create plugin for WordPress is vulnerable to generic SQL Injection via the \u0027order_by\u0027 parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The REST endpoint permission callback defaults to the publish_posts capability, meaning any Author-level user or above can reach the vulnerable code path without any additional preconditions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:15.277Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/46fa99f1-9152-4130-a5b1-2ea10032069b?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mediavine-create/tags/2.5.2/lib/db-interface/class-mv-dbi.php#L1183"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mediavine-create/tags/2.5.2/lib/db-interface/class-mv-dbi.php#L1646"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mediavine-create/tags/2.5.2/lib/db-interface/class-mv-dbi.php#L1586"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mediavine-create/tags/2.5.2/lib/class-api-services.php#L191"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mediavine-create/tags/2.5.2/lib/products/class-products.php#L533"
},
{
"url": "https://plugins.trac.wordpress.org/browser/mediavine-create/tags/2.5.2/lib/class-permissions.php#L22"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3627606%40mediavine-create\u0026new=3627606%40mediavine-create"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:11:05.000Z",
"value": "Disclosed"
}
],
"title": "Create \u003c= 2.5.3 - Authenticated (Author+) SQL Injection via \u0027order_by\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-13191",
"datePublished": "2026-09-19T07:43:15.277Z",
"dateReserved": "2026-06-24T13:46:43.873Z",
"dateUpdated": "2026-09-19T14:01:23.837Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13770 (GCVE-0-2026-13770)
Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 14:01
VLAI
EPSS
VEX
Title
AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler
Summary
The AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via save_ams_license_key AJAX Handler in all versions up to, and including, 3.15.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save_ams_license_key AJAX handler performs no capability check and no nonce verification, meaning any authenticated user with Subscriber-level access or above can invoke it to store the malicious payload.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:24 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| appmysite | AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) |
Affected:
0 , ≤ 3.15.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13770",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:24:12.263777Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T14:01:23.998Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AppMySite \u2013 WordPress \u0026 WooCommerce Mobile App Builder (No-Code Android \u0026 iOS App Maker)",
"vendor": "appmysite",
"versions": [
{
"lessThanOrEqual": "3.15.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mitchell"
}
],
"descriptions": [
{
"lang": "en",
"value": "The AppMySite \u2013 WordPress \u0026 WooCommerce Mobile App Builder (No-Code Android \u0026 iOS App Maker) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via save_ams_license_key AJAX Handler in all versions up to, and including, 3.15.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save_ams_license_key AJAX handler performs no capability check and no nonce verification, meaning any authenticated user with Subscriber-level access or above can invoke it to store the malicious payload."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:14.910Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/34c573f4-bc21-4a5f-a44a-779c523c3212?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/appmysite/tags/3.15.3/includes/views/ams-home.php#L125"
},
{
"url": "https://plugins.trac.wordpress.org/browser/appmysite/tags/3.15.3/includes/class-ams-admin-functions.php#L67"
},
{
"url": "https://plugins.trac.wordpress.org/browser/appmysite/tags/3.15.3/includes/class-ams-admin-functions.php#L34"
},
{
"url": "https://plugins.trac.wordpress.org/browser/appmysite/tags/3.15.3/includes/views/ams-home.php#L222"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3635325%40appmysite\u0026new=3635325%40appmysite"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T18:48:37.000Z",
"value": "Disclosed"
}
],
"title": "AppMySite \u003c= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-13770",
"datePublished": "2026-09-19T07:43:14.910Z",
"dateReserved": "2026-06-29T20:53:55.766Z",
"dateUpdated": "2026-09-19T14:01:23.998Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1242 (GCVE-0-2026-1242)
Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 14:01
VLAI
EPSS
VEX
Title
BlockSpare - Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation
Summary
The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND (&&) operator instead of an OR (||) operator. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass authorization checks and create arbitrary posts.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:24 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| blockspare | BlockSpare – Gutenberg Blocks for News, Magazine, Blog & Business Websites |
Affected:
0 , ≤ 4.2.6
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1242",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:24:02.142885Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T14:01:24.156Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "BlockSpare \u2013 Gutenberg Blocks for News, Magazine, Blog \u0026 Business Websites",
"vendor": "blockspare",
"versions": [
{
"lessThanOrEqual": "4.2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Osvaldo Noe Gonzalez Del Rio (Os)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND (\u0026\u0026) operator instead of an OR (||) operator. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass authorization checks and create arbitrary posts."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:14.563Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2e1bbaa2-5bb3-442e-b4a8-96db98500e7b?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/blockspare/tags/3.3.0/inc/layout/save-templates.php#L9"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:07:44.000Z",
"value": "Disclosed"
}
],
"title": "BlockSpare - Gutenberg Site Builder Blocks \u0026 Starter Sites \u003c= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-1242",
"datePublished": "2026-09-19T07:43:14.563Z",
"dateReserved": "2026-01-20T18:43:48.857Z",
"dateUpdated": "2026-09-19T14:01:24.156Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}