CVE-2026-109150

WP PageNavi Style <= 1.4 - Stored XSS via CSRF

The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is then executed in the browser of everyone who visits the site's front end.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wp Page Navi Style

CVE-2026-110525

MCB Stats <= 1.0.0 - Unauthenticated Stored XSS via User-Agent

The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that executes in an administrator's browser session when the statistics page is viewed.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Mcb

CVE-2026-114427

GutenKit 2.5.0 - 2.5.4 - Author+ Stored XSS via Page Settings Custom CSS

The GutenKit WordPress plugin before 2.5.5 does not properly sanitize custom CSS saved against a post before printing it inside an inline style block on the published page, allowing users with the Author role and above to break out of the style element and store JavaScript that executes in the browser of any visitor who views the post. Exploitation affects sites running WordPress below 7.0.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Gutenkit

CVE-2026-92396

Blocks for ShopEngine < 2.4.4 - Contributor+ Stored XSS via gutenova_store_css

The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users with a role as low as contributor to inject arbitrary scripts into any post that will run when a higher privileged user edits it.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Blocks For Shopengine

CVE-2026-115673

Anti-Spam by CleanTalk < 6.91 - Unauthenticated Stored XSS via Comment Author Email

The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 does not escape a commenter-supplied value before outputting it on an administrative spam-review screen, allowing unauthenticated users to inject arbitrary web scripts that execute in the browser of an administrator who reviews flagged comments.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Anti Spam By Cleantalk

CVE-2026-120671

UsersWP <= 1.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'badge' Shortcode Attribute

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'badge' parameter in all versions up to, and including, 1.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is particularly effective against higher-privileged users — such as editors and administrators — who preview a Contributor's pending post containing the malicious shortcode.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Stiofansisland Wordpress-extensions

Products

Userswp – Front-end Login Form, User Registration, User Profile & Members Directory Plugin For Wp Userswp

CVE-2026-97642

Wp Parsidate <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Block Attribute

The Wp Parsidate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calendar Gutenberg block's 'theme' attribute in versions up to, and including, 6.4. This is due to insufficient input sanitization and output escaping on the block attribute value which is concatenated directly into an HTML class attribute in the printCalendar() function without esc_attr(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Man4toman Wordpress-extensions

Products

Parsi Date | بسته فارسی ساز وردپرس و ووکامرس پارسی دیت Wp Parsidate

CVE-2026-116551

WP Customer Area <= 8.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter

The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 8.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Aguilatechnologies Wordpress-extensions

Products

Wp Customer Area Wp Customer Area

CVE-2026-119211

AAA Autoload Optimizer <= 1.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'option_page' Parameter via 'all' Hook

The AAA Autoload Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'option_page' parameter in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the plugin's Option Tracking setting to be configured to 'Legacy' mode, and succeeds despite WordPress ultimately returning HTTP 403 to the low-privileged caller because the vulnerable 'all' filter fires before the capability check in wp-admin/options.php.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Progressplanner Wordpress-extensions

Products

Aaa Autoload Optimizer Aaa Autoload Optimizer

CVE-2026-116545

All-in-One Video Gallery <= 5.0.0 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'track' Post Meta 'label' Field

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'custom_fields[].value.label (for key='track')' parameter in all versions up to, and including, 5.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the site's Player Library option to be configured as Plyr/Vidstack (aiovg_player_settings[player]='vidstack') rather than the Video.js default, as the DOM innerHTML sink exists only in the Plyr/Vidstack template path.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Plugins360 Wordpress-extensions

Products

All-in-one Video Gallery All-in-one Video Gallery

CVE-2026-119178

Smart Cookie Kit <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Bundled Simple HTML DOM Noise Restoration

The Smart Cookie Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is specifically crafted to survive wp_kses on save by storing hostile characters inside allowed HTML elements, with the attribute-breaking double-quote smuggled inside a permitted &lt;code&gt; body and reconstructed into a &lt;abbr title&gt; attribute only at render time by the plugin's own output buffer; exploitation requires an administrator to approve the comment and subsequently view the affected public post.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Shark986 Wordpress-extensions

Products

Smart Cookie Kit Smart Cookie Kit

CVE-2026-107658

BuddyForms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion

The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bf_post_type (and buddyforms_form_content)' parameter in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that at least one BuddyForms form with public submissions enabled exists on the site (so that the required nonce can be harvested from the public form page) and that the active theme registers a widgetized sidebar, allowing the injected customize_changeset to place a malicious Custom HTML widget into the site's front end.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Themekraft Wordpress-extensions

Products

Buddyforms Buddyforms

CVE-2026-109884

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Reflected XSS.This issue affects Elementor Website Builder: from n/a through 4.3.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Elementor Wordpress-extensions

Products

Elementor Website Builder Elementor Website Builder

CVE-2026-109883

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Code Injection.This issue affects Elementor Website Builder: from n/a through 4.3.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Elementor Wordpress-extensions

Products

Elementor Website Builder Elementor Website Builder

CVE-2026-120845

WordPress Smush Image Compression and Optimization plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Smush Image Compression and Optimization wp-smushit allows Stored XSS.This issue affects Smush Image Compression and Optimization: from n/a through 4.3.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpmudev

Products

Smush Image Compression And Optimization Smush Image Compression And Optimization

CVE-2026-119219

Jupiter X Core <= 4.62.0 - Unauthenticated Stored Cross-Site Scripting via Raven Register Custom User Meta

The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[<custom_meta_field_id>]' parameter in all versions up to, and including, 4.62.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Execution requires that the attacker-registered account be assigned as the post_author of a page or post whose template includes the Raven Author Box widget, a fixture an administrator can create by reassigning authorship to any user including newly registered Subscribers.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Artbees Wordpress-extensions

Products

Jupiter X Core Jupiter X Core

CVE-2026-121519

Social Slider Feed <= 2.3.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' Parameter

The Social Slider Feed – Social Media Feed & Gallery Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slidespeed' parameter in all versions up to, and including, 2.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The missing current_user_can() check in the Factory framework's connect() dispatcher allows Subscriber-level users to bypass the manage_options capability gate and both harvest a valid wis_edit_feed nonce and overwrite any feed's slidespeed setting, after which the stored payload fires on every public pageview embedding the feed shortcode.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Themeisle Wordpress-extensions

Products

Social Slider Feed Social Slider Feed

CVE-2026-119098

LifterLMS <= 10.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question Answer

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'answer[]' parameter in all versions up to, and including, 10.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker to be enrolled as a student in a course containing a Content-type quiz question; the injected payload executes in the administrator's browser session during the normal grading workflow when 'Start a Review' is clicked on the affected attempt.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Lifterlms Wordpress-extensions

Products

Lifterlms Lifterlms

CVE-2026-119165

WPBakery Page Builder <= 9.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display Name

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name / nickname' parameter in all versions up to, and including, 9.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires that at least one public post attributed to the attacker's account be rendered through a Basic Grid using a Grid Builder template with the Post Author element configured to link to the post author; Author-level users can satisfy this precondition unassisted, while Subscribers depend on an administrator having assigned or published a post under their account.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpbakery

Products

Wpbakery Page Builder Wpbakery Page Builder

CVE-2026-121515

FV Flowplayer Video Player <= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.56.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' option to be enabled, and the injected comment must be approved before the script executes for site visitors.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Foliovision Wordpress-extensions

Products

Fv Flowplayer Video Player Fv Flowplayer Video Player