Security

CVE-2026-5428 affects Royal Addons for Elementor and is an authenticated Author+ stored cross site scripting vulnerability in image captions rendered by the Image Grid, Slider, and Carousel widget. In versions through 1.7.1056, render_post_thumbnail() applies wp_kses_post() to data that is placed in an HTML attribute instead of using attribute-context escaping.

CVE-2026-5488 affects ExactMetrics and exposes Google Ads integration actions to authenticated Subscriber+ users. The get_ads_access_token() and reset_experience() AJAX handlers verify a nonce that is localized on profile.php but omit the exactmetrics_save_settings capability check. This can expose a live Google Ads access token or reset connected integration state.

CVE-2026-3885 affects Shortcodes Ultimate and is an authenticated Contributor+ stored cross site scripting vulnerability in the su_box shortcode. In versions through 7.4.9, a crafted max_width value can break out of its HTML attribute and add an event handler. The stored browser code runs when a visitor interacts with the affected box.

CVE-2025-13354 affects TaxoPress and allows authenticated Subscriber+ users to merge or delete arbitrary taxonomy terms through the taxopress_merge_terms_batch AJAX action. The handler validates a nonce that is available from profile.php but does not verify the taxonomy manage_terms capability. Its unbounded post lookup can also add significant load while terms are reassigned or removed.

CVE-2026-1673 affects BEAR Bulk Editor and Products Manager Professional for WooCommerce and is a cross site request forgery vulnerability that can delete WooCommerce taxonomy terms in versions through 1.1.5. The woobe_delete_tax_term AJAX action accepts tax_key and term_id without validating a WordPress nonce. An unauthenticated attacker can prepare a forged request that deletes product categories, tags, or other terms when a logged in administrator or shop manager visits a malicious page.

CVE-2026-1672 affects BEAR Bulk Editor and Products Manager Professional for WooCommerce and is a cross site request forgery vulnerability that can modify WooCommerce product data in versions through 1.1.5. The woobe_redraw_table_row AJAX action accepts product_id, field, and value without validating a WordPress nonce. An unauthenticated attacker can prepare a forged request that changes prices, descriptions, or other product fields when a logged in administrator or shop manager visits a malicious page.

CVE-2026-0738 affects Shortcodes Ultimate and is an authenticated Author+ stored cross site scripting vulnerability in the su_carousel shortcode. In versions through 7.4.8, an unsafe value in the su_slide_link attachment field can be stored and rendered in carousel output. When a visitor moves the pointer over the affected slide link, browser code can run in that visitor’s session.

CVE-2026-0737 affects Shortcodes Ultimate and is an authenticated Contributor+ stored cross site scripting vulnerability in the su_lightbox shortcode. In versions through 7.4.7, an attacker can store a crafted value in the shortcode src attribute. When a visitor activates the injected lightbox link, browser code can run in that visitor’s session.