| CVE/PSC | Application | Date | Affected versions | Description |
|---|---|---|---|---|
| Actual on: May 23, 2026, 14:05:42 | ||||
|
vulnerable
|
May 23, 2026, 19:05:04 |
Min -
Max 2.6.4
|
The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Draft Post Title in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unescaped injection path is triggered specifically when the viewing user lacks edit capabilities, meaning payloa... | |
|
WP Blockade – Visual Page Builder
vulnerable
|
May 23, 2026, 18:05:20 |
Min -
Max 0.9.14
|
The WP Blockade plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode' parameter in all versions up to and including 0.9.14. This is due to insufficient input sanitization and output escaping in the render_shortcode_preview() function. The function receives user input from $_GET['shortcode'], passes it through stripslashes() without any sanitization, and then outputs it directly via echo do_shortcode($shortcode) on line 393. When the input is not a valid WordPress shortcode... | |
|
vulnerable
|
May 23, 2026, 18:05:02 |
Min -
Max 4.0.2
|
WooCommerce PayPal Payments [woocommerce-paypal-payments] < 4.0.2 CVE-2026-9284 | |
|
vulnerable
|
May 23, 2026, 12:05:17 |
Min -
Max 1.01
|
The VatanSMS WP SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `page` parameter in all versions up to, and including, 1.01. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link. | |
|
Email Marketing, Newsletter, Email Automation and CRM Plugin for WordPress by FluentCRM
vulnerable
|
May 23, 2026, 10:05:54 |
Min -
Max 3.0.0
|
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution [fluent-crm] < 3.0.0 CVE-2026-7798 | |
|
vulnerable
|
May 23, 2026, 09:05:57 |
Min -
Max 1.5.2
|
WP Directory Kit [wpdirectorykit] < 1.5.2 CVE-2026-42672 | |
|
vulnerable
|
May 23, 2026, 09:05:30 |
Min -
Max 1.4.16
|
The 診断ジェネレータ作成プラグイン (Diagnosis Generator) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'js' parameter in versions up to and including 1.4.16. This is due to missing authorization checks and insufficient input sanitization in the themeFunc() function. The function is hooked to 'admin_init' and processes theme update requests without verifying user capabilities, allowing any authenticated user (including subscribers) to save malicious JavaScript to theme files. Additionally, the s... | |
|
MyCryptoCheckout – Bitcoin, Ethereum, and 100+ altcoins for WooCommerce
vulnerable
|
May 23, 2026, 09:05:21 |
Min -
Max 2.162
|
MyCryptoCheckout – Bitcoin, Ethereum, and 100+ altcoins for WooCommerce [mycryptocheckout] < 2.162 CVE-2026-45209 | |
|
vulnerable
|
May 23, 2026, 09:05:05 |
Min -
Max 0.5.2
|
The SponsorMe plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The PHP_SELF value is reflected in two separate locations within the vulnerable function — a form actio... | |
|
vulnerable
|
May 23, 2026, 08:05:58 |
Min -
Max 2.15.16
|
The Infility Global plugin for WordPress is vulnerable to SQL Injection via the 'orderby' and 'order' parameters in all versions up to, and including, 2.15.16. This is due to insufficient escaping on user supplied parameters and lack of sufficient preparation on the existing SQL query within the show_control_data::post_list() function, which is registered as an admin menu page with only the 'read' capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to appe... | |