Live Threat Intelligence Radar

CVE-2026-97328 is a Cross-Site Scripting (XSS) vulnerability in the WebP Express WordPress plugin versions before 0.25.16. The issue arises because the plugin does not properly escape values re-emitted into element attributes by its bundled HTML parser when a non-default image delivery mode is enabled. This allows unauthenticated users to submit malicious content that is stored and later executed in the browsers of any users viewing the affected page, including administrators.

The MasterStudy LMS WordPress Plugin before version 3.7.55 contains an authorization flaw in its student-enrolment feature. Instructors can overwrite the first name, last name, and public display name of any registered user, including administrators. This vulnerability enables impersonation and phishing risks on affected sites.

The Link Library WordPress plugin before version 7.9.6 contains a stored Cross-Site Scripting (XSS) vulnerability. This occurs because the plugin does not properly sanitise and escape a link field before outputting it inside an attribute of a link preview. Users with Contributor role or higher can exploit this flaw to inject malicious scripts. The preview is generated without authentication and without verifying if the link is published, allowing unapproved submissions to affect any visitor who views the preview.

A vulnerability in the Photo Engine (Media Organizer & Lightroom) WordPress plugin before version 6.5.8 allows authenticated users with author role and above to delete media attachments uploaded by other users, including administrators. This occurs because the plugin does not verify user authorization for actions on targeted media attachments.

A stored Cross-Site Scripting (XSS) vulnerability exists in the Photo Engine (Media Organizer & Lightroom) WordPress plugin before version 6.5.8. The plugin fails to properly sanitise and escape collection and gallery names before storing and displaying them in the administrative dashboard. This allows authenticated users with the author role or higher to inject malicious scripts that persist and execute in the admin interface.

The Royal MCP WordPress plugin versions before 1.5.7 contain an improper authentication vulnerability. The plugin does not restrict preview-link tokens to a single preview, allowing any party with a valid token to authenticate as the token's owning user. By default, this user is an administrator, granting full access to the REST API without requiring a nonce. This flaw can lead to a complete site takeover.

The MB Custom Post Types & Custom Taxonomies WordPress plugin before version 2.12.3 has an authorization flaw in its export feature. This flaw allows users with Contributor-level roles to access configuration data for admin-only custom post types and taxonomies. Additionally, these users can read titles, dates, statuses, and some stored content of other users' non-public posts and pages.

The MB Custom Post Types & Custom Taxonomies WordPress plugin versions from 2.0.2 up to but not including 2.12.3 contain a missing authorization vulnerability. This flaw allows unauthenticated users to trigger a legacy data migration process that reverts custom post type or taxonomy definitions to their pre-upgrade state. As a result, any configuration changes made by administrators after upgrading can be discarded, potentially exposing previously restricted content to anonymous visitors.

A Cross-Site Scripting (XSS) vulnerability exists in the PixelYourSite WordPress plugin versions before 11.4.3 and PixelYourSite Pro before 12.6.8. The flaw arises because the plugins do not sanitize and escape a cookie value before outputting it on the page. On sites using full-page caching, this allows unauthenticated attackers to inject malicious scripts into cached pages, which are then served to other visitors.

The Infility Global WordPress plugin versions before 2.16.25 contain a missing authorization vulnerability. This flaw allows unauthenticated users to invoke an AJAX action without any authorization or nonce checks, enabling them to overwrite machine-translation configuration values of a companion plugin. This issue affects all versions from the initial release up to but not including 2.16.25.