Threat database

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect visitors to an arbitrary external site.

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages, allowing unauthenticated visitors to retrieve the secret key of any active giveaway that has reCAPTCHA configured.

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors WordPress plugin before 1.4.124's paid featured-listing option is enabled, neither of which is a default configuration.

The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned listing-management role to inject arbitrary web scripts that execute when a listing is viewed by any visitor, including an administrator.

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access (who do not hold unfiltered_html) to store a payload that executes when the page is rendered.

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire site unavailable.

The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page.

The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing authenticated users with minimal privileges such as Subscribers to overwrite a site-wide Popup Maker WordPress plugin through 1.4.5 option (the linked service account and API configuration) that should only be modifiable by administrators.

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of arbitrary orders, including marking unpaid orders as paid and reducing stock.

The Super Forms – Drag & Drop Form Builder WordPress plugin is affected by a critical directory traversal vulnerability (CVE-2026-15896) in all versions up to 6.3.316. This flaw allows unauthenticated attackers to read arbitrary files on the server via the parse_request function. By default, no authentication is required to exploit this, though enabling the optional 'file_upload_auth' setting can mitigate unauthenticated access but does not fix the underlying vulnerability. Exploitation conditions differ between Linux and Windows environments but are generally feasible when file upload is enabled.

Autoptimize, a WordPress plugin, is vulnerable to stored Cross-Site Scripting (XSS) via the Comment Author Name field in all versions up to and including 3.1.15.1. The vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires multiple conditions: the 'Lazy-load images?' option enabled by an administrator, presence of the w3-total-cache.php file on disk (even if the plugin is disabled), a class named Minify_HTML loaded by another plugin, and approval of the malicious comment by a moderator. This vulnerability allows unauthenticated attackers to inject scripts that execute when users access the affected pages.

The SiteOrigin Widgets Bundle WordPress plugin up to version 1.73.2 contains a Local File Inclusion vulnerability via the 'theme' parameter. Authenticated users with contributor-level access or higher can exploit this flaw to include and execute arbitrary PHP files on the server. This allows execution of arbitrary PHP code, potentially bypassing access controls and exposing sensitive data. Exploitation involves sending a crafted widgetData payload to a specific REST endpoint, bypassing field validation.

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress versions up to and including 3.15.4 is vulnerable to stored Cross-Site Scripting (XSS) via the Paragraph Text field when the Rich Text Editor (RTE) option is enabled. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view the affected pages.

The Super Forms – Drag & Drop Form Builder WordPress plugin contains a privilege escalation vulnerability in versions up to and including 6.3.316. This flaw allows authenticated users with Subscriber-level access or higher to overwrite credentials of arbitrary accounts, including administrators, by exploiting insufficient capability checks in the Register & Login add-on. Successful exploitation can lead to full site compromise.

The Ninja Forms - File Uploads plugin for WordPress up to version 3.3.34 contains a vulnerability allowing unauthenticated attackers to perform arbitrary file read, write, and deletion operations via the external Amazon S3 upload flow. This occurs because the plugin trusts attacker-supplied file paths without validation, which can lead to remote code execution if the external store is configured. Exploitation requires the use of the External File Upload (Amazon S3) action, and for file read, an Email action attaching the uploaded file must be configured. A patch is available to address this issue.

CVE-2026-84925 is a reflected cross-site scripting (XSS) vulnerability in the Avada | Website Builder For WordPress & WooCommerce theme. It affects all versions up to and including 7.16.1. The vulnerability arises from improper input sanitization and output escaping of the 'lang' parameter, allowing unauthenticated attackers to inject arbitrary scripts. These scripts execute if a user is tricked into clicking a crafted link. The issue involves unsafe concatenation of the injected value into a URL within the post editor metabox without proper encoding.