The aBlocks WordPress plugin versions up to and including 2.18.0 contain a vulnerability that allows authenticated users with contributor-level access or higher to expose the full content of password-protected posts by using a shortcode with the post's ID. Users with author-level access or above can publish posts embedding this shortcode, thereby exposing protected content to unauthenticated visitors.
A vulnerability in the Trainer v2 TrainJob API allows users with permissions to create TrainJobs to inject valueFrom.secretKeyRef into environment variable definitions. This can lead to exfiltration of sensitive secrets from the namespace and privilege escalation if the TrainJob RBAC is broader than the Secret read RBAC. The issue affects a Technology Preview feature in Red Hat OpenShift AI and has a low impact. Mitigation involves aligning TrainJob creation permissions with Secret read permissions or restricting the valueFrom.secretKeyRef field via a validating webhook.
The WP Data Access – App Builder plugin for WordPress contains a SQL Injection vulnerability in the 'engine' parameter affecting all versions up to and including 5.5.90. Authenticated users with subscriber-level access or higher can exploit this flaw if an administrator has configured a Data Project page to allow lower-privileged roles. This vulnerability allows attackers to append additional SQL queries to extract sensitive database information.
A vulnerability in OpenBMB Internet of Agents affects the fetch_chat_record function in the Message Handler component due to improper access control on the comm_id argument. This flaw allows remote attackers to potentially access unauthorized information. The vulnerability has a high severity score of 7.3 and public exploit code is available. The project has been informed but has not yet responded or issued a fix.
The SEOPress AI SEO Plugin for WordPress versions up to and including 10.3 is vulnerable to stored cross-site scripting (XSS) via insufficient sanitization of specific Google Analytics tracking settings. Authenticated users with Subscriber-level access or higher can inject malicious scripts through the 'seopress_google_analytics_affiliate_tracking' and 'seopress_google_analytics_download_tracking' settings, which are improperly sanitized before being embedded in inline JavaScript. This vulnerability allows arbitrary script execution in pages viewed by users.
The QA Assistants – Driven by data plugin for WordPress versions up to and including 5.3.0 is vulnerable to PHP Object Injection via the 'dlevent_ver' parameter. This vulnerability arises from unsafe deserialization without class restrictions and insufficient sanitization of path traversal sequences. An unauthenticated attacker can exploit this to perform arbitrary file writes using a gadget in the plugin's dependencies, potentially leading to remote code execution. Exploitation requires triggering a scheduled event that runs automatically every two minutes without authentication.
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps WordPress plugin versions up to and including 5.5.90 is vulnerable to stored cross-site scripting (XSS) via its Data Projects front-end simple form. This vulnerability arises from insufficient input sanitization and output escaping in the handling of text-based database columns, allowing authenticated users with Subscriber-level access or higher to inject arbitrary scripts that execute when other users view the affected pages.
The AgenWebsite Shipping plugin for WordPress, versions up to and including 9.2.41, is vulnerable to stored cross-site scripting (XSS) via the 'zipcode' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access affected pages.
A missing authorization vulnerability exists in WPVibes AnyWhere Elementor plugin versions up to 1.3.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 5.4.
The Strong Testimonials WordPress plugin up to version 3.3.16 contains a stored cross-site scripting (XSS) vulnerability via the 'star_rating' parameter. This flaw allows unauthenticated attackers to inject malicious scripts that execute when an administrator previews a pending testimonial, a normal part of the plugin's moderation workflow.
The Ultimate Member WordPress plugin up to version 2.14.1 is vulnerable to stored cross-site scripting (XSS) via the 'pm_note' parameter, which allows authenticated users with subscriber-level access or higher to inject malicious scripts. These scripts execute when a privileged user visits the affected profile page and interacts with the injected content. The vulnerability arises from insufficient input sanitization and output escaping, enabling attackers to exploit a DOM-based XSS vector.
The Quiz and Survey Master (QSM) plugin for WordPress versions up to and including 11.2.7 contains a vulnerability that allows unauthenticated attackers to execute arbitrary shortcodes. This occurs because the plugin does not properly validate input before calling do_shortcode, and the nonce used for submission acts as a CSRF token rather than an effective authorization barrier.
The WP Data Access plugin for WordPress versions up to and including 5.5.89 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient output escaping in the Simple Form autocomplete lookup label, allowing authenticated users with Subscriber-level access or higher to inject malicious scripts. These scripts execute when other users, including those with higher privileges, access the affected pages.
The Unlimited Elements for Elementor WordPress plugin up to version 2.0.26 is vulnerable to stored cross-site scripting (XSS) via attacker-controlled RSS feed content. This vulnerability allows unauthenticated attackers to inject malicious scripts into pages that render the RSS Feed catalog widget pointing to a malicious feed URL. The issue arises from insufficient input sanitization and output escaping, particularly due to the plugin's escaping pre-processor excluding raw prints and decoding XML entity-encoded payloads back to raw markup.
The WP Data Access plugin for WordPress suffers from a stored cross-site scripting (XSS) vulnerability in all versions up to and including 5.5.89. This flaw arises from insufficient input sanitization and output escaping of the ImageURL column value, which can be populated from the wp_usermeta.description field. Authenticated users with subscriber-level access or higher can exploit this by injecting malicious scripts that execute when other users view the affected pages. Exploitation requires an administrator to publish a DataTables shortcode over a database column controlled by the attacker with the Image URL media type assigned, which is not enabled by default.
CVE-2026-119473 is a medium severity vulnerability in the ProfilePress plugin for WordPress (by properfraction) affecting versions prior to 4.18.0. It involves improper neutralization of script-related HTML tags, leading to a basic cross-site scripting (XSS) issue in the wp-user-avatar component. The vulnerability allows code injection but has limited impact on confidentiality and no impact on integrity or availability. A fix is available in version 4.18.0.
CVE-2026-119465 is a vulnerability in the WPVibes Elementor Addon Elements plugin that allows insertion of sensitive information into sent data. This flaw affects versions from initial releases up to 1.15. The issue enables retrieval of embedded sensitive data without requiring privileges or user interaction. A fix is available in version 1.15.1.
The Amelia WordPress plugin (Booking for Appointments and Events Calendar) versions 9.0 through 9.9.1 have a missing authorization vulnerability. Authenticated users with the wpamelia-customer role or higher can access attendee data for any event without verifying organizer or provider status. This allows unauthorized export of sensitive attendee information including personal details and payment data via a specific API endpoint.
The wpForo Forum plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'post[body]' parameter affecting all versions up to and including 3.2.2. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.