CVE-2026-121784 is a stored cross-site scripting (XSS) vulnerability in the WpBookingly plugin by Magepeople inc. It affects versions from initial through 1.4.3. The vulnerability involves improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts. A fix is available in version 1.4.4.
RRD::CGI::Image versions through 0.01 for Perl improperly pass CGI query parameters containing "tz" to the tzset() function without validation. This allows an attacker to set the TZ environment variable to a value that glibc interprets as a file path, potentially causing the CGI process to block if the path points to a FIFO or device that stalls the process.
The WP ImageViewer plugin for WordPress up to version 3.0.2 is vulnerable to stored DOM-based cross-site scripting (XSS) via the 'img.alt' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. Exploitation requires a front-end content plugin like bbPress to be active, granting necessary capabilities to subscriber-level users. Contributor-level attackers need the ability to submit image HTML in post content, which is the default WordPress behavior. Without such configuration, attackers require custom-level access or higher.
The Modula WordPress plugin versions up to and including 3.0.17 are vulnerable to stored cross-site scripting (XSS) via the 'items' parameter. This vulnerability arises from insufficient sanitization of the per-image 'link' field in certain REST handlers and functions, allowing authenticated users with Author-level access or higher to inject malicious scripts. These scripts execute when users access the affected pages and interact with the gallery tiles.
The WP-Members Membership Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the WooCommerce Checkout Multicheckbox/Multiselect Field in all versions up to and including 3.5.7. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with subscriber-level access or higher to inject malicious scripts that execute when other users view the affected pages. The vulnerability is limited to the WooCommerce classic checkout path and does not affect sibling registration, profile, or account-edit handlers due to type error protections in PHP 8.
The Church Admin plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the 'lat' parameter in all versions up to and including 5.1.7. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user views the affected page. Exploitation requires that a Google Maps API key be configured in the plugin settings, as the vulnerable code path is only triggered under this condition.
The WS Form LITE WordPress plugin up to version 1.12.18 is vulnerable to a stored cross-site scripting (XSS) flaw via the 'field_<id>[0][0]' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. The issue is due to the client-side esc_html() helper improperly handling non-string values, enabling nested-array payloads to bypass escaping and reach jQuery .append() unescaped.
The Registration Form for WooCommerce plugin for WordPress versions up to and including 1.1.4 contains a privilege escalation vulnerability. This flaw arises from a missing allow-list check in the checkout registration path, allowing unauthenticated attackers to assign themselves the Administrator role during account creation at checkout. This results in full site takeover.
The Happyforms WordPress plugin up to version 1.38.9 is vulnerable to stored cross-site scripting (XSS) via spoofable client IP headers. The vulnerability arises because the plugin reads raw HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without validation, stores them as post meta, and later outputs them in the admin interface without proper escaping. This allows unauthenticated attackers to inject malicious scripts that execute when an administrator views the affected submission details.
A stored Cross-site Scripting (XSS) vulnerability exists in Cozmoslabs TranslatePress plugin versions up to 3.3.8. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts that execute in users' browsers. The vulnerability has a high severity rating with a CVSS score of 7.1.
The Happyforms Pro plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'happyforms_client_referer' parameter. This vulnerability affects all versions up to and including 1.38.9 and allows unauthenticated attackers to inject malicious scripts that execute when users view the affected pages.
The JetFormBuilder plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'note' form field parameter. This vulnerability affects all versions up to and including 3.6.8 and allows unauthenticated attackers to inject malicious scripts that execute when a privileged user views a crafted page. Exploitation requires a user with edit_others_posts capability to visit a manipulated URL controlled by the attacker.
The VikBooking Hotel Booking Engine & PMS plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'guests[][][documents]' parameter. This affects all versions up to and including 1.8.17. The flaw allows unauthenticated attackers who have a valid booking session token to inject malicious scripts that execute when users access the affected pages.
The JetFormBuilder plugin for WordPress up to version 3.6.8 is vulnerable to stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject malicious scripts via form fields mapped to post meta keys, which execute when users access affected pages. Exploitation requires a public Insert Post form configured to write to a post meta key and a Calculated Field referencing that key. A single unauthenticated POST request can persist the malicious payload.
The Appointment Booking Plugin – LatePoint for WordPress versions up to and including 5.7.6 is vulnerable to an authentication bypass via account takeover. This vulnerability arises from improper handling of SQL query conditions in the plugin's code, allowing unauthenticated attackers to reset passwords of arbitrary customers and gain full access to their bookings, orders, and personal information. When a specific plugin option is enabled, attackers can also take over linked WordPress user accounts.
The Real Testimonials WordPress plugin versions up to and including 4.1.0 are vulnerable to stored cross-site scripting (XSS) via the 'tpro_client_image' and 'tpro_client_testimonial' parameters. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires an administrator to have a display block configured with the 'Strip All HTML Tags' option disabled and to approve the injected testimonials, which is the default plugin setting.
The Real Testimonials WordPress plugin up to version 4.1.0 is vulnerable to stored cross-site scripting (XSS) via the 'tpro_client_testimonial' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrator approves a testimonial and the affected page loads the WordPress Interactivity runtime. The flaw is due to insufficient input sanitization and output escaping.
The Real Testimonials WordPress plugin up to version 4.1.0 is vulnerable to stored cross-site scripting (XSS) via the 'tpro_client_name' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires an administrator to publish the testimonial, preview it via AJAX, and save an update, which stores the malicious payload. The attacker cannot trigger the vulnerability without administrator interaction.
A vulnerability in RelyWP Simple Cloudflare Turnstile up to version 1.44.4 allows authentication bypass via an alternate path or channel, leading to authentication abuse. This flaw does not impact confidentiality or availability but can affect integrity. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity). No patch or remediation details are currently provided.
The AutomatorWP WordPress plugin up to version 6.0.4 contains a privilege escalation vulnerability. This flaw arises from insufficient privilege validation in the create_user() function when used in anonymous-user actions or certain WordPress integration actions. An attacker can exploit this by triggering an automation configured to assign roles dynamically from user-controlled data, such as comment author fields, allowing creation of an administrator account without authentication. Exploitation requires a specific automation setup and is triggered by routine admin actions like comment approval, which does not alert the admin to the creation of a privileged account.