The Mang Board plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'align' parameter affecting all versions up to and including 2.4.5. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when any user views the affected page. The vulnerability arises because the input is not properly sanitized or escaped, and the payload bypasses WordPress's wp_kses_post filter by avoiding angle brackets, allowing the malicious code to persist and execute in viewers' browsers.
The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter in all versions up to and including 4.7.2. This vulnerability arises from improper input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The issue is due to the plugin's fallback regex incorrectly processing allowed attribute values, enabling injection of active HTML attributes such as event handlers.
The VikRentCar Car Rental Management System WordPress plugin is vulnerable to stored Cross-Site Scripting (XSS) via the 'className' parameter in all versions up to and including 1.4.10. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, where wp_kses_post() does not effectively neutralize the payload due to the injection context within an HTML attribute. This flaw allows script injection despite some sanitization attempts.
The Webheadcoder Multi-Step Forms for Contact Form 7 WordPress plugin versions up to and including 4.7 contain a reflected cross-site scripting (XSS) vulnerability via the 'l10n_print_after' parameter. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link. Exploitation requires the targeted site to have at least one Contact Form 7 form configured with a [multistep] form-tag. The vulnerability is mitigated in non-multistep forms starting from version 4.7 due to canonicalization that blocks the attack path.
The Avada (Fusion) Builder WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in versions up to and including 3.16.2. This flaw arises from insufficient input sanitization and output escaping of the 'tab_index' and 'empty_notice' parameters. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability persists because the wp_kses_post function does not remove the payload due to its location within shortcode attribute text, which is treated as plain text rather than HTML.
The If-So Dynamic Content – Elementor & All Page Builders Personalization WordPress plugin up to version 1.10.2 is vulnerable to stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping in multiple parameters. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability has a CVSS score of 6.4, indicating a medium severity risk.
The Postie WordPress plugin up to version 1.9.87 is vulnerable to a stored cross-site scripting (XSS) flaw via the Email Body URL Autolink feature. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. The ?postie=get-mail endpoint is accessible without authentication or capability checks, and the plugin disables WordPress's usual output filters before saving content, enabling the storage of unescaped href attributes that execute when users view the affected pages.
The Waitlist Woocommerce (Back in stock notifier) WordPress plugin up to version 2.9.1 is vulnerable to stored Cross-Site Scripting (XSS) via the 'type' shortcode attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This occurs because the plugin does not properly sanitize or escape shortcode attribute input, and the wp_kses_post filter does not mitigate this due to how shortcode attributes are handled at render time.
The If-So Dynamic Content – Elementor & All Page Builders Personalization WordPress plugin up to version 1.10.2 contains a stored cross-site scripting (XSS) vulnerability via the 'conversion' shortcode attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.
Cozy Blocks – Website Builder for WordPress Block Editor plugin versions up to 2.2.27 are vulnerable to stored cross-site scripting (XSS) via the productRating.iconColor parameter. This vulnerability allows authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages. The issue occurs only when the productRating option is enabled and the associated WooCommerce product has a non-zero rating.
The s2Member WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'date_format' parameter in versions up to and including 261011. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, allowing payloads that bypass WordPress's wp_kses_post() filter by using backslash-escaped sequences which PHP's date() function converts into HTML tag characters at render time.
The DesignSetGo WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'tagName' parameter in versions up to and including 2.11.0. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when an administrator runs the plugin's block-conversion migration. Exploitation requires administrator action to activate the payload, limiting direct attacker control.
The Travelly – Tour & Travel Booking Manager plugin for WooCommerce versions up to 2.3.6 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper sanitization and escaping of user-supplied shortcode attributes 'width', 'height', and 'zoom' in the [ttbm-hotel-map] shortcode. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages.
The UiChemy plugin for WordPress, used to convert Figma, prompts, and AI builds to page builders like Elementor, Gutenberg, and Bricks, contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 5.3.0. This vulnerability arises from insufficient input sanitization and output escaping of a specific URL parameter, allowing authenticated users with contributor-level access or higher to inject malicious scripts. The injected script executes when a privileged user clicks the crafted link, potentially compromising their session or data.
The If-So Dynamic Content – Elementor & All Page Builders Personalization WordPress plugin versions up to 1.10.2 contain a stored cross-site scripting (XSS) vulnerability via the 'url' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute in administrator browsers when previewing or opening affected posts. This vulnerability arises from insufficient input sanitization and output escaping in the plugin.
MxChat – AI Chatbot & Content Generation for WordPress plugin versions up to 3.2.25 are vulnerable to a stored DOM-based Cross-Site Scripting (XSS) flaw via the 'feedback' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrator views the Transcripts page. The issue arises from insufficient input sanitization and output escaping of user-supplied data.
The Awesome Support WordPress plugin up to version 6.4.1 contains a stored cross-site scripting (XSS) vulnerability via the 'wpas_files' parameter. This flaw allows authenticated users with custom-level access or higher to inject malicious scripts that execute when other users view the affected pages. Exploitation requires the 'Enable drag-n-drop uploader for ticket form' setting to be enabled, which is disabled by default.
CVE-2026-113488 is a stored cross-site scripting (XSS) vulnerability in the GeoDirectory WordPress plugin versions before 2.8.196. It arises from improper escaping of a post badge shortcode attribute in a JavaScript context, allowing users with Contributor role or higher to inject malicious scripts. These scripts execute when anyone, including administrators, clicks the badge. The vulnerability has a CVSS score of 6.8, indicating a medium severity impact. A fix is available in version 2.8.196.
CVE-2026-113487 is a stored cross-site scripting (XSS) vulnerability in the GeoDirectory WordPress plugin before version 2.8.196. It arises because the plugin does not properly sanitize or escape a post badge click-through link value before outputting it in an anchor element on a listing. This flaw allows users with Contributor role or higher to inject malicious scripts that execute when higher-privileged users, such as administrators, view the affected listing.
A Cross-site Scripting (XSS) vulnerability exists in the MP3 Audio Player WordPress plugin versions 5.9 up to but not including 5.16. The flaw allows users with Contributor-level access or higher to inject arbitrary JavaScript via an unescaped shortcode attribute, which executes when another user, such as an administrator previewing a post, views the content. This vulnerability is fixed in version 5.16.