The Waitlist WooCommerce (Back in stock notifier) plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'type' shortcode attribute. This affects all versions up to and including 2.9.1. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because shortcode attribute values are not sanitized by the wp_kses_post filter and are only processed at render time.
The Prime Slider plugin for WordPress versions up to and including 4.7.2 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The issue is due to the plugin's fallback regex improperly handling allowed attribute values, enabling the injection of active HTML attributes such as event handlers.
The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.10.2. This vulnerability arises from insufficient input sanitization and output escaping of certain parameters, allowing authenticated users with contributor-level access or higher to inject malicious scripts. These scripts execute whenever a user accesses the affected page, potentially compromising user data or session integrity.
The VikRentCar Car Rental Management System plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'className' parameter in all versions up to and including 1.4.10. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because input sanitization and output escaping are insufficient, allowing payloads to break out of HTML attribute contexts despite the use of wp_kses_post() at save time.
The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 3.1.8. This vulnerability arises from insufficient input sanitization and output escaping of the 'fields[section][fields][row][col][type]' parameter. Authenticated users with shop manager-level access or higher can exploit this flaw to inject malicious scripts that execute when other users view the affected pages.
The UiChemy WordPress plugin, which converts Figma, prompts, and AI builds to Elementor, Gutenberg, and Bricks, is vulnerable to stored cross-site scripting (XSS) in all versions up to and including 5.3.0. The vulnerability arises from insufficient input sanitization and output escaping of a specific URL parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when privileged users interact with the injected content. Exploitation requires a privileged user to click the crafted link, triggering the malicious JavaScript payload.
The Cozy Blocks plugin for WordPress, used for building websites with the WordPress Block Editor and integrating Gutenberg blocks, is vulnerable to stored cross-site scripting (XSS) via the 'productRating.iconColor' parameter. This vulnerability affects all versions up to and including 2.2.27. It allows authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages. The vulnerability is triggered only when the productRating feature is enabled and the WooCommerce product has a non-zero rating.
The Cozy Blocks plugin for WordPress Block Editor (Gutenberg) versions up to and including 2.2.27 is vulnerable to stored cross-site scripting (XSS) via the 'content' block attribute parameters related to icon.view, icon.layout, and icon.gap. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping, as wp_kses_post does not neutralize certain quote-only attribute-breakout payloads lacking '<' characters, leaving exploitable JSON attributes intact at render time.
The Tour Booking Manager plugin for WordPress versions up to and including 2.3.6 is vulnerable to stored cross-site scripting (XSS) via the 'width', 'height', and 'zoom' shortcode attributes of the [ttbm-hotel-map] shortcode. This vulnerability arises from insufficient input sanitization and output escaping in the ttbm_hotel_map_shortcode() function, allowing authenticated users with contributor-level access or higher to inject arbitrary scripts that execute when the affected page is viewed.
The s2Member WordPress plugin up to version 261011 is vulnerable to stored cross-site scripting (XSS) via the 'date_format' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, allowing payloads that bypass WordPress's wp_kses_post() filter by using backslash-escaped sequences that PHP's date() function converts into HTML tags at render time.
The easy.jobs WordPress plugin up to version 2.8.2 contains a stored cross-site scripting (XSS) vulnerability in the 'icon' attribute of its Gutenberg block. This flaw allows authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.
The Hustle plugin for WordPress, used for email marketing and lead generation, contains a stored cross-site scripting (XSS) vulnerability in the 'content[title]' parameter. This affects all versions up to and including 7.8.14.3. The flaw arises from insufficient input sanitization and output escaping, allowing authenticated users with custom-level access and the 'Create and Update Modules' capability to inject malicious scripts. This capability is not granted by default and must be explicitly assigned by an administrator via the plugin's permissions settings.
The Document Embedder plugin for WordPress up to version 2.4.0 is vulnerable to a stored DOM-based cross-site scripting (XSS) flaw. Authenticated users with contributor-level access or higher can inject malicious scripts via the 'content' parameter in post content JSON. The injected scripts execute when a user clicks the embedded document's Download button, exploiting an AJAX fallback that improperly handles authorization checks. This vulnerability arises from insufficient input sanitization and output escaping.
The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'conversion' shortcode attribute. This affects all versions up to and including 1.10.2. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages.
The Avada (Fusion) Builder plugin for WordPress versions up to and including 3.16.2 contains a stored cross-site scripting (XSS) vulnerability via the 'tab_index' and 'empty_notice' parameters. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with contributor-level access or higher to inject malicious scripts into pages. The wp_kses_post function does not remove the payload because the malicious content is embedded within shortcode attribute text, which is treated as plain text rather than HTML markup.
The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'url' parameter. This affects all versions up to and including 1.10.2. Authenticated users with contributor-level access or higher can inject malicious scripts that execute in administrator browser sessions when previewing or opening the affected post.
The Awesome Support WordPress plugin versions up to and including 6.4.1 contain a stored cross-site scripting (XSS) vulnerability via the 'wpas_files' parameter. This flaw allows authenticated users with custom-level access or higher to inject malicious scripts that execute when other users view the affected pages. Exploitation requires the 'Enable drag-n-drop uploader for ticket form' setting to be enabled, which is disabled by default.
The Postie plugin for WordPress versions up to and including 1.9.87 is vulnerable to stored cross-site scripting (XSS) via the Email Body URL Autolink feature. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. The ?postie=get-mail endpoint is accessible without authentication or capability checks, and the email processing removes WordPress's kses filters, enabling raw markup with unescaped href attributes to be stored as post content. This can lead to script execution when users access the injected content.
CVE-2026-16020 is a stored cross-site scripting (XSS) vulnerability in the DefterAsist Financial Advisor Platform by Fazile BACAK. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that persist on the platform. It affects versions up to and including 2026-10-27. The CVSS 3.1 base score is 5.4, indicating a medium severity level.
The Echo Knowledge Base plugin for WordPress has a reflected cross-site scripting (XSS) vulnerability in versions up to and including 17.214.0. This flaw arises from improper input sanitization and output escaping of the 'new_kb_config' parameter, allowing attacker-controlled JSON data to be injected into a style element. Exploitation requires tricking a user with Editor-level or higher privileges to perform an action such as clicking a crafted link, leading to script execution in their browser.