The UiChemy plugin for WordPress, used to convert Figma, prompts, and AI builds to page builders like Elementor, Gutenberg, and Bricks, contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 5.3.0. This vulnerability arises from insufficient input sanitization and output escaping of a specific URL parameter, allowing authenticated users with contributor-level access or higher to inject malicious scripts. The injected script executes when a privileged user clicks the crafted link, potentially compromising their session or data.
The If-So Dynamic Content – Elementor & All Page Builders Personalization WordPress plugin versions up to 1.10.2 contain a stored cross-site scripting (XSS) vulnerability via the 'url' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute in administrator browsers when previewing or opening affected posts. This vulnerability arises from insufficient input sanitization and output escaping in the plugin.
MxChat – AI Chatbot & Content Generation for WordPress plugin versions up to 3.2.25 are vulnerable to a stored DOM-based Cross-Site Scripting (XSS) flaw via the 'feedback' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrator views the Transcripts page. The issue arises from insufficient input sanitization and output escaping of user-supplied data.
The Awesome Support WordPress plugin up to version 6.4.1 contains a stored cross-site scripting (XSS) vulnerability via the 'wpas_files' parameter. This flaw allows authenticated users with custom-level access or higher to inject malicious scripts that execute when other users view the affected pages. Exploitation requires the 'Enable drag-n-drop uploader for ticket form' setting to be enabled, which is disabled by default.
CVE-2026-113488 is a stored cross-site scripting (XSS) vulnerability in the GeoDirectory WordPress plugin versions before 2.8.196. It arises from improper escaping of a post badge shortcode attribute in a JavaScript context, allowing users with Contributor role or higher to inject malicious scripts. These scripts execute when anyone, including administrators, clicks the badge. The vulnerability has a CVSS score of 6.8, indicating a medium severity impact. A fix is available in version 2.8.196.
CVE-2026-113487 is a stored cross-site scripting (XSS) vulnerability in the GeoDirectory WordPress plugin before version 2.8.196. It arises because the plugin does not properly sanitize or escape a post badge click-through link value before outputting it in an anchor element on a listing. This flaw allows users with Contributor role or higher to inject malicious scripts that execute when higher-privileged users, such as administrators, view the affected listing.
A Cross-site Scripting (XSS) vulnerability exists in the MP3 Audio Player WordPress plugin versions 5.9 up to but not including 5.16. The flaw allows users with Contributor-level access or higher to inject arbitrary JavaScript via an unescaped shortcode attribute, which executes when another user, such as an administrator previewing a post, views the content. This vulnerability is fixed in version 5.16.
CVE-2026-111021 is a reflected Cross-Site Scripting (XSS) vulnerability in the Persian WooCommerce SMS WordPress plugin versions 7.2.0 up to but not including 7.3.2. The flaw arises because the plugin fails to properly sanitize and escape a parameter before reflecting it into an HTML attribute. This allows an attacker to execute malicious scripts in the browser session of a logged-in privileged user who is tricked into submitting a crafted request. The vulnerability has a high severity score of 7.1 and was fixed in version 7.3.2.
A stored cross-site scripting (XSS) vulnerability exists in the Copy Anything to Clipboard for WordPress plugin before version 5.5.5. The flaw arises because the plugin does not properly sanitize and escape a shortcode attribute before storing it and rendering it back into the page via client-side script. This allows users with contributor role or higher to inject malicious scripts that execute when higher-privileged users view the affected content.
CVE-2026-110506 is a stored cross-site scripting (XSS) vulnerability in the Page Builder by SiteOrigin WordPress plugin versions before 2.38.0. The flaw arises because the plugin does not properly sanitize or escape a widget property before storing and displaying it in the page builder interface. This allows users with contributor roles or higher to inject malicious scripts that execute when higher-privileged users open the affected post in the editor.
CVE-2026-107098 is a cross-site scripting (XSS) vulnerability in the Royal Addons for Elementor WordPress plugin versions from 1.7.1037 up to but not including 1.7.1070. The flaw arises because the plugin does not properly sanitize and escape a map widget's size setting before inserting it into an HTML attribute. This allows users with Contributor role or higher to inject JavaScript that executes in the browsers of users viewing the affected page, including administrators reviewing submissions. The vulnerability is fixed in version 1.7.1070.
CVE-2026-105972 is a Cross-Site Scripting (XSS) vulnerability in the Menu Cart for WooCommerce WordPress plugin versions before 3.2.1. The flaw arises because the plugin does not properly sanitize and escape cart item variation data before displaying it in the cart slide-out. This allows unauthenticated attackers to inject malicious scripts that execute in the context of other users' sessions, including administrators. The vulnerability has a high severity with a CVSS score of 7.5 and was fixed in version 3.2.1.
The Appointment Booking Calendar WordPress plugin up to version 1.4.05 contains a stored cross-site scripting (XSS) vulnerability via the 'vs_text_submitbtn' parameter. Authenticated users with subscriber-level access or higher can exploit this if assigned as a calendar owner by an administrator. This allows injection of arbitrary scripts that execute when users view the affected pages. By default, exploitation requires editor-level access or higher if no calendar ownership is assigned to lower roles.