Skip to main content
Skip to footer
Opens in a new tab
Home
CVE Analysis
How it Works
Resources
Pricing
Log in
Create Account
Home
CVE Analysis
How it Works
Resources
Pricing
Log in
Create Account
Severity:
medium
CVE-2026-3619: Sheets2Table <= 0.4.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'titles' Shortcode Attribute PoC, Patch Analysis & Rule
March 28, 2026
CVE-2026-3619 affects the Sheets2Table plugin for WordPress (up to version 0.4.1) with a medium severity score of 6.4. Authenticated users…
CVE-2026-3617: Paypal Shortcodes <= 0.3 Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' and 'name' Shortcode Attributes PoC, Patch Analysis & Rule
March 28, 2026
CVE-2026-3617 affects the Paypal Shortcodes plugin for WordPress (up to v0.3) with a medium severity (CVSS 6.4) Stored XSS vulnerability.…
CVE-2026-3996: WP Games Embed <= 0.1beta Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
March 28, 2026
CVE-2026-3996 affects the WP Games Embed plugin (version 0.1beta) with a medium severity (CVSS 6.4) stored XSS vulnerability. Users should…
CVE-2026-3997: Text Toggle <= 1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute PoC, Patch Analysis & Rule
March 28, 2026
CVE-2026-3997 affects the Text Toggle plugin for WordPress (up to v1.1) with a medium severity (CVSS 6.4) Stored XSS vulnerability.…
CVE-2026-4072: WordPress PayPal Donation <= 1.01 Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' Shortcode Attribute PoC, Patch Analysis & Rule
March 28, 2026
CVE-2026-4072 affects the WordPress PayPal Donation plugin (up to v1.01) with a medium severity (CVSS 6.4) stored XSS vulnerability. Users…
CVE-2026-1914: FuseDesk <= 6.8 Authenticated (Contributor+) Stored Cross-Site Scripting via 'emailtext' Shortcode Attribute PoC, Patch Analysis & Rule
March 28, 2026
CVE-2026-1914 affects the FuseDesk WordPress plugin (up to version 6.8) with a medium severity CVSS score of 6.4 due to…
CVE-2026-2294: UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.09 Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update PoC, Patch Analysis & Rule
March 28, 2026
CVE-2026-2294 affects the Uipress Lite plugin (up to v3.5.09) with a CVSS score of 4.3. It allows authenticated users to…
CVE-2026-3651: Build App Online <= 1.0.23 Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX Action PoC, Patch Analysis & Rule
March 28, 2026
CVE-2026-3651 affects the Build App Online plugin (v1.0.23) with a CVSS score of 5.3. It allows unauthorized users to modify…
CVE-2026-3460: REST API TO MiniProgram <= 5.1.2 Authenticated (Subscriber+) Insecure Direct Object Reference via 'userid' REST API Parameter PoC, Patch Analysis & Rule
March 28, 2026
CVE-2026-3460 affects the Rest Api To Miniprogram plugin for WordPress (up to version 5.1.2) with a CVSS score of 5.3.…
CVE-2026-3641: Appmax <= 1.0.3 Missing Authorization to Order Status Manipulation and Arbitrary Order Creation via Webhook Endpoint PoC, Patch Analysis & Rule
March 28, 2026
CVE-2026-3641 affects the Appmax plugin for WordPress (up to version 1.0.3) with a CVSS score of 5.3. This medium severity…
CVE-2026-3353: Comment SPAM Wiper <= 1.2.1 Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Setting PoC, Patch Analysis & Rule
March 28, 2026
CVE-2026-3353 affects the Comment Spam Wiper plugin (up to v1.2.1) with a medium severity (CVSS 4.4) Stored XSS vulnerability. Admins…
CVE-2026-1886: Go Night Pro | WordPress Dark Mode Plugin <= 1.1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'margin' Shortcode Attribute PoC, Patch Analysis & Rule
March 28, 2026
CVE-2026-1886 affects the Go Night Pro plugin (v1.1.0) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated attackers can…
CVE-2026-3354: Wikilookup <= 1.1.5 Authenticated (Administrator+) Stored Cross-Site Scripting via 'Popup Width' Setting PoC, Patch Analysis & Rule
March 28, 2026
CVE-2026-3354 affects the Wikilookup plugin (up to v1.1.5) with a medium severity CVSS score of 4.4. It allows authenticated admins…
CVE-2026-1899: Any Post Slider <= 1.0.4 Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_type' Shortcode Attribute PoC, Patch Analysis & Rule
March 28, 2026
CVE-2026-1899 affects the Any Post Slider plugin (up to v1.0.4) with a medium severity (CVSS 6.4) XSS vulnerability. Authenticated attackers…
CVE-2026-3332: Xhanch My Advanced Settings <= 1.1.2 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
March 28, 2026
CVE-2026-3332 affects the Xhanch My Advanced Settings plugin (up to v1.1.2) with a medium severity (CVSS 4.3) CSRF vulnerability. Unauthenticated…
CVE-2026-3331: Lobot Slider Administrator <= 0.6.0 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
March 28, 2026
CVE-2026-3331 affects the Lobot Slider Administrator plugin for WordPress (up to v0.6.0) with a medium severity (CVSS 4.3) CSRF vulnerability.…
CVE-2026-3347: Multi Functional Flexi Lightbox <= 1.2 Authenticated (Admin+) Stored Cross-Site Scripting via 'message' Parameter PoC, Patch Analysis & Rule
March 28, 2026
CVE-2026-3347 affects the Multi Functional Flexi Lightbox plugin (up to v1.2) with a medium severity (CVSS 5.5) stored XSS vulnerability.…
CVE-2026-3335: Canto <= 3.1.1 Missing Authorization to Unauthenticated File Upload PoC, Patch Analysis & Rule
March 28, 2026
CVE-2026-3335 affects the Canto plugin for WordPress (up to 3.1.1) with a medium severity (CVSS 5.3) file upload vulnerability. Unauthenticated…
CVE-2026-3333: MinhNhut Link Gateway <= 3.6.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
March 26, 2026
CVE-2026-3333 affects the Minhnhut Link Gateway plugin for WordPress (up to version 3.6.1) with a medium severity (CVSS 6.4) XSS…
CVE-2026-2837: Ricerca – advanced search <= 1.1.12 Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings PoC, Patch Analysis & Rule
March 25, 2026
CVE-2026-2837 affects the Ricerca Smart Search plugin (up to v1.1.12) with a CVSS score of 4.4. This medium-severity XSS vulnerability…
←
1
…
55
56
57
58
59
…
120
→