Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MemberPress Corporate Accounts",
          "vendor": "MemberPress",
          "versions": [
            {
              "lessThanOrEqual": "1.5.39",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "andrea bocchetti"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the \u0027add_sub_account_user\u0027 function that passes the raw \u0027userdata\u0027 array to \u0027wp_insert_user\u0027 without filtering dangerous keys like role or ID. This makes it possible for authenticated attackers, with subscriber-level access and above who hold a corporate account, to create new administrator accounts or hijack existing administrator accounts by overwriting their email addresses. The vulnerability was partially patched in version 1.5.39."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-12T12:30:04.807Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ba49bbf9-649b-456e-bab8-9f0f74bdbaee?source=cve"
        },
        {
          "url": "https://memberpress.com/addons/corporate-accounts/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-10T19:58:56.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-11T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "MemberPress Corporate Accounts \u003c= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account Creation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-15451",
    "datePublished": "2026-09-12T12:30:04.807Z",
    "dateReserved": "2026-07-10T19:35:20.741Z",
    "dateUpdated": "2026-09-12T12:30:04.807Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Booking for Appointments and Events Calendar \u2013 Amelia",
          "vendor": "melograno",
          "versions": [
            {
              "lessThanOrEqual": "2.4.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nguyen Anh Quan (prototw)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the \u0027load_manually\u0027 parameter in the render() methods of classes. This makes it possible for authenticated attackers, with Contributor-level access and above who can use Elementor, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 2.4.8."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-12T12:30:04.247Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/06ec5c60-169c-4bbb-92bf-802805d46c62?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Infrastructure/WP/Elementor/AmeliaStepBookingElementorWidget.php#L226"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.2.1/src/Infrastructure/WP/Elementor/AmeliaStepBookingElementorWidget.php#L226"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Infrastructure/WP/Elementor/AmeliaStepBookingElementorWidget.php#L200"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.2.1/src/Infrastructure/WP/Elementor/AmeliaStepBookingElementorWidget.php#L200"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Infrastructure/WP/Elementor/AmeliaEventsElementorWidget.php#L134"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.2.1/src/Infrastructure/WP/Elementor/AmeliaEventsElementorWidget.php#L134"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Infrastructure/WP/Elementor/AmeliaEventsCalendarBookingElementorWidget.php#L186"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.2.1/src/Infrastructure/WP/Elementor/AmeliaEventsCalendarBookingElementorWidget.php#L186"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Infrastructure/WP/Elementor/AmeliaEventsListBookingElementorWidget.php#L247"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.2.1/src/Infrastructure/WP/Elementor/AmeliaEventsListBookingElementorWidget.php#L247"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3657136/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3687762/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-29T23:09:50.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-11T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Booking for Appointments and Events Calendar \u2013 Amelia \u003c= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027load_manually\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-10148",
    "datePublished": "2026-09-12T12:30:04.247Z",
    "dateReserved": "2026-05-29T22:53:59.941Z",
    "dateUpdated": "2026-09-12T12:30:04.247Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "DT LMS \u2013 elearning,  WordPress LMS Plugin",
          "vendor": "designthemes",
          "versions": [
            {
              "lessThanOrEqual": "1.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "adhikara13"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The DT LMS \u2013 elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers (including dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings) in versions up to, and including, 1.1. These handlers are registered on the wp_ajax_nopriv_* hook and contain no capability check, no nonce verification, and pass user-supplied data directly to update_option(). This makes it possible for unauthenticated attackers to overwrite arbitrary plugin option values stored in the wp_options table, including Point-of-Contact email configuration and skin/branding settings, which can be used to alter the appearance and behavior of the LMS for all site visitors."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-12T07:39:16.702Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fe5bd645-0707-43ce-9316-d52f60035754?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/dt-lms-lite/trunk/settings/settings-poc-utils.php#L102"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/dt-lms-lite/trunk/settings/settings-poc-utils.php#L97"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/dt-lms-lite/trunk/settings/settings-utils.php#L59"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/dt-lms-lite/trunk/settings/settings-utils.php#L53"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/dt-lms-lite/trunk/settings/settings-utils.php#L15"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3585901%40dt-lms-lite\u0026new=3585901%40dt-lms-lite"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-11T18:48:09.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "DT LMS \u003c= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-11355",
    "datePublished": "2026-09-12T07:39:16.702Z",
    "dateReserved": "2026-06-05T11:27:17.361Z",
    "dateUpdated": "2026-09-12T07:39:16.702Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Smart Marketing SMS and Newsletters Forms",
          "vendor": "egoi",
          "versions": [
            {
              "lessThanOrEqual": "5.1.24",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the plugin\u0027s sync feature to be enabled (options[\u0027enabled\u0027]) and get_option(\u0027egoi_mapping\u0027) to be truthy, both of which reflect ordinary configured states for the plugin\u0027s core contact mapping functionality."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-12T07:39:16.304Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f14e3f20-b022-49f8-89b0-acca9b950cb8?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/smart-marketing-for-wp/trunk/includes/class-egoi-for-wp.php#L841"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/smart-marketing-for-wp/trunk/admin/class-egoi-for-wp-listener.php#L132"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/smart-marketing-for-wp/trunk/admin/class-egoi-for-wp-listener.php#L183"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/smart-marketing-for-wp/trunk/includes/class-egoi-for-wp.php#L908"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3663923%40smart-marketing-for-wp\u0026new=3663923%40smart-marketing-for-wp"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-11T18:42:11.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Smart Marketing SMS and Newsletters Forms \u003c= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-77161",
    "datePublished": "2026-09-12T07:39:16.304Z",
    "dateReserved": "2026-08-20T14:49:19.735Z",
    "dateUpdated": "2026-09-12T07:39:16.304Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Tutor LMS \u2013 eLearning and online course solution",
          "vendor": "themeum",
          "versions": [
            {
              "lessThanOrEqual": "4.0.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Chloe Chamberland"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence Argus"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Tutor LMS \u2013 eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc_sql()`, which replaces every `%` character with a 66-byte HMAC placeholder token before the data is serialized and stored via `update_user_meta()`; when the meta is later retrieved, the placeholder is collapsed back to a single `%`, leaving serialized string length declarations 65 bytes greater than the actual content, and because array keys originate from entirely unescaped POST field names, `unserialize()` over-reads into attacker-controlled bytes, allowing injection of an arbitrary serialized object stream. This makes it possible for authenticated attackers, with subscriber-level access and above, to achieve remote code execution on the server by triggering the `GuzzleHttp\\Cookie\\FileCookieJar` POP chain, reachable via the `spl_autoload_register` loader in `TUTOR\\RestAPI` which loads the plugin\u0027s own bundled PayPal Composer autoloader, writing attacker-controlled content to an attacker-specified filename. This has an unauthenticated pathway when user registration is enabled, which is common for students and teachers to register, and it requires the monetization feature to be enabled."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-12T07:39:15.920Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d0077d56-11e7-4e74-abe0-63e81db67be3?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Withdraw.php#L213"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Withdraw.php#L217"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Withdraw.php#L204"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Withdraw.php#L44"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/RestAPI.php#L190"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3690454%40tutor\u0026new=3690454%40tutor"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-23T15:54:24.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-11T18:49:43.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Tutor LMS \u003c= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-78175",
    "datePublished": "2026-09-12T07:39:15.920Z",
    "dateReserved": "2026-08-23T15:39:15.798Z",
    "dateUpdated": "2026-09-12T07:39:15.920Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "The Events Calendar",
          "vendor": "stellarwp",
          "versions": [
            {
              "lessThanOrEqual": "6.17.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Chloe Chamberland"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence Argus"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget \u0027classes\u0027 map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-12T07:39:15.542Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cc2ccfeb-6df6-4fee-96a5-94f8dd131f7c?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/common/src/Tribe/Utils/Element_Classes.php#L211"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/views/v2/components/messages.php#L30"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Widgets/Service_Provider.php#L279"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Template_Bootstrap.php#L214"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3667866%40the-events-calendar\u0026new=3667866%40the-events-calendar"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3667867%40the-events-calendar\u0026new=3667867%40the-events-calendar"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-23T11:54:47.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-11T18:40:37.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "The Events Calendar \u003c= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget \u0027classes\u0027 Map Callable Invocation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-78159",
    "datePublished": "2026-09-12T07:39:15.542Z",
    "dateReserved": "2026-08-23T11:39:39.155Z",
    "dateUpdated": "2026-09-12T07:39:15.542Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "The Events Calendar",
          "vendor": "stellarwp",
          "versions": [
            {
              "lessThanOrEqual": "6.17.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Chloe Chamberland"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence Argus"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable without authentication or approval because the plugin\u0027s V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that allows an unauthenticated commenter to immediately view their own pending comment, delivering the injected block markup to the vulnerable code path before any moderation occurs. This does require comments to be enabled and visible on events."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-12T07:39:15.165Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a0c67346-534a-4b67-a904-fa148703707a?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Template_Bootstrap.php#L213"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Widgets/Service_Provider.php#L295"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Widgets/Service_Provider.php#L255"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Collections/Lazy_Post_Collection.php#L82"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/common/src/Tribe/Utils/Collection_Trait.php#L247"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3690576%40the-events-calendar\u0026new=3690576%40the-events-calendar"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-21T22:52:17.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-11T18:39:45.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "The Events Calendar \u003c= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-78006",
    "datePublished": "2026-09-12T07:39:15.165Z",
    "dateReserved": "2026-08-21T21:25:40.295Z",
    "dateUpdated": "2026-09-12T07:39:15.165Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MPG \u2013 Multiple Page Generator, Bulk Landing Pages \u0026 Programmatic SEO",
          "vendor": "themeisle",
          "versions": [
            {
              "lessThanOrEqual": "4.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nhien Pham (nhienit) (nhienit)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "thevietronin"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The MPG \u2013 Multiple Page Generator, Bulk Landing Pages \u0026 Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when the [mpg_spintax] shortcode is rendered in site-wide content such as a footer or template part, as the vulnerable code path is only reached when the shortcode is active on the requested page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-12T07:39:14.796Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/677004db-d8ac-410c-89d9-ee841d643ef7?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.2.0/controllers/SpintaxController.php#L66"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.2.0/helpers/Helper.php#L215"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.2.0/controllers/HookController.php#L594"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.1.7/controllers/SpintaxController.php#L66"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.1.7/helpers/Helper.php#L215"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.1.7/controllers/HookController.php#L594"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3687328%40multiple-pages-generator-by-porthas\u0026new=3687328%40multiple-pages-generator-by-porthas"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-03T13:08:05.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-11T18:53:30.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "MPG \u003c= 4.2.1 - Unauthenticated SQL Injection via URL Path"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-85198",
    "datePublished": "2026-09-12T07:39:14.796Z",
    "dateReserved": "2026-09-03T12:52:53.344Z",
    "dateUpdated": "2026-09-12T07:39:14.796Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor",
          "vendor": "wproyal",
          "versions": [
            {
              "lessThanOrEqual": "1.7.1066",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "TarPeg007"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1066 via the \u0027wpr_keyword\u0027 parameter. This makes it possible for unauthenticated attackers to extract arbitrary postmeta values from all published posts via character-by-character substring matching across the entire wp_postmeta table. The required nonce is emitted publicly via wp_localize_script on any frontend page that loads a Royal Elementor widget, meaning no authenticated session or prior action is needed to obtain it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-12T07:39:14.425Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5eab79e6-cb47-4fe7-993a-e833bd6689f8?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1064/classes/modules/wpr-ajax-search.php#L155"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1064/classes/modules/wpr-ajax-search.php#L115"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1064/classes/modules/wpr-ajax-search.php#L23"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1064/plugin.php#L655"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1061/classes/modules/wpr-ajax-search.php#L155"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1061/classes/modules/wpr-ajax-search.php#L115"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1061/classes/modules/wpr-ajax-search.php#L23"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1061/plugin.php#L655"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-27T16:13:04.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-11T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Royal Addons for Elementor \u003c= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in \u0027wpr_keyword\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-17585",
    "datePublished": "2026-09-12T07:39:14.425Z",
    "dateReserved": "2026-07-27T15:57:56.711Z",
    "dateUpdated": "2026-09-12T07:39:14.425Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GEO my WP",
          "vendor": "ninjew",
          "versions": [
            {
              "lessThanOrEqual": "4.5.5.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "yck"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmw_posts_locator_ajax_info_window_loader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. In environments where PEAR is installed with register_argc_argv enabled, this file inclusion can be leveraged to write and execute arbitrary PHP code, achieving full remote code execution."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-98",
              "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-12T07:39:14.056Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/562712a8-a42e-4b36-9985-3c71698efdda?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/geo-my-wp/tags/4.5.5.3/plugins/posts-locator/includes/gmw-posts-locator-functions.php#L975"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/geo-my-wp/tags/4.5.5.3/plugins/posts-locator/includes/gmw-posts-locator-functions.php#L964"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/geo-my-wp/tags/4.5.5.3/includes/gmw-functions.php#L1945"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/geo-my-wp/tags/4.5.5.3/includes/gmw-functions.php#L1987"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/geo-my-wp/tags/4.5.5.1/plugins/posts-locator/includes/gmw-posts-locator-functions.php#L975"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/geo-my-wp/tags/4.5.5.1/plugins/posts-locator/includes/gmw-posts-locator-functions.php#L964"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/geo-my-wp/tags/4.5.5.1/includes/gmw-functions.php#L1945"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/geo-my-wp/tags/4.5.5.1/includes/gmw-functions.php#L1987"
        },
        {
          "url": "https://github.com/Fitoussi/geo-my-wp/commit/5a768bf1c6e44ded83a65be8789f3587515665ac"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-03T13:10:28.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-11T18:52:40.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "GEO my WP \u003c= 4.5.5.3 - Unauthenticated Local File Inclusion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-85200",
    "datePublished": "2026-09-12T07:39:14.056Z",
    "dateReserved": "2026-09-03T12:54:35.397Z",
    "dateUpdated": "2026-09-12T07:39:14.056Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "rtMedia for WordPress, BuddyPress and bbPress",
          "vendor": "rtcamp",
          "versions": [
            {
              "lessThanOrEqual": "4.7.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the \u0027compare\u0027 parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is exploitable on any public page containing an rtMedia shortcode (e.g., [rtmedia_gallery]) when the rtmedia_shortcode GET parameter is set, because RTMediaQuery::query() merges $_REQUEST into the internal query while only validating top-level array keys, allowing the nested \u0027compare\u0027 subvalue to reach the vulnerable sink without authentication."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-12T07:39:13.454Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/53d9b351-ba17-431a-b371-7dc1a87bd757?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/buddypress-media/tags/4.7.11/app/helper/RTMediaModel.php#L116"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/buddypress-media/tags/4.7.11/app/helper/RTMediaModel.php#L105"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/buddypress-media/tags/4.7.11/app/main/routers/query/RTMediaQuery.php#L611"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3652137/buddypress-media/tags/4.7.12/app/helper/db/RTDBModel.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-11T18:44:17.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "rtMedia for WordPress, BuddyPress and bbPress \u003c= 4.7.11 - Unauthenticated SQL Injection via \u0027compare\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-16482",
    "datePublished": "2026-09-12T07:39:13.454Z",
    "dateReserved": "2026-07-21T15:15:26.548Z",
    "dateUpdated": "2026-09-12T07:39:13.454Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15439",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T17:53:03.846559Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T17:53:11.894Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GamiPress \u2013 Gamification plugin to reward points, badges \u0026 ranks in WordPress, now with AI",
          "vendor": "rubengc",
          "versions": [
            {
              "lessThanOrEqual": "7.9.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nox Axter"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the \u0027q\u0027 parameter of the wpForo integration AJAX selector (action gamipress_wpforo_get_posts) in versions up to, and including, 7.9.7. The value is passed only through $wpdb-\u003eesc_like() and interpolated directly into a single-quoted LIKE clause with no %s placeholder. Because esc_like() runs after WordPress core magic quotes, it doubles the injected backslash (\\\u0027 -\u003e \\\\\u0027), which MySQL reads as one literal backslash followed by a live closing quote, allowing the attacker to break out of the string and inject boolean-based SQL. The wpForo plugin only needs to be active to register the callback; no wpForo vulnerability is used. Requires a Subscriber account, which can read the gamipress_admin nonce (exposed on every admin page, e.g. /wp-admin/profile.php). Note: the researcher\u0027s Simple:Press vectors (PoC 2 \u0026 3) do not reproduce in current code, which uses $wpdb-\u003eprepare() with %s placeholders; only the wpForo selector is confirmed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T15:27:51.708Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/72ad7420-5793-496e-8607-2b346c7a3ce5?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.3/integrations/wpforo/includes/functions.php#L40"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.3/integrations/wpforo/includes/functions.php#L24"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-10T14:36:16.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "GamiPress \u003c= 7.9.7 - Authenticated (Subscriber+) SQL Injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-15439",
    "datePublished": "2026-09-11T15:27:51.708Z",
    "dateReserved": "2026-07-10T18:24:33.819Z",
    "dateUpdated": "2026-09-11T17:53:11.894Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-12145",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T20:09:41.998791Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T20:19:12.097Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuddyPress",
          "vendor": "buddypress",
          "versions": [
            {
              "lessThanOrEqual": "14.3.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Brian Mungai"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bp_notifications_action_bulk_manage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete/mark as read/mark as unread notifications of other users."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:28:52.377Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8c2965c0-a07f-46a2-b06c-fa2e739aea94?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3259392/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-11-16T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2026-09-10T21:43:29.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "BuddyPress \u003c= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-12145",
    "datePublished": "2026-09-11T11:28:52.377Z",
    "dateReserved": "2024-12-04T11:44:00.635Z",
    "dateUpdated": "2026-09-11T20:19:12.097Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-17037",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T11:11:15.931585Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T11:12:01.482Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kirki \u2013 Freeform Page Builder, Website Builder \u0026 Customizer",
          "vendor": "themeum",
          "versions": [
            {
              "lessThanOrEqual": "6.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "daroo"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Kirki \u2013 Freeform Page Builder, Website Builder \u0026 Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018comment\u2019 parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T09:27:20.479Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e578af07-90ec-4bd4-91ec-b793bbccf977?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3636487/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-17T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2026-07-24T12:44:05.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-10T20:46:28.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Kirki \u003c= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via \u0027comment\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-17037",
    "datePublished": "2026-09-11T09:27:20.479Z",
    "dateReserved": "2026-07-24T12:23:20.492Z",
    "dateUpdated": "2026-09-11T11:12:01.482Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6640",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T13:37:41.497522Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T13:46:23.081Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Media Library Assistant",
          "vendor": "dglingren",
          "versions": [
            {
              "lessThanOrEqual": "3.35",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "normaandersonfrank"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027mla_link_attributes\u0027 parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:39:07.997Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac0abf8e-6efd-4cf5-ad03-8442d892a35f?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-tag-cloud.php#L1089-L1106"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.34/includes/class-mla-shortcode-tag-cloud.php#L1089-L1106"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-support.php#L270-L283"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.34/includes/class-mla-shortcode-support.php#L270-L283"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-tag-cloud.php#L1041-L1046"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.34/includes/class-mla-shortcode-tag-cloud.php#L1041-L1046"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-tag-cloud.php#L76-L95"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.34/includes/class-mla-shortcode-tag-cloud.php#L76-L95"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3512155/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-20T05:06:29.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-10T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Media Library Assistant \u003c= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-6640",
    "datePublished": "2026-09-11T07:39:07.997Z",
    "dateReserved": "2026-04-19T21:52:53.691Z",
    "dateUpdated": "2026-09-11T13:46:23.081Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6642",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T16:31:49.370014Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T20:30:25.014Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Media Library Assistant",
          "vendor": "dglingren",
          "versions": [
            {
              "lessThanOrEqual": "3.35",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "TruongLV1 From FPT Night Wolf"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts in the mla_generate_bulk_edit_form_fieldsets() function and mla-bulk-edit-fieldsets.tpl template. While wp_kses() filtering is applied during preset export for users without unfiltered_html capability, this does not prevent attribute injection attacks since the malicious payload consists of quotes and HTML attributes rather than HTML tags. When preset values are retrieved and rendered, they are directly assigned to template variables without esc_attr() escaping and then inserted into input element value attributes via simple string replacement. This makes it possible for authenticated attackers, with Author-level access and above (upload_files capability), to inject arbitrary web scripts that execute when an administrator imports the poisoned preset and the targeted input field receives focus."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:39:07.110Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6e45dc8a-b777-4a49-b1b1-c59ffa75f5b4?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/tpls/mla-bulk-edit-fieldsets.tpl#L70"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.35/tpls/mla-bulk-edit-fieldsets.tpl#L70"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-edit-media.php#L647-L651"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.35/includes/class-mla-edit-media.php#L647-L651"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-ajax.php#L395"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.35/includes/class-mla-ajax.php#L395"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3512155/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-20T05:06:52.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-10T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Media Library Assistant \u003c= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-6642",
    "datePublished": "2026-09-11T07:39:07.110Z",
    "dateReserved": "2026-04-19T22:17:10.138Z",
    "dateUpdated": "2026-09-11T20:30:25.014Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6641",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T13:58:07.817647Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T13:58:17.628Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Media Library Assistant",
          "vendor": "dglingren",
          "versions": [
            {
              "lessThanOrEqual": "3.35",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "gidget smith"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027mla_gallery\u0027 shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mla_link_href parameter when mla_output is set to \u0027paginate_links\u0027, where the _paginate_links() function processes the value through mla_process_shortcode_parameter() and _replace_query_parameter() without proper URL escaping, then outputs it directly in href attributes without applying esc_url(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:39:06.595Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/13602c35-a0f7-4651-af9a-0be9e581893a?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.34/includes/class-mla-shortcodes.php#L39"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-support.php#L2484"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.34/includes/class-mla-shortcode-support.php#L2484"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-support.php#L2449"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.34/includes/class-mla-shortcode-support.php#L2449"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcodes.php#L39"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3512155/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-20T05:06:38.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-10T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Media Library Assistant \u003c= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027mla_link_href\u0027 Shortcode Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-6641",
    "datePublished": "2026-09-11T07:39:06.595Z",
    "dateReserved": "2026-04-19T22:06:28.199Z",
    "dateUpdated": "2026-09-11T13:58:17.628Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-78172",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T20:11:02.523148Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T20:19:12.263Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Themify \u2013 WooCommerce Product Filter",
          "vendor": "themifyme",
          "versions": [
            {
              "lessThanOrEqual": "1.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Adrien Brunner"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Themify \u2013 WooCommerce Product Filter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query Parameter Name in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T03:39:40.053Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ee8e5848-8aa8-489a-9563-aefc0aa62dec?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/themify-wc-product-filter/tags/1.5.5/includes/class-wpf-utils.php#L464"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/themify-wc-product-filter/tags/1.5.5/public/class-wpf-public.php#L937"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/themify-wc-product-filter/tags/1.5.5/public/class-wpf-public.php#L87"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3675210%40themify-wc-product-filter%2Ftrunk\u0026old=3529222%40themify-wc-product-filter%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-29T05:42:30.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-10T14:47:16.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Themify \u2013 WooCommerce Product Filter \u003c= 1.5.5 - Reflected Cross-Site Scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-78172",
    "datePublished": "2026-09-11T03:39:40.053Z",
    "dateReserved": "2026-08-23T14:49:36.284Z",
    "dateUpdated": "2026-09-11T20:19:12.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-7438",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T13:37:21.704766Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T13:46:23.403Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Bold Timeline Lite",
          "vendor": "boldthemes",
          "versions": [
            {
              "lessThanOrEqual": "1.2.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "zaim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `supertitle` and `subtitle` attributes of the `bold_timeline_item` shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T03:39:39.542Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e739b324-f833-4b31-8d4c-40538c924ddf?source=cve"
        },
        {
          "url": "https://wordpress.org/plugins/bold-timeline-lite"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/bold-timeline-lite/trunk/assets/views/bold_timeline_item_view.php#L202"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/bold-timeline-lite/tags/1.2.8/assets/views/bold_timeline_item_view.php#L202"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/bold-timeline-lite/trunk/assets/views/bold_timeline_item_view.php#L204"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/bold-timeline-lite/tags/1.2.8/assets/views/bold_timeline_item_view.php#L204"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/bold-timeline-lite/tags/1.2.8/content_elements/bold_timeline_item/bold_timeline_item.php#L10"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3556837%40bold-timeline-lite%2Ftrunk%2Fassets%2Fviews%2Fbold_timeline_item_view.php\u0026old=3417223%40bold-timeline-lite%2Ftrunk%2Fassets%2Fviews%2Fbold_timeline_item_view.php\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-05T08:40:19.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-10T14:34:47.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Bold Timeline Lite \u003c= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-7438",
    "datePublished": "2026-09-11T03:39:39.542Z",
    "dateReserved": "2026-04-29T15:43:27.737Z",
    "dateUpdated": "2026-09-11T13:46:23.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19991",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T16:31:53.747796Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T20:30:39.441Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "UsersWP \u2013 Front-end login form, User Registration, User Profile \u0026 Members Directory plugin for WP",
          "vendor": "stiofansisland",
          "versions": [
            {
              "lessThanOrEqual": "1.2.70",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "daroo"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload_file_remove() AJAX handler. The plugin stores the value of an account \u0027file\u0027 form field taken directly from $_POST when no real $_FILES upload is provided (process_account() calls uwp_validate_fields() and array_merges the result with the empty output of UsersWP_Files::validate_uploads()). At storage time the value is only checked with validate_file(), which passes any string that does not contain a literal \u0027../\u0027. When the value is later processed by upload_file_remove(), it is again gated with validate_file() and then normalized through uwp_get_file_relative_url(); that helper performs a global str_replace() of the uploads base URL against the stored URL, allowing a crafted URL containing embedded \u0027..\u003cuploads-baseurl\u003e\u0027 tokens to collapse into \u0027../../\u0027 traversal sequences after the last validation. The transformed value is then appended to the uploads base directory and passed to wp_delete_file() without any canonical containment check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the affected site\u0027s server (including wp-config."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T03:39:39.185Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dfa094d3-e8db-4402-ad23-e161b1b6181e?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.70/includes/class-forms.php#L2432"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.70/includes/helpers/misc.php#L2107"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.70/includes/class-forms.php#L2420"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.70/includes/class-validation.php#L194"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.70/includes/class-forms.php#L2076"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3650759%40userswp%2Ftrunk\u0026old=3618724%40userswp%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-16T17:48:58.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-10T14:40:42.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "UsersWP \u003c= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-19991",
    "datePublished": "2026-09-11T03:39:39.185Z",
    "dateReserved": "2026-08-16T17:24:16.224Z",
    "dateUpdated": "2026-09-11T20:30:39.441Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18562",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T16:04:36.389080Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T16:04:49.511Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "HUSKY \u2013 Products Filter for WooCommerce Professional",
          "vendor": "realmag777",
          "versions": [
            {
              "lessThanOrEqual": "1.4.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kuba"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The HUSKY \u2013 Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. This is due to insufficient input sanitization and output escaping in the wp_load_js() function, which reads filter values from the URL path via the url_request extension\u0027s parse_url_query() and embeds them into an inline JavaScript string using json_encode() without escaping single quotes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T03:39:38.824Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dca6bd12-5adf-48fa-b24f-198f13250080?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/tags/1.4.1/index.php#L1116"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/tags/1.4.1/ext/url_request/classes/url_parser.php#L478"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/tags/1.4.1/ext/url_request/classes/url_parser.php#L462"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/tags/1.4.1/ext/url_request/classes/url_parser.php#L492"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3640571%40woocommerce-products-filter%2Ftrunk\u0026old=3637824%40woocommerce-products-filter%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-01T18:36:40.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-10T14:51:16.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "HUSKY \u003c= 1.4.3 - Reflected Cross-Site Scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-18562",
    "datePublished": "2026-09-11T03:39:38.824Z",
    "dateReserved": "2026-08-01T18:21:10.820Z",
    "dateUpdated": "2026-09-11T16:04:49.511Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19985",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T14:09:50.573564Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T14:10:13.313Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Relevanssi \u2013 A Better Search",
          "vendor": "comesio",
          "versions": [
            {
              "lessThanOrEqual": "4.28.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mutantgun"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Relevanssi \u2013 A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the \u0027s\u0027, \u0027post_types\u0027, and \u0027orderby\u0027 request parameters. This is due to insufficient input sanitization and output escaping in the relevanssi_debug_array() function in lib/debug.php, which dumps user-supplied query variables through print_r() inside a \u003cpre\u003e block without HTML escaping. The debug path is enabled by supplying the relevanssi_debug=on request parameter when the administrator has previously enabled the \u0027Debugging mode\u0027 setting; the gate itself is a configuration check with no capability, nonce, or logged-in check (the vendor explicitly suppresses nonce verification on that line). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T03:39:38.495Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d07fe28c-f76e-42b2-b894-be316004235a?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.27.2/lib/search.php#L132"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.27.2/lib/search.php#L143"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.1/lib/debug.php#L68"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.1/lib/search.php#L132"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.1/lib/search.php#L143"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.1/lib/debug.php#L27"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.1/lib/search.php#L562"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.27.2/lib/debug.php#L68"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.27.2/lib/debug.php#L27"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.27.2/lib/search.php#L562"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3650355%40relevanssi%2Ftrunk\u0026old=3529670%40relevanssi%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-16T14:08:59.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-10T14:41:38.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Relevanssi \u003c= 4.28.1 - Reflected Cross-Site Scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-19985",
    "datePublished": "2026-09-11T03:39:38.495Z",
    "dateReserved": "2026-08-16T13:53:20.548Z",
    "dateUpdated": "2026-09-11T14:10:13.313Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11446",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T16:35:24.063578Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T16:37:36.654Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Booktics \u2013 Appointment Booking Calendar for Service Businesses",
          "vendor": "arraytics",
          "versions": [
            {
              "lessThanOrEqual": "1.0.23",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "revblock"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Booktics \u2013 Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create_order_permission() permission callback on the POST /wp-json/booktics/v1/orders REST route unconditionally returning true, combined with find_and_update_guest() overwriting an existing customer record\u0027s stored name, phone, and wp_user_id whenever the caller-supplied email matches, with no proof of ownership. This makes it possible for unauthenticated attackers to overwrite the contact details (name and phone) of any existing customer whose email address they know, poisoning downstream reminder emails, SMS, calendar invites, and CRM data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T03:39:38.143Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c86956bf-b013-4a84-b77e-8b1007238b27?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.21/core/order/controllers/order-controller.php#L172"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.21/core/order/controllers/order-controller.php#L885"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.18/core/order/controllers/order-controller.php#L172"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.18/core/order/controllers/order-controller.php#L863"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-06T10:02:44.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-10T14:53:08.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Booktics \u2013 Booking Calendar for Appointments and Service Businesses \u003c= 1.0.23 - Missing Authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-11446",
    "datePublished": "2026-09-11T03:39:38.143Z",
    "dateReserved": "2026-06-06T09:47:28.518Z",
    "dateUpdated": "2026-09-11T16:37:36.654Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-81754",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T14:10:47.820823Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T14:11:09.418Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Vigilant \u2013 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner\u2026",
          "vendor": "fernandot",
          "versions": [
            {
              "lessThanOrEqual": "2.10.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sebastian Albrecht"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Vigilant \u2013 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner\u2026 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is delivered passively by any unauthenticated visitor who triggers a failed login attempt with a crafted User-Agent header, requiring no further interaction from the attacker once stored."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T03:39:37.805Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c483cdc5-56e4-4ee7-a782-0505816728ab?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/vigilante/tags/2.9.5/includes/class-database.php#L448"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/vigilante/tags/2.9.5/includes/class-database.php#L639"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/vigilante/tags/2.9.5/assets/js/admin.js#L1996"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/vigilante/tags/2.9.5/assets/js/admin.js#L2778"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/vigilante/tags/2.9.5/includes/class-login-security.php#L899"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3669625%40vigilante%2Ftrunk%2Fassets%2Fjs%2Fadmin.js\u0026old=3667821%40vigilante%2Ftrunk%2Fassets%2Fjs%2Fadmin.js\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-27T21:51:13.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-10T14:46:45.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Vigilant \u003c= 2.10.2 - Unauthenticated Stored Cross-Site Scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-81754",
    "datePublished": "2026-09-11T03:39:37.805Z",
    "dateReserved": "2026-08-27T12:18:35.158Z",
    "dateUpdated": "2026-09-11T14:11:09.418Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8778",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T20:11:19.055852Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T20:19:12.419Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MIPL Grouped Checkout Fields for WooCommerce. Customize \u0026 Organize Checkout Fields.",
          "vendor": "mulika",
          "versions": [
            {
              "lessThanOrEqual": "1.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Farrukh Ziyaev"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The MIPL Grouped Checkout Fields for WooCommerce \u2013 Customize \u0026 Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `mipl_wc_upload_file` function in all versions up to, and including, 1.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site\u0027s server which may make remote code execution possible."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T03:39:37.451Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac1257a9-7c8e-43aa-b21a-93a77b456aa4?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mipl-wc-checkout-fields/tags/1.2.1/mipl-wc-checkout-fields.php#L260"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mipl-wc-checkout-fields/trunk/mipl-wc-checkout-fields.php#L260"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mipl-wc-checkout-fields/tags/1.2.1/include/class-mipl-wc-cf-checkout-block.php#L415"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mipl-wc-checkout-fields/trunk/include/class-mipl-wc-cf-checkout-block.php#L415"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3552029%40mipl-wc-checkout-fields%2Ftrunk%2Finclude%2Fclass-mipl-wc-cf-checkout-block.php\u0026old=3549283%40mipl-wc-checkout-fields%2Ftrunk%2Finclude%2Fclass-mipl-wc-cf-checkout-block.php\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-02T09:11:56.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-10T14:37:18.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "MIPL Grouped Checkout Fields for WooCommerce \u003c= 1.2.2 - Unauthenticated Arbitrary File Upload"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-8778",
    "datePublished": "2026-09-11T03:39:37.451Z",
    "dateReserved": "2026-05-17T09:55:22.575Z",
    "dateUpdated": "2026-09-11T20:19:12.419Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84960",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T16:40:29.323956Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T16:40:39.620Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP-Members Membership Plugin",
          "vendor": "cbutlerjr",
          "versions": [
            {
              "lessThanOrEqual": "3.5.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kuba"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions up to, and including, 3.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires the victim to first visit the attacker-crafted URL and then click the Terms of Service link rendered on the resulting registration page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T03:39:37.108Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ab8bd8c8-d9aa-4223-9400-4d500446b598?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.6/includes/class-wp-members-forms.php#L2203"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.6/includes/class-wp-members-forms.php#L2202"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3679958%40wp-members%2Ftrunk\u0026old=3471137%40wp-members%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-02T17:46:55.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-10T14:47:48.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP-Members Membership Plugin \u003c= 3.5.6 - Reflected Cross-Site Scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-84960",
    "datePublished": "2026-09-11T03:39:37.108Z",
    "dateReserved": "2026-09-02T17:31:38.442Z",
    "dateUpdated": "2026-09-11T16:40:39.620Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18561",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T16:34:21.743585Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T20:30:46.694Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unlimited Elements For Elementor",
          "vendor": "unitecms",
          "versions": [
            {
              "lessThanOrEqual": "2.0.16",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yuto Hyakumoto"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the \u0027addontype\u0027 parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in the getWhereString() function; when the parameter is supplied as an array, element zero is used verbatim as the SQL comparison operator and concatenated into the WHERE clause without sanitization, while normalizeAjaxInputData() strips WordPress\u0027s magic_quotes protection from the value. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T03:39:36.749Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/969d605d-e093-447c-abf7-0d56cb3ac569?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/framework/db.class.php#L216"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_actions.class.php#L87"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_addons.class.php#L1387"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_addon.class.php#L304"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/provider_functions.class.php#L611"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3661670%40unlimited-elements-for-elementor%2Ftrunk\u0026old=3628543%40unlimited-elements-for-elementor%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-10T14:43:49.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Unlimited Elements For Elementor \u003c= 2.0.16 - Unauthenticated SQL Injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-18561",
    "datePublished": "2026-09-11T03:39:36.749Z",
    "dateReserved": "2026-08-01T17:37:42.275Z",
    "dateUpdated": "2026-09-11T20:30:46.694Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18964",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T13:37:32.356688Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T13:46:23.554Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button \u2013 Chaty",
          "vendor": "premio",
          "versions": [
            {
              "lessThanOrEqual": "3.5.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "uhcna"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button \u2013 Chaty plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u0027s\u0027 parameter in all versions up to, and including, 3.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. WordPress\u0027s server-side HTML encoding of the \u0027s\u0027 search parameter in the \u0026lt;title\u0026gt; element is bypassed because the browser DOM API decodes HTML entities when jQuery\u0027s .text() method reads document.title, returning literal special characters that are then embedded unescaped into the constructed HTML attribute value."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T03:39:36.400Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/918af0dc-afad-4645-b4ad-8b10a34e20b2?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chaty/trunk/js/cht-front-script.min.js#L1"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3637386%40chaty%2Ftrunk%2Fjs%2Fcht-front-script.min.js\u0026old=3485342%40chaty%2Ftrunk%2Fjs%2Fcht-front-script.min.js\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-05T15:23:28.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-10T14:42:25.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button \u003c= 3.5.9 - Reflected Cross-Site Scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-18964",
    "datePublished": "2026-09-11T03:39:36.400Z",
    "dateReserved": "2026-08-05T15:07:52.166Z",
    "dateUpdated": "2026-09-11T13:46:23.554Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-81825",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T16:34:24.163481Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T20:30:53.550Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Simple Ajax Chat \u2013 Add a Fast, Secure Chat Box",
          "vendor": "specialk",
          "versions": [
            {
              "lessThanOrEqual": "20260811",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HEI LAI SZE"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Simple Ajax Chat \u2013 Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, \u003c= 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce protecting chat message submission is publicly visible on the chat page, rendering it ineffective as an authentication barrier and allowing fully unauthenticated attackers to submit malicious messages that are stored persistently and rendered to all visitors on every page load."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T03:39:36.060Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8336d8d6-81ac-40a6-af1e-167c12440908?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/simple-ajax-chat/trunk/simple-ajax-chat-form.php#L144"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/simple-ajax-chat/trunk/simple-ajax-chat-form.php#L143"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/simple-ajax-chat/trunk/simple-ajax-chat-form.php#L182"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/simple-ajax-chat/trunk/simple-ajax-chat-core.php#L34"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/simple-ajax-chat/trunk/simple-ajax-chat.php#L698"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/simple-ajax-chat/trunk/simple-ajax-chat.php#L329"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3669278%40simple-ajax-chat%2Ftrunk\u0026old=3640838%40simple-ajax-chat%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-27T13:47:48.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-10T14:45:50.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Simple Ajax Chat \u003c= 20260811 - Unauthenticated Stored Cross-Site Scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-81825",
    "datePublished": "2026-09-11T03:39:36.060Z",
    "dateReserved": "2026-08-27T13:32:01.254Z",
    "dateUpdated": "2026-09-11T20:30:53.550Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11496",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T20:11:11.199656Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T20:19:12.583Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PDF Builder for WooCommerce. Create invoices,packing slips and more",
          "vendor": "edgarrojas",
          "versions": [
            {
              "lessThanOrEqual": "2.0.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jaskaranjeet Singh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Woo PDF Invoice Builder plugin (also distributed as \"PDF Builder for WooCommerce\") for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder() AJAX handler (woocommerce-pdf-invoice-ajax.php:513), registered on wp_ajax_rednao_wcpdfinv_inspect_order, performing no capability check and no nonce verification before loading an arbitrary order by the attacker-supplied \u0027OrderNumber\u0027 POST field and serializing its full WC_Order::get_data() and meta to the response. This makes it possible for authenticated attackers with Subscriber-level access and above to read every WooCommerce order on the site \u2014 including billing/shipping address, email, phone number, payment method, gateway transaction ID, and order totals \u2014 by iterating order IDs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T03:39:35.189Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5e3e7c1a-a9c0-4e92-868c-5785d891cf8f?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-pdf-invoice-builder/tags/2.0.8/woocommerce-pdf-invoice-ajax.php#L513"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-pdf-invoice-builder/trunk/woocommerce-pdf-invoice-ajax.php#L513"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-pdf-invoice-builder/tags/2.0.8/woocommerce-pdf-invoice-ajax.php#L46"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-pdf-invoice-builder/tags/2.0.8/utilities/WCInspector.php#L23"
        },
        {
          "url": "https://wordpress.org/plugins/woo-pdf-invoice-builder/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3567364%40woo-pdf-invoice-builder%2Ftrunk%2Fwoocommerce-pdf-invoice-ajax.php\u0026old=3544283%40woo-pdf-invoice-builder%2Ftrunk%2Fwoocommerce-pdf-invoice-ajax.php\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-10T14:38:41.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Woo PDF Invoice Builder \u003c= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-11496",
    "datePublished": "2026-09-11T03:39:35.189Z",
    "dateReserved": "2026-06-07T11:13:24.812Z",
    "dateUpdated": "2026-09-11T20:19:12.583Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}