Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Subscribe2 \u2013 Form, Email Subscribers \u0026 Newsletters",
          "vendor": "wedevs",
          "versions": [
            {
              "lessThanOrEqual": "10.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Naoya Takahashi (nakko)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Subscribe2 \u2013 Form, Email Subscribers \u0026 Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018data[ip]\u2019 parameter in all versions up to, and including, 10.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T21:24:08.525Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9aa4bcc1-3c9e-451e-81ed-2059882b2ef1?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3709549/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-31T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2026-10-29T04:42:02.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-07T08:27:42.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Subscribe2 \u2013 Form, Email Subscribers \u0026 Newsletters \u003c= 10.47 - Unauthenticated Stored Cross-Site Scripting via \u0027data[ip]\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-120531",
    "datePublished": "2026-11-07T21:24:08.525Z",
    "dateReserved": "2026-11-02T16:19:23.937Z",
    "dateUpdated": "2026-11-07T21:24:08.525Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-120579",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:58:32.074046Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:05:58.280Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Active Woot Products Tables for WooCommerce. 100% FREE",
          "vendor": "realmag777",
          "versions": [
            {
              "lessThanOrEqual": "2.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Active Woot Products Tables for WooCommerce. 100% FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027help_title\u0027 parameter in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T12:27:07.427Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d19d9234-2f74-41a9-8f7e-98da9e844e7c?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L2268"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L2249"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/lib/helper.php#L38"
        },
        {
          "url": "https://plugins.svn.wordpress.org/profit-products-tables-for-woocommerce/trunk/index.php"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3784667/profit-products-tables-for-woocommerce/trunk/index.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-29T17:49:14.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-07T00:14:08.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Active Woot Products Tables for WooCommerce. 100% FREE \u003c= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027help_title\u0027 Shortcode Attribute"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-120579",
    "datePublished": "2026-11-07T12:27:07.427Z",
    "dateReserved": "2026-11-02T16:42:49.938Z",
    "dateUpdated": "2026-11-07T18:05:58.280Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109973",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:58:35.439374Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:05:58.418Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Flipbox \u2013 Awesomes Flip Boxes Image Overlay",
          "vendor": "oxilab",
          "versions": [
            {
              "lessThanOrEqual": "3.1.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027flip-box-image-upload-url-01-alt\u0027 parameter in versions up to, and including, 3.1.1. This is due to the plugin saving the image-alt field through sanitize_text_field() in Inc/Style22::register_child() (and Inc/Style18, 19, 20, 25, 29) \u2014 which preserves the double-quote character \u2014 and then concatenating the stored value into a double-quoted HTML attribute in Public_Render/Style22::default_render() (and the corresponding Style18/19/20/25/29 renderers) with no esc_attr() escaping. This makes it possible for authenticated attackers, with contributor-level access and above (when an administrator has delegated the plugin\u0027s \u0027Who can edit\u0027 capability via the plugin Settings page, or on multisite installations where even administrators lack unfiltered_html), to inject arbitrary web scripts in pages that will execute whenever a user accesses any page containing an affected [oxilab_flip_box] shortcode or block."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T12:27:07.074Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c3403cd6-31ba-4c36-a60e-d3e5c038af78?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/image-hover-effects-ultimate-visual-composer/tags/3.1.0/Public_Render/Style22.php#L58"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/image-hover-effects-ultimate-visual-composer/tags/3.1.0/Inc/Style22.php#L169"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/image-hover-effects-ultimate-visual-composer/tags/3.1.0/Page/Admin_Render.php#L128"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/image-hover-effects-ultimate-visual-composer/tags/3.1.0/Includes/Admin/Menu.php#L53"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3762680%40image-hover-effects-ultimate-visual-composer\u0026new=3762680%40image-hover-effects-ultimate-visual-composer"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-04T00:26:05.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-07T00:15:12.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Flipbox \u003c= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027flip-box-image-upload-url-01-alt\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-109973",
    "datePublished": "2026-11-07T12:27:07.074Z",
    "dateReserved": "2026-10-13T11:49:38.421Z",
    "dateUpdated": "2026-11-07T18:05:58.418Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-122041",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:10:47.816889Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:26:30.378Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Checkout Field Editor for WooCommerce (Pro)",
          "vendor": "Themehigh",
          "versions": [
            {
              "lessThanOrEqual": "3.8.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "theviper17y"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wp_ajax and wp_ajax_nopriv and is gated solely by the \u0027file_handling_nonce\u0027 nonce, which is emitted inside the public checkout page markup (data-nonce attribute) whenever a File Upload checkout field is configured. This makes it possible for unauthenticated attackers to delete arbitrary attachments (including those belonging to other users or posts) by submitting a crafted attachment_id, which can lead to loss of important media and potential denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T12:27:06.721Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a0b5f2ae-8cd9-4363-9d68-8a59f81a061b?source=cve"
        },
        {
          "url": "https://www.themehigh.com/product/woocommerce-checkout-field-editor-pro/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-06T23:43:27.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Checkout Field Editor for WooCommerce (Pro) \u003c= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via \u0027attachment_id\u0027 Parameter via thwcfe_remove_uploaded AJAX Action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-122041",
    "datePublished": "2026-11-07T12:27:06.721Z",
    "dateReserved": "2026-11-04T15:26:19.818Z",
    "dateUpdated": "2026-11-07T18:26:30.378Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119156",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:58:39.035685Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:05:58.580Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Download Manager",
          "vendor": "codename065",
          "versions": [
            {
              "lessThanOrEqual": "7.5.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "crow"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027wpdm_reg[first_name], wpdm_reg[last_name], wpdm_reg[user_login]\u0027 parameter in all versions up to, and including, 7.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the site to have \"Anyone can register\" enabled, the plugin\u0027s [wpdm_reg_form] shortcode published on a public page, and at least one package authored by user ID 1 rendered with the Spotlight link template."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T12:27:06.194Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1cfe8902-9ddf-4dac-80ca-17589b737cd5?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/Package/views/link-templates/link-template-spotlight.php#L54"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/Package/PackageController.php#L2129"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/User/Register.php#L326"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/User/Register.php#L323"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/User/Register.php#L229"
        },
        {
          "url": "https://www.wpdownloadmanager.com/changelogs/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-29T14:56:53.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T23:44:33.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Download Manager \u003c= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name]"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-119156",
    "datePublished": "2026-11-07T12:27:06.194Z",
    "dateReserved": "2026-10-29T14:39:12.282Z",
    "dateUpdated": "2026-11-07T18:05:58.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93429",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:58:45.852122Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:05:58.914Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "VikBooking Hotel Booking Engine \u0026 PMS",
          "vendor": "e4jvikwp",
          "versions": [
            {
              "lessThanOrEqual": "1.8.17",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "artuskg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The VikBooking Hotel Booking Engine \u0026 PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027guests[][][documents]\u0027 Parameter in all versions up to, and including, 1.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to possess a valid booking sid/ts pair, which can be obtained by making a standard public booking, as the session token needed to satisfy the JSession::checkToken() gate is emitted in the publicly accessible pre-checkin form."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:36.453Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fffd481c-5cdf-43d0-8a9c-cd8a180c38fd?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.15/admin/views/bookingcheckin/tmpl/default.php#L729"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.15/admin/views/bookingcheckin/tmpl/default.php#L737"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.15/site/controller.php#L3211"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.15/site/controller.php#L3330"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.15/vikbooking.php#L398"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.18/admin/views/bookingcheckin/tmpl/default.php#L737"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-17T21:18:44.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.8.17 - Unauthenticated Stored Cross-Site Scripting via \u0027guests[][][documents]\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-93429",
    "datePublished": "2026-11-07T11:26:36.453Z",
    "dateReserved": "2026-09-17T21:03:40.107Z",
    "dateUpdated": "2026-11-07T18:05:58.914Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121977",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:58:49.168541Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:05:59.085Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder",
          "vendor": "jetmonsters",
          "versions": [
            {
              "lessThanOrEqual": "3.6.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "UKO"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027note (form field whose value is written to post meta `note`)\u0027 parameter in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a privileged user with the edit_others_posts capability to visit a form URL containing the attacker-created post ID, a delivery step the attacker controls via a crafted phishing link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:36.079Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f586a89a-7d1f-48ef-bbf6-0c78154bccbc?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.8/includes/blocks/dynamic-value.php#L88"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.8/assets/build/frontend/dynamic.value.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.8/includes/presets/sources/preset-source-post.php#L83"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.8/includes/functions.php#L123"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3788241/jetformbuilder/trunk/includes/blocks/dynamic-value.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-04T13:28:04.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T21:49:06.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "JetFormBuilder \u003c= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Property"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-121977",
    "datePublished": "2026-11-07T11:26:36.079Z",
    "dateReserved": "2026-11-04T13:12:10.363Z",
    "dateUpdated": "2026-11-07T18:05:59.085Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-120509",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:58:52.461768Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:05:59.250Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Real Testimonials \u2013 Testimonial Slider, Collect Customer Reviews and Video Testimonials",
          "vendor": "shapedplugin",
          "versions": [
            {
              "lessThanOrEqual": "4.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "UKO"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Real Testimonials \u2013 Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027tpro_client_name\u0027 parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to publish the submitted testimonial, trigger the Show Preview AJAX handler, and save an Update, which canonicalizes and persists the attacker-controlled payload as the Manage View title \u2014 matching the plugin\u0027s standard moderation workflow. Successful exploitation additionally requires an action by an administrator \u2014 the attacker cannot trigger the vulnerability on their own."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:35.721Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f3c52521-763b-4618-8d8f-fc1f49554be2?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/testimonial-free/tags/4.1.0/src/Frontend/Helper.php#L376"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/testimonial-free/tags/4.1.0/src/Frontend/Views/partials/submit-form.php#L19"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/testimonial-free/tags/4.1.0/src/Admin/Views/Framework/Classes/metabox.class.php#L497"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/testimonial-free/tags/4.1.0/src/Admin/Views/Framework/Classes/metabox.class.php#L549"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3781836/testimonial-free"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3781836/testimonial-free/trunk/src/Frontend/Helper.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-02T16:11:34.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T21:37:01.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Real Testimonials \u003c= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via \u0027tpro_client_name\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-120509",
    "datePublished": "2026-11-07T11:26:35.721Z",
    "dateReserved": "2026-11-02T15:53:46.450Z",
    "dateUpdated": "2026-11-07T18:05:59.250Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115548",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:58:55.593798Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:05:59.400Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Quttera ThreatSign \u2013 Web Malware Scanner for WordPress",
          "vendor": "quttera",
          "versions": [
            {
              "lessThanOrEqual": "4.1.0.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Adrien Brunner"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Quttera ThreatSign \u2013 Web Malware Scanner for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027HTTP_USER_AGENT\u0027 parameter in all versions up to, and including, 4.1.0.48 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:35.366Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eacc5af0-3248-4819-b90e-0f5e0e6d2786?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/quttera-web-malware-scanner/tags/4.1.0.45/qtrAjaxHandler.php#L1199"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/quttera-web-malware-scanner/tags/4.1.0.45/JS/iscan_frontend.php#L112"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/quttera-web-malware-scanner/tags/4.1.0.45/qtrDatabaseScanner.php#L345"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/quttera-web-malware-scanner/tags/4.1.0.45/qtrReport.php#L133"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3771915%40quttera-web-malware-scanner\u0026new=3771915%40quttera-web-malware-scanner"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-13T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2026-10-23T05:11:18.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T23:19:12.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Quttera ThreatSign \u003c= 4.1.0.48 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-115548",
    "datePublished": "2026-11-07T11:26:35.366Z",
    "dateReserved": "2026-10-22T21:03:00.835Z",
    "dateUpdated": "2026-11-07T18:05:59.400Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111317",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:59:16.514055Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:05:59.534Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder",
          "vendor": "jetmonsters",
          "versions": [
            {
              "lessThanOrEqual": "3.6.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mohamed Amgad Khater (mamgad)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027\u003cany form field name \u2014 e.g. \u0027payload\u0027\u003e\u0027 parameter in all versions up to, and including, 3.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the targeted form to have both the Save Form Record action enabled and a form-level Form Record preset configured; the stored payload only executes when a privileged user visits the front-end form page with the preset\u0027s record query variable set to the attacker\u0027s submitted record ID."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:34.962Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ce95c4a1-0873-4178-a63a-ca9ffdb29ed7?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/includes/blocks/render/base.php#L277"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/modules/form-record/controller.php#L204"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/includes/presets/sources/preset-source-form-record.php#L99"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/includes/blocks/types/base.php#L356"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/includes/form-handler.php#L85"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3758108%40jetformbuilder\u0026new=3758108%40jetformbuilder"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-15T20:36:29.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T22:46:18.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "JetFormBuilder \u003c= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-111317",
    "datePublished": "2026-11-07T11:26:34.962Z",
    "dateReserved": "2026-10-15T20:21:14.387Z",
    "dateUpdated": "2026-11-07T18:05:59.534Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109214",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:59:19.711610Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:05:59.667Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "User Frontend \u2013 Membership, User Registration, User Profile, User Directory \u0026 Content Restriction with Frontend Post Submission",
          "vendor": "wedevs",
          "versions": [
            {
              "lessThanOrEqual": "4.3.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Chakradhar Chirumamilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The User Frontend \u2013 Membership, User Registration, User Profile, User Directory \u0026 Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027\u003ctaxonomy_field_name\u003e (default: \u0027category\u0027)\u0027 parameter in all versions up to, and including, 4.3.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target installation to have configured a Taxonomy field in text-input mode with guest post submission enabled on at least one frontend form."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:34.590Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca1837a4-ea04-4a82-aadb-43e9cff28833?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/admin/form-builder/views/post-form-settings.php#L498"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/admin/html/form-settings-post.php#L118"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/includes/Traits/FieldableTrait.php#L745"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/includes/Ajax/Frontend_Form_Ajax.php#L36"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/includes/Ajax.php#L26"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/admin/form-builder/assets/js/form-builder.js#L666"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3770255%40wp-user-frontend%2Ftags%2F4.3.14\u0026old=3722911%40wp-user-frontend%2Ftags%2F4.3.13"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-12T13:53:34.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T23:13:49.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "User Frontend \u003c= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-109214",
    "datePublished": "2026-11-07T11:26:34.590Z",
    "dateReserved": "2026-10-12T13:38:09.368Z",
    "dateUpdated": "2026-11-07T18:05:59.667Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111370",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:59:22.754883Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:05:59.803Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Visitor Statistics (Real Time Traffic)",
          "vendor": "osamaesh",
          "versions": [
            {
              "lessThanOrEqual": "8.9.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kamil B."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027os (also browser, res)\u0027 parameter in all versions up to, and including, 8.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:34.205Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb621eb8-4404-4a21-b96e-e5871c8a769b?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-stats-manager/tags/8.7.1/includes/wsm_db.php#L231"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-stats-manager/tags/8.7.1/includes/wsm_statistics.php#L3957"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-stats-manager/tags/8.7.1/wp-stats-manager.php#L110"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-stats-manager/tags/8.7.1/includes/wsm_init.php#L563"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-stats-manager/tags/8.7.1/includes/wsm_requests.php#L311"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3783278%40wp-stats-manager\u0026new=3783278%40wp-stats-manager"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-15T21:37:25.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T23:04:50.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Visitor Statistics (Real Time Traffic) \u003c= 8.9.0 - Unauthenticated Stored Cross-Site Scripting via \u0027os\u0027 / \u0027browser\u0027 / \u0027res\u0027 Tracker Parameters"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-111370",
    "datePublished": "2026-11-07T11:26:34.205Z",
    "dateReserved": "2026-10-15T21:22:00.190Z",
    "dateUpdated": "2026-11-07T18:05:59.803Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109991",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:11:09.203527Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:26:30.640Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FunnelKit Payment Gateway for Stripe WooCommerce",
          "vendor": "teamfunnelkit",
          "versions": [
            {
              "lessThanOrEqual": "1.15.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kuba"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.15.0.2 via the \u0027order-pay (WP query var from /checkout/order-pay/\u003cID\u003e/)\u0027 parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full billing PII \u2014 including name, email address, phone number, and complete street address \u2014 of any store order by enumerating sequential order IDs, as this data is emitted into the inline fkwcs_data JavaScript object via wp_localize_script on every matching page response. Exploitation occurs even when WooCommerce itself rejects the order-pay page request, because the plugin\u0027s wp_localize_script call runs independently of WooCommerce\u0027s own order-key validation on the same request."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:33.813Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d77b41-f535-4e60-a850-881be8dee458?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/funnelkit-stripe-woo-payment-gateway/tags/1.15.0.1/includes/abstract-payment-gateway.php#L364"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/funnelkit-stripe-woo-payment-gateway/tags/1.15.0.1/includes/abstract-payment-gateway.php#L317"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/funnelkit-stripe-woo-payment-gateway/tags/1.15.0.1/includes/abstract-payment-gateway.php#L295"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3741799%40funnelkit-stripe-woo-payment-gateway\u0026new=3741799%40funnelkit-stripe-woo-payment-gateway"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-09T18:22:46.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T22:51:01.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "FunnelKit Payment Gateway for Stripe WooCommerce \u003c= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via \u0027order-pay\u0027 URL Path Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-109991",
    "datePublished": "2026-11-07T11:26:33.813Z",
    "dateReserved": "2026-10-13T12:35:18.333Z",
    "dateUpdated": "2026-11-07T18:26:30.640Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104014",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:11:18.295742Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:26:30.767Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Naimur Email OTP Verification for WooCommerce",
          "vendor": "naimurrahmannahid",
          "versions": [
            {
              "lessThanOrEqual": "2.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "s4m0y3d"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.0. This is due to the plugin\u0027s password-reset finalization endpoint (the wp_ajax_nopriv_ceovw_update_new_password action handled by CEOVW_AJAX::update_new_password()) authorizing the reset solely by the presence of a database row marking an email as \u0027VERIFIED\u0027, with no timestamp check, no session binding, and no per-reset token \u2014 combined with mark_otp_as_verified_for_reset() leaving the row in that state after a user enters their code (abandoning the flow leaves the row behind), and a scheduled \u0027ceovw_cleanup_expired_otps_event\u0027 cron that has no add_action() handler anywhere in the plugin so cleanup never runs. This makes it possible for unauthenticated attackers to take over any account whose owner previously requested and verified a password-reset code and did not immediately finish choosing a new password \u2014 the attacker needs only the victim\u0027s email address and a nonce that the plugin itself localizes publicly into the CEOVW_APP global on the WooCommerce account page for logged-out visitors, after which they call the endpoint, overwrite the victim\u0027s password, and are returned a live wordpress_logged_in_ session cookie for that user (full site takeover if the account is an administrator)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:33.449Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b29918de-22a2-424f-ad86-ad83874ca81a?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.0/includes/class-ajax.php#L163"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.0/includes/class-security.php#L77"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.0/includes/class-security.php#L72"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.0/includes/class-ajax.php#L10"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.0/naimur-email-otp-for-woocommerce.php#L38"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.1/includes/class-ajax.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T08:07:29.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T21:32:13.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Naimur Email OTP Verification for WooCommerce \u003c= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104014",
    "datePublished": "2026-11-07T11:26:33.449Z",
    "dateReserved": "2026-10-01T16:43:39.527Z",
    "dateUpdated": "2026-11-07T18:26:30.767Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118050",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:59:25.953462Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:05:59.939Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Football Pool",
          "vendor": "antoineh",
          "versions": [
            {
              "lessThanOrEqual": "2.13.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "poiri3r"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027shouttext\u0027 parameter in all versions up to, and including, 2.13.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script only fires in the admin Edit view for a shout; the public Shoutbox widget and the admin list view both encode output via Football_Pool_Utils::xssafe(), making the admin Edit view the sole unescaped sink."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:33.101Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac3e048d-9ebd-41c2-9dbd-751adae10380?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/football-pool/tags/2.13.5/admin/class-football-pool-admin.php#L654"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/football-pool/tags/2.13.5/admin/class-football-pool-admin-shoutbox.php#L100"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/football-pool/tags/2.13.5/classes/class-football-pool-shoutbox.php#L57"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/football-pool/tags/2.13.5/widgets/widget-football-pool-shoutbox.php#L84"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3775727%40football-pool\u0026new=3775727%40football-pool"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-06T21:47:05.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Football Pool \u003c= 2.13.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shoutbox Message"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-118050",
    "datePublished": "2026-11-07T11:26:33.101Z",
    "dateReserved": "2026-10-27T15:17:47.667Z",
    "dateUpdated": "2026-11-07T18:05:59.939Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118267",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:11:38.819789Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:26:30.900Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts \u0026 Maps",
          "vendor": "peterschulznl",
          "versions": [
            {
              "lessThanOrEqual": "5.5.89",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kuba"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts \u0026 Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin\u0027s write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) passing the attacker-supplied `key` and `val` parameters directly to `$wpdadb-\u003eupdate`, `$wpdadb-\u003edelete`, and `$wpdadb-\u003einsert` without enforcing the container\u0027s row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions that are correctly applied on the read endpoints. This makes it possible for authenticated attackers, with Subscriber-level access and above, to write to arbitrary rows and columns outside the configured restrictions \u2014 including overwriting the `user_pass` field of the WordPress administrator account in `wp_users` \u2014 and subsequently authenticate as the administrator, achieving full site takeover. Exploitation requires an administrator to have published a Data App that enables write transactions (update, delete, or insert) for Subscriber-level or anonymous users, which is an explicitly advertised use-case of the plugin. Exploitation by unauthenticated attackers requires that the administrator has published a Data App whose rest_api.authorization is \u0027anonymous\u0027 and whose container has transactions.update (or delete/insert) enabled. On a default installation, where that is not configured, the vulnerability requires attackers with subscriber-level access and above."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:32.742Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a81029fe-db29-4dd4-8450-65d1764855f1?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L1213"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L1267"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L1186"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Table.php#L665"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L382"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3771310%40wp-data-access%2Ftags%2F5.5.90\u0026old=3761178%40wp-data-access%2Ftags%2F5.5.89"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-27T20:29:35.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T21:37:24.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Data Access \u003c= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via \u0027key\u0027 and \u0027val\u0027 Parameters on app/update, app/delete, app/insert"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-118267",
    "datePublished": "2026-11-07T11:26:32.742Z",
    "dateReserved": "2026-10-27T20:15:02.961Z",
    "dateUpdated": "2026-11-07T18:26:30.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123418",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:59:29.363869Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:06:00.083Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Church Admin",
          "vendor": "andy_moyle",
          "versions": [
            {
              "lessThanOrEqual": "5.1.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Shinya Murakami (4n86rakam1)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027lat\u0027 parameter in all versions up to, and including, 5.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when a Google Maps API key has been configured in Church Admin settings, as the vulnerable sink is only reached when that option is present."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:32.384Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9c3c5632-444e-45d8-b0e0-347591c8db98?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/church-admin/tags/5.1.7/includes/directory.php#L4033"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/church-admin/tags/5.1.7/includes/front_end_register.php#L286"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/church-admin/tags/5.1.7/includes/front_end_register.php#L330"
        },
        {
          "url": "https://downloads.wordpress.org/plugin/church-admin.5.1.8.zip"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-05T22:25:49.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T21:48:33.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Church Admin \u003c= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via \u0027lat\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-123418",
    "datePublished": "2026-11-07T11:26:32.384Z",
    "dateReserved": "2026-11-05T22:05:12.591Z",
    "dateUpdated": "2026-11-07T18:06:00.083Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121976",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:59:32.564732Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:06:00.294Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Modula Image Gallery \u2013 Photo Grid \u0026 Video Gallery",
          "vendor": "wpchill",
          "versions": [
            {
              "lessThanOrEqual": "3.0.17",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Modula plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027items\u0027 parameter in versions up to, and including, 3.0.17 This is due to insufficient input sanitization of the per-image \u0027link\u0027 field in the save_merged_items() REST handler and Images\\Adapter::normalize_item_row(), which preserves unknown keys verbatim, combined with output escaping in Modula_Helper::generate_attributes() that applies only esc_attr() to the resulting anchor href and does not strip the \u0027javascript:\u0027 URL scheme. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and clicks the gallery tile."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:32.022Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/91d3cbc2-00ca-4384-a52d-84fe2f0328b3?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.17/includes/v2/images/class-adapter.php#L655"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.17/includes/v2/rest/class-gallery-upload-controller.php#L914"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.17/includes/v2/class-meta-sync.php#L422"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.17/includes/public/shortcode/class-modula-item-data-processor.php#L629"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.17/includes/core/helpers/class-modula-helper.php#L17"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3787971%40modula-best-grid-gallery%2Ftags%2F3.0.18\u0026old=3781958%40modula-best-grid-gallery%2Ftags%2F3.0.17"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-04T13:27:49.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T21:49:31.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Modula Image Gallery \u003c= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via \u0027items\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-121976",
    "datePublished": "2026-11-07T11:26:32.022Z",
    "dateReserved": "2026-11-04T13:11:52.039Z",
    "dateUpdated": "2026-11-07T18:06:00.294Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-122231",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:59:35.745581Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:06:00.431Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WS Form LITE \u2013 Drag \u0026 Drop Contact Form Builder",
          "vendor": "westguard",
          "versions": [
            {
              "lessThanOrEqual": "1.12.18",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "UKO"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WS Form LITE \u2013 Drag \u0026 Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027field_\u003cid\u003e[0][0]\u0027 parameter in all versions up to, and including, 1.12.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the client-side esc_html() helper returns any non-string value unchanged, allowing a nested-array payload coerced via Array.prototype.toString to reach jQuery .append() unescaped."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:31.673Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7996ce73-32d7-49d5-b47b-71f9fc106d3d?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ws-form/tags/1.12.17/shared/js/ws-form.js#L1580"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ws-form/tags/1.12.17/shared/js/ws-form.js#L1310"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ws-form/tags/1.12.17/shared/js/ws-form.js#L560"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ws-form/tags/1.12.17/includes/core/class-ws-form-submit.php#L2771"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ws-form/tags/1.12.17/includes/core/class-ws-form-submit-meta.php#L247"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ws-form/tags/1.12.17/api/class-ws-form-api-submit.php#L63"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ws-form/tags/1.12.17/api/class-ws-form-api.php#L344"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3784929/ws-form"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3784929/ws-form/trunk/shared/js/ws-form.js"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-04T21:01:36.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T21:25:51.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WS Form LITE \u003c= 1.12.18 - Unauthenticated Stored Cross-Site Scripting via Text Field Array Value"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-122231",
    "datePublished": "2026-11-07T11:26:31.673Z",
    "dateReserved": "2026-11-04T20:45:42.214Z",
    "dateUpdated": "2026-11-07T18:06:00.431Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-120685",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:59:38.816845Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:06:00.566Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Real Testimonials \u2013 Testimonial Slider, Collect Customer Reviews and Video Testimonials",
          "vendor": "shapedplugin",
          "versions": [
            {
              "lessThanOrEqual": "4.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "UKO"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Real Testimonials \u2013 Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027tpro_client_image (JPEG IPTC caption) + tpro_client_testimonial ([gallery] shortcode)\u0027 parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have the display block configured with the Strip All HTML Tags option disabled, which is the plugin\u0027s native setting for rendering formatted testimonial content, and to have approved the submitted testimonials."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:31.315Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/756c203e-8fbe-46f0-8ae7-a3f2d005cd6f?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/testimonial-free/tags/4.1.0/src/Blocks/Templates/template-parts/testimonial-content.php#L34"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/testimonial-free/tags/4.1.0/src/Blocks/API/APIHelper.php#L50"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/testimonial-free/tags/4.1.0/src/Blocks/API/APIHelper.php#L151"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/testimonial-free/tags/4.1.0/src/Blocks/API/ManageAPI.php#L352"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/testimonial-free/tags/4.1.0/src/Blocks/Includes/TestimonialQuery.php#L240"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3781836/testimonial-free"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3781836/testimonial-free/trunk/src/Blocks/Templates/template-parts/testimonial-content.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-02T19:32:28.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T21:32:03.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Real Testimonials \u003c= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + \u0027[gallery]\u0027 Shortcode Chain"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-120685",
    "datePublished": "2026-11-07T11:26:31.315Z",
    "dateReserved": "2026-11-02T19:16:46.326Z",
    "dateUpdated": "2026-11-07T18:06:00.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109230",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:59:42.334070Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:06:00.700Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Visitor Statistics (Real Time Traffic)",
          "vendor": "osamaesh",
          "versions": [
            {
              "lessThanOrEqual": "8.7.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Adrien Brunner"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027browser\u0027 parameter in all versions up to, and including, 8.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored via an unauthenticated HTTP request to the public visitor tracking endpoint (wmcAction=wmcTrack) and executes when the bundled jqPlot PieRenderer inserts the HTML-decoded series label directly as HTML in the authenticated administrator\u0027s browser."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:30.940Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/756679f3-b6d2-4458-ad68-556551491ac7?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-stats-manager/tags/8.7.1/includes/wsm_requests.php#L305"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-stats-manager/tags/8.7.1/includes/wsm_statistics.php#L3957"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-stats-manager/tags/8.7.1/js/custom_admin.js#L319"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-stats-manager/tags/8.7.1/wp-stats-manager.php#L109"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-stats-manager/tags/8.7.1/includes/wsm_db.php#L215"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3763124%40wp-stats-manager\u0026new=3763124%40wp-stats-manager"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-12T14:14:07.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T21:36:50.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Visitor Statistics (Real Time Traffic) \u003c= 8.7.1 - Unauthenticated Stored Cross-Site Scripting via \u0027browser\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-109230",
    "datePublished": "2026-11-07T11:26:30.940Z",
    "dateReserved": "2026-10-12T13:58:46.948Z",
    "dateUpdated": "2026-11-07T18:06:00.700Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93766",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:59:46.341134Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:06:00.841Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Happyforms Pro",
          "vendor": "Happyforms",
          "versions": [
            {
              "lessThanOrEqual": "1.38.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Bao Le"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Happyforms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027happyforms_client_referer\u0027 parameter in all versions up to, and including, 1.38.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:30.560Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/71fac3d5-40d5-41d5-b756-2f1e941709b6?source=cve"
        },
        {
          "url": "https://wordpress.org/plugins/happyforms-upgrade/#developers"
        },
        {
          "url": "https://happyforms.io/whats-new/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-06T21:59:56.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Happyforms Pro \u003c= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via \u0027happyforms_client_referer\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-93766",
    "datePublished": "2026-11-07T11:26:30.560Z",
    "dateReserved": "2026-09-18T16:53:12.706Z",
    "dateUpdated": "2026-11-07T18:06:00.841Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119075",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:11:49.846770Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:26:31.030Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Registration Form for WooCommerce",
          "vendor": "themegrill",
          "versions": [
            {
              "lessThanOrEqual": "1.1.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "JB Sabit"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields()) validates a submitted \u0027tgwcfb/user-roles\u0027 value against the form\u0027s configured allowed roles, but the checkout registration path (validate_checkout_fields(), hooked to woocommerce_after_checkout_validation) stores the raw $_POST[\u0027user_roles\u0027] value in $this-\u003evalid_data without any allow-list enforcement, and add_user_data() then injects that value into woocommerce_new_customer_data as the new account\u0027s role. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by supplying a user_roles=administrator parameter when creating an account during checkout, resulting in full site takeover."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:30.206Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/714d10b0-526c-4347-a369-85fc32ef3478?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/registration-form-for-woocommerce/tags/1.1.3/includes/FormHandler.php#L354"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/registration-form-for-woocommerce/tags/1.1.3/includes/FormHandler.php#L407"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fregistration-form-for-woocommerce%2Ftags%2F1.1.4\u0026new_path=%2Fregistration-form-for-woocommerce%2Ftags%2F1.1.5"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-06T04:58:35.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T21:45:02.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Registration Form for WooCommerce \u003c= 1.1.4 - Unauthenticated Privilege Escalation to \u0027user_roles\u0027 Parameter at Checkout"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-119075",
    "datePublished": "2026-11-07T11:26:30.206Z",
    "dateReserved": "2026-10-29T13:06:26.068Z",
    "dateUpdated": "2026-11-07T18:26:31.030Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104746",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:11:57.186321Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:26:31.166Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Motors \u2013 Car Dealership \u0026 Classified Listings Plugin",
          "vendor": "stylemix",
          "versions": [
            {
              "lessThanOrEqual": "1.4.125",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Maciej Komorowski"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Motors \u2013 Car Dealership \u0026 Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the stm_listings_ajax_save_user_data function in all versions up to, and including, 1.4.125 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Although deletion is bounded to wp-content/uploads (preventing removal of wp-config.php), any authenticated Subscriber can trivially exploit this because the required AJAX nonce is printed on every front-end page and the handler\u0027s stm_user_avatar_path meta is writable by any logged-in user against their own account."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:29.847Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/636c0ef8-262e-41f8-acab-fb7621a3e902?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.124/includes/actions.php#L479"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.124/includes/actions.php#L467"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.124/includes/actions.php#L644"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.124/includes/user-extra.php#L405"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.124/includes/helpers.php#L1401"
        },
        {
          "url": "https://plugins.svn.wordpress.org/motors-car-dealership-classified-listings/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3754485/motors-car-dealership-classified-listings/trunk/includes/actions.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T12:20:47.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T23:12:10.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Motors \u003c= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via \u0027stm_user_avatar_path\u0027 User Meta"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104746",
    "datePublished": "2026-11-07T11:26:29.847Z",
    "dateReserved": "2026-10-02T12:05:51.002Z",
    "dateUpdated": "2026-11-07T18:26:31.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104768",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-08T01:06:47.285033Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-08T01:06:54.511Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AutomatorWP \u2013 No-Code Workflow Automation, Integration \u0026 Webhooks Plugin, now with AI",
          "vendor": "rubengc",
          "versions": [
            {
              "lessThanOrEqual": "6.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Ryan Albon"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The AutomatorWP \u2013 No-Code Workflow Automation, Integration \u0026 Webhooks Plugin, now with AI plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.4. This is due to missing privilege-ceiling validation in the `create_user()` function within the anonymous-user action (and equally in the Create User and Add/Change Role WordPress-integration actions), which verify only that the submitted role exists via `automatorwp_get_editable_roles()` without confirming the role falls at or below the acting context\u0027s privilege level \u2014 allowing attacker-controlled trigger tag data (e.g., a `{comment_author}` tag bound to the Role option) to supply any role, including `administrator`, unchallenged. This makes it possible for unauthenticated attackers to create a new administrator-role account tied to an attacker-controlled email address, receiving the generated password via WordPress\u0027s new-user notification email and thereby gaining full administrative access to the site. Exploitation requires the site to have an anonymous automation configured with the Role option bound to a dynamic trigger tag such as `{comment_author}`, and is triggered when a site administrator performs the routine action of approving a comment \u2014 an action that provides no in-UI indication that it will mint a new privileged account from the comment author field."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:29.486Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6138f184-4475-4288-835f-9bf8c21f9147?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/integrations/automatorwp/actions/anonymous-user.php#L500"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/integrations/automatorwp/actions/anonymous-user.php#L487"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/includes/events.php#L1303"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/integrations/wordpress/triggers/anonymous-comment-post-type.php#L111"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/integrations/wordpress/actions/create-user.php#L174"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/integrations/wordpress/actions/user-role.php#L149"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3754573%40automatorwp\u0026new=3754573%40automatorwp"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-06T23:15:57.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "AutomatorWP \u003c= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation \u0027Role\u0027 Option"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104768",
    "datePublished": "2026-11-07T11:26:29.486Z",
    "dateReserved": "2026-10-02T13:02:33.640Z",
    "dateUpdated": "2026-11-08T01:06:54.511Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-120683",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:59:49.814042Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:06:00.976Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Real Testimonials \u2013 Testimonial Slider, Collect Customer Reviews and Video Testimonials",
          "vendor": "shapedplugin",
          "versions": [
            {
              "lessThanOrEqual": "4.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mohamed Amgad Khater (mamgad)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Real Testimonials \u2013 Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027tpro_client_testimonial\u0027 parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to approve the pending testimonial through standard moderation and the target page to load the WordPress Interactivity runtime (e.g. a theme or block that enqueues @wordpress/interactivity)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:29.097Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5d4b22d2-597d-4b34-ac96-83fcc0ff8049?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/testimonial-free/tags/4.1.0/src/Frontend/Views/templates/testimonial/content.php#L23"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/testimonial-free/tags/4.1.0/src/Blocks/API/APIHelper.php#L79"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/testimonial-free/tags/4.1.0/src/Blocks/API/ManageAPI.php#L352"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/testimonial-free/tags/4.1.0/src/Blocks/API/APIHelper.php#L34"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3781836/testimonial-free"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3781836/testimonial-free/trunk/src/Frontend/Views/templates/testimonial/content.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-02T19:30:48.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T21:36:33.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Real Testimonials \u003c= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form \u0027tpro_client_testimonial\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-120683",
    "datePublished": "2026-11-07T11:26:29.097Z",
    "dateReserved": "2026-11-02T19:15:01.544Z",
    "dateUpdated": "2026-11-07T18:06:00.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104760",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:59:53.532468Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:06:01.105Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki \u0026 AI Chatbot",
          "vendor": "wedevs",
          "versions": [
            {
              "lessThanOrEqual": "2.6.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki \u0026 AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027modalPlaceholder\u0027 Block Attribute in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because Contributors can save posts in pending status, a malicious payload in the modalPlaceholder block attribute will execute in the browser of any admin or editor who previews or views the pending post."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:28.712Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/590e7782-ac7a-469f-a893-05627404a1b3?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wedocs/tags/2.6.0/assets/build/blocks/QuickSearch/render.php#L439"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wedocs/tags/2.6.0/assets/build/blocks/QuickSearch/render.php#L425"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wedocs/tags/2.6.0/assets/build/blocks/QuickSearch/render.php#L445"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wedocs/tags/2.6.0/assets/build/blocks/QuickSearch/render.php#L231"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wedocs/tags/2.6.0/assets/build/blocks/QuickSearch/render.php#L852"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3783119/wedocs/trunk/assets/build/blocks/QuickSearch/render.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T12:43:28.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T23:09:34.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki \u0026 AI Chatbot \u003c= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027modalPlaceholder\u0027 Block Attribute"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104760",
    "datePublished": "2026-11-07T11:26:28.712Z",
    "dateReserved": "2026-10-02T12:28:20.086Z",
    "dateUpdated": "2026-11-07T18:06:01.105Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Dynific Addons for Elementor (formerly Anywhere Elementor)",
          "vendor": "wpvibes",
          "versions": [
            {
              "lessThanOrEqual": "1.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mohamed Amgad Khater (mamgad)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Dynific Addons for Elementor plugin for WordPress is vulnerable to SQL Injection via the \u0027q\u0027 parameter in versions up to, and including, 1.3. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the ae_preview_post() AJAX handler and its preview_post_filter() posts_where callback, where the value is passed through $wpdb-\u003eesc_like() (addcslashes for \u0027_%\\\\\u0027) and concatenated into a single-quoted SQL LIKE literal \u2014 a construction that does not escape single quotes and actively escapes the backslash wp_magic_quotes places before the attacker\u0027s quote, freeing it to terminate the literal. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:28.340Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4c1691f4-5659-41c0-9035-93556a78f07b?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/admin/admin-helper.php#L91"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/admin/admin-helper.php#L119"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/admin/admin-helper.php#L99"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/aepro.php#L460"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3779229%40anywhere-elementor\u0026new=3779229%40anywhere-elementor"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-01T14:33:03.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T22:46:55.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Dynific Addons for Elementor (formerly Anywhere Elementor) \u003c= 1.3 - Authenticated (Subscriber+) SQL Injection via \u0027q\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-103914",
    "datePublished": "2026-11-07T11:26:28.340Z",
    "dateReserved": "2026-10-01T14:17:52.184Z",
    "dateUpdated": "2026-11-07T11:26:28.340Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119183",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:59:56.734200Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:06:01.238Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder",
          "vendor": "jetmonsters",
          "versions": [
            {
              "lessThanOrEqual": "3.6.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mohamed Amgad Khater (mamgad)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027\u003cform field mapped to a post meta key, e.g. lst_cost\u003e\u0027 parameter in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target site to have configured a public Insert Post form writing to a post meta key and a Calculated Field whose formula references that key via the %META::key% macro, after which a single unauthenticated POST is sufficient to persist the payload."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:27.981Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3b3d2e0d-ce2a-48cd-a36f-92979335fd71?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/templates/fields/calculated-field.php#L31"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/includes/blocks/render/calculated-field-render.php#L56"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/modules/actions-v2/insert-post/properties/post-meta-property.php#L157"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/modules/actions-v2/insert-post/insert-post-action.php#L53"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3788241/jetformbuilder/trunk/includes/blocks/render/calculated-field-render.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-29T16:02:59.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T21:48:52.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "JetFormBuilder \u003c= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via \u0027%META::key%\u0027 Macro via Post Meta"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-119183",
    "datePublished": "2026-11-07T11:26:27.981Z",
    "dateReserved": "2026-10-29T15:47:09.675Z",
    "dateUpdated": "2026-11-07T18:06:01.238Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96565",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:59:59.921587Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:06:01.374Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP-Members Membership Plugin",
          "vendor": "cbutlerjr",
          "versions": [
            {
              "lessThanOrEqual": "3.5.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jacek Sowi\u0144ski (dzaku)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field (scalar bypass of wpmem_sanitize_array) in all versions up to, and including, 3.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable via the WooCommerce classic checkout path, as the sibling registration, profile, and account-edit handlers implode the value before sanitization, which raises a PHP 8 TypeError on scalar input and fails closed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:27.608Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3872211b-b7d9-4d71-a371-9099392b4678?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.7/includes/admin/class-wp-members-admin-users.php#L555"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.7/includes/api/api-forms.php#L540"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.7/includes/api/api-forms.php#L372"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.7/includes/vendor/rocketgeek-utilities/includes/forms.php#L143"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.7/includes/api/api-forms.php#L530"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3753517%40wp-members%2Ftrunk\u0026old=3686809%40wp-members%2Ftrunk"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.8/includes/admin/class-wp-members-admin-users.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-23T13:43:34.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T22:49:51.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP-Members Membership Plugin \u003c= 3.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-96565",
    "datePublished": "2026-11-07T11:26:27.608Z",
    "dateReserved": "2026-09-23T13:18:47.831Z",
    "dateUpdated": "2026-11-07T18:06:01.374Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}