Search

Find a vulnerability

Search criteria

    188 vulnerabilities by Roxnor

    CVE-2026-104012 (GCVE-0-2026-104012)

    Vulnerability from nvd – Published: 2026-10-31 07:46 – Updated: 2026-11-02 14:51
    VLAI
    Title
    Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint
    Summary
    The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public `/rox-appointment-booking/v1/public/booking` REST endpoint performing mass-assignment of the raw request body into a new customer row while `CustomerModel::$fillable` includes the internal `wp_user_id` column, allowing an unauthenticated attacker to persist an arbitrary WordPress user ID alongside an attacker-controlled email address with no authorization check. When an administrator subsequently opens the poisoned customer record and clicks Update Customer, `SaveCustomer::handleRequest()` passes the stored `wp_user_id` and attacker-supplied email to `wp_update_user()` — succeeding because `LinkedAccount::canChange()` unconditionally returns true when the acting user holds the `edit_users` capability — thereby overwriting the targeted administrator's email address and enabling full account takeover via a standard WordPress password-reset request. Successful exploitation requires an administrator to open and save the poisoned record, and the attacker must know or guess a valid administrator user ID (such as the default user ID 1).
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-02 14:50 UTC
    CWE
    • CWE-269 - Improper Privilege Management
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Credits
    Daryle Minor
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104012",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T14:50:55.700006Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T14:51:04.867Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Rox Appointment Booking \u2013 Event, Calendar \u0026 Appointment Scheduling",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "1.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Daryle Minor"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Rox Appointment Booking \u2013 Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public `/rox-appointment-booking/v1/public/booking` REST endpoint performing mass-assignment of the raw request body into a new customer row while `CustomerModel::$fillable` includes the internal `wp_user_id` column, allowing an unauthenticated attacker to persist an arbitrary WordPress user ID alongside an attacker-controlled email address with no authorization check. When an administrator subsequently opens the poisoned customer record and clicks Update Customer, `SaveCustomer::handleRequest()` passes the stored `wp_user_id` and attacker-supplied email to `wp_update_user()` \u2014 succeeding because `LinkedAccount::canChange()` unconditionally returns true when the acting user holds the `edit_users` capability \u2014 thereby overwriting the targeted administrator\u0027s email address and enabling full account takeover via a standard WordPress password-reset request. Successful exploitation requires an administrator to open and save the poisoned record, and the attacker must know or guess a valid administrator user ID (such as the default user ID 1)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T07:46:47.528Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a32f428-fa6e-469b-b004-e80a1029af80?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/Customer/REST/SaveCustomer.php#L262"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/FrontendBookingPanel/Services/CustomerService.php#L74"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/Customer/Data/CustomerModel.php#L38"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/FrontendBookingPanel/REST/BookingConfirm.php#L61"
        },
        {
          "url": "https://downloads.wordpress.org/plugin/rox-appointment-booking.1.3.2.zip"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-11T10:02:19.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-30T19:18:58.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Rox Appointment Booking \u003c= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via \u0027/public/booking\u0027 Endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104012",
    "datePublished": "2026-10-31T07:46:47.528Z",
    "dateReserved": "2026-10-01T16:42:36.171Z",
    "dateUpdated": "2026-11-02T14:51:04.867Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-103898 (GCVE-0-2026-103898)

    Vulnerability from nvd – Published: 2026-10-31 07:46 – Updated: 2026-11-03 18:53
    VLAI
    Title
    Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback
    Summary
    The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at `/wp-json/wslu-social-login/type/{provider}/` with `permission_callback => __return_true` locating an existing WordPress account solely by the email string returned from the OAuth provider and calling `wp_set_auth_cookie()` without a password check, while the only verification guard — `!empty($getProfile->emailVerified)` in `inc/admin-create-user.php` — is a no-op for the bundled Hybridauth Facebook and Twitter adapters, both of which assign the raw email string rather than a boolean verified flag to `emailVerified`. This makes it possible for unauthenticated attackers to obtain a fully authenticated session as any existing WordPress user, including Administrators, whose registered email address can be presented through a configured Facebook or Twitter login on the target site. Exploitation requires only that the attacker control an OAuth account whose provider-returned email matches the target account's registered WordPress email address; no local credentials, nonce, or prior foothold is needed.
    Severity
    8.1 (High)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-03 18:53 UTC
    CWE
    • CWE-287 - Improper Authentication
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Credits
    Kumar Atul (Mandarin21)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-103898",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T18:53:25.586421Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T18:53:35.040Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Wp Social Login and Register Social Counter",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "3.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kumar Atul (Mandarin21)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at `/wp-json/wslu-social-login/type/{provider}/` with `permission_callback =\u003e __return_true` locating an existing WordPress account solely by the email string returned from the OAuth provider and calling `wp_set_auth_cookie()` without a password check, while the only verification guard \u2014 `!empty($getProfile-\u003eemailVerified)` in `inc/admin-create-user.php` \u2014 is a no-op for the bundled Hybridauth Facebook and Twitter adapters, both of which assign the raw email string rather than a boolean verified flag to `emailVerified`. This makes it possible for unauthenticated attackers to obtain a fully authenticated session as any existing WordPress user, including Administrators, whose registered email address can be presented through a configured Facebook or Twitter login on the target site. Exploitation requires only that the attacker control an OAuth account whose provider-returned email matches the target account\u0027s registered WordPress email address; no local credentials, nonce, or prior foothold is needed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T07:46:52.815Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e961d3db-da5e-4bde-ae7e-04e6ba3ebef4?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/inc/admin-create-user.php#L229"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/inc/admin-create-user.php#L512"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/inc/admin-create-user.php#L172"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/inc/admin-rest-api.php#L46"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/lib/composer/vendor/hybridauth/hybridauth/src/Provider/Facebook.php#L205"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/lib/composer/vendor/hybridauth/hybridauth/src/Provider/Twitter.php#L102"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3752566%40wp-social\u0026new=3752566%40wp-social"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-01T14:08:41.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-30T19:24:45.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Wp Social Login and Register Social Counter \u003c= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-103898",
    "datePublished": "2026-10-31T07:46:52.815Z",
    "dateReserved": "2026-10-01T13:53:08.414Z",
    "dateUpdated": "2026-11-03T18:53:35.040Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-103519 (GCVE-0-2026-103519)

    Vulnerability from nvd – Published: 2026-10-03 06:38 – Updated: 2026-10-03 15:42
    VLAI
    Title
    WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter
    Summary
    The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. The bypass relies on WordPress's own strip_shortcodes() function unwrapping the [[tag]] double-bracket escape to a bare [tag] that survives wp_insert_post storage and fires when the publicly queryable xs_review post type is rendered through the_content.
    Severity
    5.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-03 15:24 UTC
    CWE
    • CWE-94 - Improper Control of Generation of Code ('Code Injection')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    roxnor WP Ultimate Review Affected: 0 , ≤ 2.4.3 (semver)
    		Create a notification for this product.
    Credits
    Eunho Kim
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-103519",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:24:54.105226Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:42:41.904Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Ultimate Review",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "2.4.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Eunho Kim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. The bypass relies on WordPress\u0027s own strip_shortcodes() function unwrapping the [[tag]] double-bracket escape to a bare [tag] that survives wp_insert_post storage and fires when the publicly queryable xs_review post type is rendered through the_content."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T06:38:23.698Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/76986a3a-67f8-4d91-9f48-88fad356c3b4?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/app/content.php#L347"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/app/content.php#L366"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/init.php#L291"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/app/content.php#L217"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3720426%40wp-ultimate-review\u0026new=3720426%40wp-ultimate-review"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-30T19:17:10.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-02T17:41:13.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Ultimate Review \u003c= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via \u0027xs_reviw_summery\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-103519",
    "datePublished": "2026-10-03T06:38:23.698Z",
    "dateReserved": "2026-09-30T19:01:44.804Z",
    "dateUpdated": "2026-10-03T15:42:41.904Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-100157 (GCVE-0-2026-100157)

    Vulnerability from nvd – Published: 2026-10-03 06:38 – Updated: 2026-10-03 15:42
    VLAI
    Title
    WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)
    Summary
    The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The nonce required to pass the only gate is emitted to unauthenticated visitors via the public review form, and submitted shortcode payloads are auto-published without admin approval by default, meaning exploitation requires no account and no privileged interaction.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-03 15:24 UTC
    CWE
    • CWE-94 - Improper Control of Generation of Code ('Code Injection')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    roxnor WP Ultimate Review Affected: 0 , ≤ 2.4.3 (semver)
    		Create a notification for this product.
    Credits
    walid213
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100157",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:24:14.767164Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:42:41.054Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Ultimate Review",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "2.4.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "walid213"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The nonce required to pass the only gate is emitted to unauthenticated visitors via the public review form, and submitted shortcode payloads are auto-published without admin approval by default, meaning exploitation requires no account and no privileged interaction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T06:38:26.027Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ee3690d9-d1c3-4653-948b-cba1a7653574?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/app/content.php#L347"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/app/content.php#L217"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/app/content.php#L52"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/init.php#L286"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3720426%40wp-ultimate-review\u0026new=3720426%40wp-ultimate-review"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T12:33:09.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-02T17:41:41.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Ultimate Review \u003c= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via \u0027xs_reviw_summery\u0027 Parameter (Split-Shortcode / Late-Registered Shortcode)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100157",
    "datePublished": "2026-10-03T06:38:26.027Z",
    "dateReserved": "2026-09-25T12:18:04.662Z",
    "dateUpdated": "2026-10-03T15:42:41.054Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-97344 (GCVE-0-2026-97344)

    Vulnerability from nvd – Published: 2026-10-03 05:29 – Updated: 2026-10-03 15:42
    VLAI
    Title
    Wp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write
    Summary
    The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to chain two steps: invoking the nonce-only dismiss_ajax_call endpoint (nonce accessible to Subscribers via any wp-admin page) to set the xs_social_profile_image meta flag on their own account, which activates the unescaped img output branch in xs_social_get_avatar, and then setting their display name to a script payload that core's ENT_NOQUOTES handling preserves unescaped.
    Severity
    6.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-03 15:32 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Credits
    Jakub Herman
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-97344",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:32:53.553628Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:42:45.605Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Wp Social Login and Register Social Counter",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "3.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakub Herman"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to chain two steps: invoking the nonce-only dismiss_ajax_call endpoint (nonce accessible to Subscribers via any wp-admin page) to set the xs_social_profile_image meta flag on their own account, which activates the unescaped img output branch in xs_social_get_avatar, and then setting their display name to a script payload that core\u0027s ENT_NOQUOTES handling preserves unescaped."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T05:29:13.734Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/40e03292-c2dc-4d34-88f4-0d0631e7b981?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/app/avatar.php#L40"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/lib/notice/notice.php#L384"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/lib/notice/notice.php#L422"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3720423%40wp-social\u0026new=3720423%40wp-social"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-24T12:40:15.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-02T17:23:42.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Wp Social Login and Register Social Counter \u003c= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-97344",
    "datePublished": "2026-10-03T05:29:13.734Z",
    "dateReserved": "2026-09-24T12:25:10.497Z",
    "dateUpdated": "2026-10-03T15:42:45.605Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-94500 (GCVE-0-2026-94500)

    Vulnerability from nvd – Published: 2026-09-23 18:14 – Updated: 2026-09-23 18:46
    VLAI
    Title
    WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
    Summary
    Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-23 18:38 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Patchstack CNA under the mitre root
    CNA scorecard B 75/100 over 3528 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Roxnor ElementsKit Elementor addons Lite Affected: n/a , ≤ 4.0.5 (custom)
    		Create a notification for this product.
    Credits
    nh4tvd | Patchstack Bug Bounty Program
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94500",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T18:38:14.282203Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T18:46:52.294Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "elementskit-lite",
          "product": "ElementsKit Elementor addons Lite",
          "vendor": "Roxnor",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.0.6",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.0.5",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "nh4tvd | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite \u003c= 4.0.5 versions."
            }
          ],
          "value": "Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite \u003c= 4.0.5 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T18:14:31.298Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/elementskit-lite/vulnerability/wordpress-elementskit-elementor-addons-lite-plugin-4-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress ElementsKit Elementor addons Lite Plugin to the latest available version (at least 4.0.6)."
            }
          ],
          "value": "Update the WordPress ElementsKit Elementor addons Lite Plugin to the latest available version (at least 4.0.6)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress ElementsKit Elementor addons Lite plugin \u003c= 4.0.5 - Cross Site Scripting (XSS) vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-94500",
    "datePublished": "2026-09-23T18:14:31.298Z",
    "dateReserved": "2026-09-21T17:53:41.813Z",
    "dateUpdated": "2026-09-23T18:46:52.294Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-92235 (GCVE-0-2026-92235)

    Vulnerability from nvd – Published: 2026-09-22 07:41 – Updated: 2026-09-22 10:25
    VLAI
    Title
    WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter
    Summary
    The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
    Severity
    8.1 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-22 10:08 UTC
    CWE
    • CWE-94 - Improper Control of Generation of Code ('Code Injection')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    roxnor WP Ultimate Review Affected: 0 , ≤ 2.4.2 (semver)
    		Create a notification for this product.
    Credits
    jtb75
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92235",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T10:08:59.756351Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T10:25:32.150Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Ultimate Review",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "2.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "jtb75"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T07:41:13.593Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dc0fe855-97b7-46ef-b1c8-1602447e97e6?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/app/content.php#L360"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/app/content.php#L341"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/app/content.php#L189"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/app/content.php#L56"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/init.php#L271"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/views/public/meta-box-user-review.php#L538"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3703958%40wp-ultimate-review\u0026new=3703958%40wp-ultimate-review"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T19:36:06.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-21T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Ultimate Review \u003c= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via \u0027xs_submit_review_data[xs_reviw_summery]\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-92235",
    "datePublished": "2026-09-22T07:41:13.593Z",
    "dateReserved": "2026-09-15T19:31:28.783Z",
    "dateUpdated": "2026-09-22T10:25:32.150Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-85575 (GCVE-0-2026-85575)

    Vulnerability from nvd – Published: 2026-09-15 01:03 – Updated: 2026-09-15 13:54
    VLAI
    Title
    The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter
    Summary
    The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengine_product_title_header_size’ parameter in all versions up to, and including, 4.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
    Severity
    6.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-15 13:25 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Credits
    Romain Deperne (ang3L)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85575",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T13:25:18.606994Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T13:54:32.586Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ShopEngine Elementor WooCommerce Builder Addon \u2013 All in One WooCommerce Solution with eCommerce Templates \u0026 Woo Widgets",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "4.9.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Romain Deperne (ang3L)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The ShopEngine Elementor WooCommerce Builder Addon \u2013 All in One WooCommerce Solution with eCommerce Templates \u0026 Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018shopengine_product_title_header_size\u2019 parameter in all versions up to, and including, 4.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T01:03:08.299Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/acd7b1b5-9618-4e8a-b320-bb65978d2c92?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3693396/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-01T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2026-09-04T11:10:09.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-14T11:05:47.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "The ShopEngine Elementor WooCommerce Builder Addon \u2013 All in One WooCommerce Solution with eCommerce Templates \u0026 Woo Widgets  \u003c= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027shopengine_product_title_header_size\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-85575",
    "datePublished": "2026-09-15T01:03:08.299Z",
    "dateReserved": "2026-09-04T10:54:52.809Z",
    "dateUpdated": "2026-09-15T13:54:32.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-75971 (GCVE-0-2026-75971)

    Vulnerability from nvd – Published: 2026-08-25 11:27 – Updated: 2026-08-25 13:08
    VLAI
    Title
    ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes
    Summary
    The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the `rum_importer()` function being registered on the WordPress core `import_start` action hook with no plugin-owned capability check and no allowlist filtering, causing arbitrary `<wp_option>` name/value pairs parsed from an attacker-supplied WXR import file to be passed directly to `update_option()`. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to write arbitrary WordPress options — most critically setting `users_can_register` to `1` and `default_role` to `administrator` — enabling open self-registration of Administrator accounts and full site takeover. This is exploitable by Shop Manager-level users because WooCommerce grants that role the `import` capability, allowing it to reach the WordPress Importer flow that fires the `import_start` hook on which `rum_importer()` is registered, contrary to the assumption that the hook is restricted to Administrators.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-25 13:08 UTC
    CWE
    • CWE-269 - Improper Privilege Management
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Credits
    Wordfence PRISM
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75971",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T13:08:21.771878Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T13:08:29.780Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ShopEngine Elementor WooCommerce Builder Addon \u2013 All in One WooCommerce Solution with eCommerce Templates \u0026 Woo Widgets",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "4.9.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The ShopEngine Elementor WooCommerce Builder Addon \u2013 All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the `rum_importer()` function being registered on the WordPress core `import_start` action hook with no plugin-owned capability check and no allowlist filtering, causing arbitrary `\u003cwp_option\u003e` name/value pairs parsed from an attacker-supplied WXR import file to be passed directly to `update_option()`. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to write arbitrary WordPress options \u2014 most critically setting `users_can_register` to `1` and `default_role` to `administrator` \u2014 enabling open self-registration of Administrator accounts and full site takeover. This is exploitable by Shop Manager-level users because WooCommerce grants that role the `import` capability, allowing it to reach the WordPress Importer flow that fires the `import_start` hook on which `rum_importer()` is registered, contrary to the assumption that the hook is restricted to Administrators."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T11:27:11.397Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4045d49f-fd12-4906-9e60-97fdb082fe84?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shopengine/tags/4.9.4/core/export-import/import.php#L45"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shopengine/tags/4.9.4/core/export-import/import.php#L19"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shopengine/tags/4.9.4/core/builders/base.php#L57"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-18T17:50:12.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-08-24T22:24:38.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "ShopEngine Elementor WooCommerce Builder Addon \u003c= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import \u0027\u003cwp_option\u003e\u0027 Nodes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-75971",
    "datePublished": "2026-08-25T11:27:11.397Z",
    "dateReserved": "2026-08-18T17:35:04.430Z",
    "dateUpdated": "2026-08-25T13:08:29.780Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-18100 (GCVE-0-2026-18100)

    Vulnerability from nvd – Published: 2026-08-25 07:39 – Updated: 2026-08-25 18:12
    VLAI
    Title
    MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting
    Summary
    The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mf_form_id' Widget Setting in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses Elementor's save-time wp_kses_post filter because it contains no HTML tags, and MetForm's own str_replace transformation of script tags into JavaScript template literal expressions provides an additional delivery path.
    Severity
    6.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-25 18:12 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Credits
    Jonah Burgess (CryptoCat)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18100",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T18:12:43.152431Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T18:12:52.098Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates \u0026 Custom Form Builder for Elementor",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "4.1.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jonah Burgess (CryptoCat)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The MetForm \u2013 Contact Form, Survey, Quiz, \u0026 Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027mf_form_id\u0027 Widget Setting in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses Elementor\u0027s save-time wp_kses_post filter because it contains no HTML tags, and MetForm\u0027s own str_replace transformation of script tags into JavaScript template literal expressions provides an additional delivery path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T07:39:50.408Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/976f1f01-ad5d-413e-a208-ae4b71a61502?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/metform/tags/4.1.8/utils/util.php#L605"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/metform/tags/4.1.8/controls/form-picker-utils.php#L45"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/metform/tags/4.1.8/widgets/form.php#L143"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/metform/tags/4.1.4/utils/util.php#L605"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/metform/tags/4.1.4/controls/form-picker-utils.php#L45"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/metform/tags/4.1.4/widgets/form.php#L143"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3639278%40metform%2Ftrunk\u0026old=3618333%40metform%2Ftrunk"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-28T17:45:54.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-08-24T19:12:51.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "MetForm \u003c= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027mf_form_id\u0027 Widget Setting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-18100",
    "datePublished": "2026-08-25T07:39:50.408Z",
    "dateReserved": "2026-07-28T17:29:53.289Z",
    "dateUpdated": "2026-08-25T18:12:52.098Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-76063 (GCVE-0-2026-76063)

    Vulnerability from nvd – Published: 2026-08-25 03:27 – Updated: 2026-08-25 19:22
    VLAI
    Title
    FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter
    Summary
    The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfp_featured_video_url' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The REST endpoint used to submit the video URL has its permission_callback set to __return_true, meaning any authenticated user — including those with Subscriber-level access — can reach the vulnerable code path.
    Severity
    6.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-25 18:32 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Credits
    Wordfence PRISM
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76063",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T18:32:50.975332Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T19:22:31.342Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FundEngine \u2013 Donation and Crowdfunding Platform",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "1.8.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The FundEngine \u2013 Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027wfp_featured_video_url\u0027 parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The REST endpoint used to submit the video URL has its permission_callback set to __return_true, meaning any authenticated user \u2014 including those with Subscriber-level access \u2014 can reach the vulnerable code path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T03:27:06.337Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9cf1230e-759e-4892-8de8-1adb3a0e48a1?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-fundraising-donation/tags/1.8.1/apps/featured.php#L175"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-fundraising-donation/tags/1.8.1/apps/featured.php#L467"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-fundraising-donation/tags/1.8.1/apps/content.php#L1425"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-fundraising-donation/tags/1.8.1/apps/content.php#L1198"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3656562%40wp-fundraising-donation\u0026new=3656562%40wp-fundraising-donation"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-18T21:19:27.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-08-24T14:32:08.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "FundEngine \u003c= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \u0027wfp_featured_video_url\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-76063",
    "datePublished": "2026-08-25T03:27:06.337Z",
    "dateReserved": "2026-08-18T21:04:21.474Z",
    "dateUpdated": "2026-08-25T19:22:31.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-75930 (GCVE-0-2026-75930)

    Vulnerability from nvd – Published: 2026-08-25 03:27 – Updated: 2026-08-25 15:19
    VLAI
    Title
    FundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' Parameter
    Summary
    The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary posts and pages — overwriting title and content, and seizing ownership by supplying an attacker-controlled post_author integer that bypasses wp_kses_post sanitization. The wp_rest nonce required by the handler is trivially obtainable by any logged-in user via /wp-admin/admin-ajax.php?action=rest-nonce and therefore does not constitute an authorization barrier.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-25 15:18 UTC
    CWE
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Credits
    Wordfence PRISM
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75930",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T15:18:42.413356Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T15:19:49.192Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FundEngine \u2013 Donation and Crowdfunding Platform",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "1.8.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The FundEngine \u2013 Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary posts and pages \u2014 overwriting title and content, and seizing ownership by supplying an attacker-controlled post_author integer that bypasses wp_kses_post sanitization. The wp_rest nonce required by the handler is trivially obtainable by any logged-in user via /wp-admin/admin-ajax.php?action=rest-nonce and therefore does not constitute an authorization barrier."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T03:27:05.464Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/08057fa2-90e1-4537-a828-a2c5902b348c?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-fundraising-donation/tags/1.8.1/apps/content.php#L1228"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-fundraising-donation/tags/1.8.1/apps/content.php#L1195"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-fundraising-donation/tags/1.8.1/apps/content.php#L289"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3656562%40wp-fundraising-donation\u0026new=3656562%40wp-fundraising-donation"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-18T15:58:15.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-08-24T14:32:34.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "FundEngine \u003c= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via \u0027campaign_post\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-75930",
    "datePublished": "2026-08-25T03:27:05.464Z",
    "dateReserved": "2026-08-18T15:43:07.095Z",
    "dateUpdated": "2026-08-25T15:19:49.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-73993 (GCVE-0-2026-73993)

    Vulnerability from nvd – Published: 2026-08-20 12:07 – Updated: 2026-08-20 16:27
    VLAI
    Title
    WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
    Summary
    Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-20 16:00 UTC
    CWE
    • CWE-502 - Deserialization of Untrusted Data
    Assigner
    Patchstack CNA under the mitre root
    CNA scorecard B 75/100 over 3528 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Roxnor FundEngine Affected: n/a , ≤ 1.7.9 (custom)
    		Create a notification for this product.
    Credits
    Taylsec | Patchstack Bug Bounty Program
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73993",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T16:00:38.130737Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T16:27:27.661Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "wp-fundraising-donation",
          "product": "FundEngine",
          "vendor": "Roxnor",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.8.0",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.7.9",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Taylsec | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unauthenticated PHP Object Injection in FundEngine \u003c= 1.7.9 versions."
            }
          ],
          "value": "Unauthenticated PHP Object Injection in FundEngine \u003c= 1.7.9 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-586",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-586 Object Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T12:07:21.318Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/wp-fundraising-donation/vulnerability/wordpress-fundengine-plugin-1-7-9-php-object-injection-vulnerability-2?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress FundEngine Plugin to the latest available version (at least 1.8.0)."
            }
          ],
          "value": "Update the WordPress FundEngine Plugin to the latest available version (at least 1.8.0)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress FundEngine plugin \u003c= 1.7.9 - PHP Object Injection vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-73993",
    "datePublished": "2026-08-20T12:07:21.318Z",
    "dateReserved": "2026-08-14T10:15:59.205Z",
    "dateUpdated": "2026-08-20T16:27:27.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-32470 (GCVE-0-2026-32470)

    Vulnerability from nvd – Published: 2026-08-18 13:59 – Updated: 2026-08-18 19:48
    VLAI
    Title
    WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
    Summary
    Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-18 19:31 UTC
    CWE
    • CWE-502 - Deserialization of Untrusted Data
    Assigner
    Patchstack CNA under the mitre root
    CNA scorecard B 75/100 over 3528 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Roxnor FundEngine Affected: n/a , ≤ 1.7.9 (custom)
    		Create a notification for this product.
    Credits
    daroo | Patchstack Bug Bounty Program
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32470",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T19:31:33.940910Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T19:48:24.165Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "wp-fundraising-donation",
          "product": "FundEngine",
          "vendor": "Roxnor",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.8.0",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.7.9",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "daroo | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unauthenticated PHP Object Injection in FundEngine \u003c= 1.7.9 versions."
            }
          ],
          "value": "Unauthenticated PHP Object Injection in FundEngine \u003c= 1.7.9 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-586",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-586 Object Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T13:59:24.334Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/wp-fundraising-donation/vulnerability/wordpress-fundengine-plugin-1-7-9-php-object-injection-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress FundEngine Plugin to the latest available version (at least 1.8.0)."
            }
          ],
          "value": "Update the WordPress FundEngine Plugin to the latest available version (at least 1.8.0)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress FundEngine plugin \u003c= 1.7.9 - PHP Object Injection vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-32470",
    "datePublished": "2026-08-18T13:59:24.334Z",
    "dateReserved": "2026-03-12T11:11:50.221Z",
    "dateUpdated": "2026-08-18T19:48:24.165Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-65440 (GCVE-0-2026-65440)

    Vulnerability from nvd – Published: 2026-07-27 22:44 – Updated: 2026-07-28 13:32
    VLAI
    Title
    WordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability
    Summary
    Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.
    Severity
    7.1 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-07-28 13:32 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Patchstack CNA under the mitre root
    CNA scorecard B 75/100 over 3528 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Roxnor GetGenie Affected: n/a , ≤ 4.4.3 (custom)
    		Create a notification for this product.
    Credits
    daroo | Patchstack Bug Bounty Program
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-65440",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T13:32:08.657265Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T13:32:17.246Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "getgenie",
          "product": "GetGenie",
          "vendor": "Roxnor",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.5.0",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.4.3",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "daroo | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unauthenticated Cross Site Scripting (XSS) in GetGenie \u003c= 4.4.3 versions."
            }
          ],
          "value": "Unauthenticated Cross Site Scripting (XSS) in GetGenie \u003c= 4.4.3 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-591 Reflected XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-27T22:44:03.223Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/getgenie/vulnerability/wordpress-getgenie-plugin-4-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress GetGenie Plugin to the latest available version (at least 4.5.0)."
            }
          ],
          "value": "Update the WordPress GetGenie Plugin to the latest available version (at least 4.5.0)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress GetGenie plugin \u003c= 4.4.3 - Cross Site Scripting (XSS) vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-65440",
    "datePublished": "2026-07-27T22:44:03.223Z",
    "dateReserved": "2026-07-22T08:52:41.030Z",
    "dateUpdated": "2026-07-28T13:32:17.246Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-103898 (GCVE-0-2026-103898)

    Vulnerability from cvelistv5 – Published: 2026-10-31 07:46 – Updated: 2026-11-03 18:53
    VLAI
    Title
    Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback
    Summary
    The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at `/wp-json/wslu-social-login/type/{provider}/` with `permission_callback => __return_true` locating an existing WordPress account solely by the email string returned from the OAuth provider and calling `wp_set_auth_cookie()` without a password check, while the only verification guard — `!empty($getProfile->emailVerified)` in `inc/admin-create-user.php` — is a no-op for the bundled Hybridauth Facebook and Twitter adapters, both of which assign the raw email string rather than a boolean verified flag to `emailVerified`. This makes it possible for unauthenticated attackers to obtain a fully authenticated session as any existing WordPress user, including Administrators, whose registered email address can be presented through a configured Facebook or Twitter login on the target site. Exploitation requires only that the attacker control an OAuth account whose provider-returned email matches the target account's registered WordPress email address; no local credentials, nonce, or prior foothold is needed.
    Severity
    8.1 (High)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-03 18:53 UTC
    CWE
    • CWE-287 - Improper Authentication
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Credits
    Kumar Atul (Mandarin21)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-103898",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T18:53:25.586421Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T18:53:35.040Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Wp Social Login and Register Social Counter",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "3.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kumar Atul (Mandarin21)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at `/wp-json/wslu-social-login/type/{provider}/` with `permission_callback =\u003e __return_true` locating an existing WordPress account solely by the email string returned from the OAuth provider and calling `wp_set_auth_cookie()` without a password check, while the only verification guard \u2014 `!empty($getProfile-\u003eemailVerified)` in `inc/admin-create-user.php` \u2014 is a no-op for the bundled Hybridauth Facebook and Twitter adapters, both of which assign the raw email string rather than a boolean verified flag to `emailVerified`. This makes it possible for unauthenticated attackers to obtain a fully authenticated session as any existing WordPress user, including Administrators, whose registered email address can be presented through a configured Facebook or Twitter login on the target site. Exploitation requires only that the attacker control an OAuth account whose provider-returned email matches the target account\u0027s registered WordPress email address; no local credentials, nonce, or prior foothold is needed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T07:46:52.815Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e961d3db-da5e-4bde-ae7e-04e6ba3ebef4?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/inc/admin-create-user.php#L229"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/inc/admin-create-user.php#L512"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/inc/admin-create-user.php#L172"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/inc/admin-rest-api.php#L46"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/lib/composer/vendor/hybridauth/hybridauth/src/Provider/Facebook.php#L205"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/lib/composer/vendor/hybridauth/hybridauth/src/Provider/Twitter.php#L102"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3752566%40wp-social\u0026new=3752566%40wp-social"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-01T14:08:41.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-30T19:24:45.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Wp Social Login and Register Social Counter \u003c= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-103898",
    "datePublished": "2026-10-31T07:46:52.815Z",
    "dateReserved": "2026-10-01T13:53:08.414Z",
    "dateUpdated": "2026-11-03T18:53:35.040Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-104012 (GCVE-0-2026-104012)

    Vulnerability from cvelistv5 – Published: 2026-10-31 07:46 – Updated: 2026-11-02 14:51
    VLAI
    Title
    Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint
    Summary
    The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public `/rox-appointment-booking/v1/public/booking` REST endpoint performing mass-assignment of the raw request body into a new customer row while `CustomerModel::$fillable` includes the internal `wp_user_id` column, allowing an unauthenticated attacker to persist an arbitrary WordPress user ID alongside an attacker-controlled email address with no authorization check. When an administrator subsequently opens the poisoned customer record and clicks Update Customer, `SaveCustomer::handleRequest()` passes the stored `wp_user_id` and attacker-supplied email to `wp_update_user()` — succeeding because `LinkedAccount::canChange()` unconditionally returns true when the acting user holds the `edit_users` capability — thereby overwriting the targeted administrator's email address and enabling full account takeover via a standard WordPress password-reset request. Successful exploitation requires an administrator to open and save the poisoned record, and the attacker must know or guess a valid administrator user ID (such as the default user ID 1).
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-02 14:50 UTC
    CWE
    • CWE-269 - Improper Privilege Management
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Credits
    Daryle Minor
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104012",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T14:50:55.700006Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T14:51:04.867Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Rox Appointment Booking \u2013 Event, Calendar \u0026 Appointment Scheduling",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "1.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Daryle Minor"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Rox Appointment Booking \u2013 Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public `/rox-appointment-booking/v1/public/booking` REST endpoint performing mass-assignment of the raw request body into a new customer row while `CustomerModel::$fillable` includes the internal `wp_user_id` column, allowing an unauthenticated attacker to persist an arbitrary WordPress user ID alongside an attacker-controlled email address with no authorization check. When an administrator subsequently opens the poisoned customer record and clicks Update Customer, `SaveCustomer::handleRequest()` passes the stored `wp_user_id` and attacker-supplied email to `wp_update_user()` \u2014 succeeding because `LinkedAccount::canChange()` unconditionally returns true when the acting user holds the `edit_users` capability \u2014 thereby overwriting the targeted administrator\u0027s email address and enabling full account takeover via a standard WordPress password-reset request. Successful exploitation requires an administrator to open and save the poisoned record, and the attacker must know or guess a valid administrator user ID (such as the default user ID 1)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T07:46:47.528Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a32f428-fa6e-469b-b004-e80a1029af80?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/Customer/REST/SaveCustomer.php#L262"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/FrontendBookingPanel/Services/CustomerService.php#L74"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/Customer/Data/CustomerModel.php#L38"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/FrontendBookingPanel/REST/BookingConfirm.php#L61"
        },
        {
          "url": "https://downloads.wordpress.org/plugin/rox-appointment-booking.1.3.2.zip"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-11T10:02:19.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-30T19:18:58.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Rox Appointment Booking \u003c= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via \u0027/public/booking\u0027 Endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104012",
    "datePublished": "2026-10-31T07:46:47.528Z",
    "dateReserved": "2026-10-01T16:42:36.171Z",
    "dateUpdated": "2026-11-02T14:51:04.867Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-100157 (GCVE-0-2026-100157)

    Vulnerability from cvelistv5 – Published: 2026-10-03 06:38 – Updated: 2026-10-03 15:42
    VLAI
    Title
    WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)
    Summary
    The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The nonce required to pass the only gate is emitted to unauthenticated visitors via the public review form, and submitted shortcode payloads are auto-published without admin approval by default, meaning exploitation requires no account and no privileged interaction.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-03 15:24 UTC
    CWE
    • CWE-94 - Improper Control of Generation of Code ('Code Injection')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    roxnor WP Ultimate Review Affected: 0 , ≤ 2.4.3 (semver)
    		Create a notification for this product.
    Credits
    walid213
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100157",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:24:14.767164Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:42:41.054Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Ultimate Review",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "2.4.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "walid213"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The nonce required to pass the only gate is emitted to unauthenticated visitors via the public review form, and submitted shortcode payloads are auto-published without admin approval by default, meaning exploitation requires no account and no privileged interaction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T06:38:26.027Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ee3690d9-d1c3-4653-948b-cba1a7653574?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/app/content.php#L347"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/app/content.php#L217"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/app/content.php#L52"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/init.php#L286"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3720426%40wp-ultimate-review\u0026new=3720426%40wp-ultimate-review"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T12:33:09.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-02T17:41:41.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Ultimate Review \u003c= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via \u0027xs_reviw_summery\u0027 Parameter (Split-Shortcode / Late-Registered Shortcode)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100157",
    "datePublished": "2026-10-03T06:38:26.027Z",
    "dateReserved": "2026-09-25T12:18:04.662Z",
    "dateUpdated": "2026-10-03T15:42:41.054Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-103519 (GCVE-0-2026-103519)

    Vulnerability from cvelistv5 – Published: 2026-10-03 06:38 – Updated: 2026-10-03 15:42
    VLAI
    Title
    WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter
    Summary
    The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. The bypass relies on WordPress's own strip_shortcodes() function unwrapping the [[tag]] double-bracket escape to a bare [tag] that survives wp_insert_post storage and fires when the publicly queryable xs_review post type is rendered through the_content.
    Severity
    5.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-03 15:24 UTC
    CWE
    • CWE-94 - Improper Control of Generation of Code ('Code Injection')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    roxnor WP Ultimate Review Affected: 0 , ≤ 2.4.3 (semver)
    		Create a notification for this product.
    Credits
    Eunho Kim
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-103519",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:24:54.105226Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:42:41.904Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Ultimate Review",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "2.4.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Eunho Kim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. The bypass relies on WordPress\u0027s own strip_shortcodes() function unwrapping the [[tag]] double-bracket escape to a bare [tag] that survives wp_insert_post storage and fires when the publicly queryable xs_review post type is rendered through the_content."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T06:38:23.698Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/76986a3a-67f8-4d91-9f48-88fad356c3b4?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/app/content.php#L347"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/app/content.php#L366"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/init.php#L291"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/app/content.php#L217"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3720426%40wp-ultimate-review\u0026new=3720426%40wp-ultimate-review"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-30T19:17:10.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-02T17:41:13.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Ultimate Review \u003c= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via \u0027xs_reviw_summery\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-103519",
    "datePublished": "2026-10-03T06:38:23.698Z",
    "dateReserved": "2026-09-30T19:01:44.804Z",
    "dateUpdated": "2026-10-03T15:42:41.904Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-97344 (GCVE-0-2026-97344)

    Vulnerability from cvelistv5 – Published: 2026-10-03 05:29 – Updated: 2026-10-03 15:42
    VLAI
    Title
    Wp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write
    Summary
    The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to chain two steps: invoking the nonce-only dismiss_ajax_call endpoint (nonce accessible to Subscribers via any wp-admin page) to set the xs_social_profile_image meta flag on their own account, which activates the unescaped img output branch in xs_social_get_avatar, and then setting their display name to a script payload that core's ENT_NOQUOTES handling preserves unescaped.
    Severity
    6.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-03 15:32 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Credits
    Jakub Herman
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-97344",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:32:53.553628Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:42:45.605Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Wp Social Login and Register Social Counter",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "3.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakub Herman"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to chain two steps: invoking the nonce-only dismiss_ajax_call endpoint (nonce accessible to Subscribers via any wp-admin page) to set the xs_social_profile_image meta flag on their own account, which activates the unescaped img output branch in xs_social_get_avatar, and then setting their display name to a script payload that core\u0027s ENT_NOQUOTES handling preserves unescaped."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T05:29:13.734Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/40e03292-c2dc-4d34-88f4-0d0631e7b981?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/app/avatar.php#L40"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/lib/notice/notice.php#L384"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/lib/notice/notice.php#L422"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3720423%40wp-social\u0026new=3720423%40wp-social"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-24T12:40:15.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-02T17:23:42.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Wp Social Login and Register Social Counter \u003c= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-97344",
    "datePublished": "2026-10-03T05:29:13.734Z",
    "dateReserved": "2026-09-24T12:25:10.497Z",
    "dateUpdated": "2026-10-03T15:42:45.605Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-94500 (GCVE-0-2026-94500)

    Vulnerability from cvelistv5 – Published: 2026-09-23 18:14 – Updated: 2026-09-23 18:46
    VLAI
    Title
    WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
    Summary
    Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-23 18:38 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Patchstack CNA under the mitre root
    CNA scorecard B 75/100 over 3528 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Roxnor ElementsKit Elementor addons Lite Affected: n/a , ≤ 4.0.5 (custom)
    		Create a notification for this product.
    Credits
    nh4tvd | Patchstack Bug Bounty Program
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94500",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T18:38:14.282203Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T18:46:52.294Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "elementskit-lite",
          "product": "ElementsKit Elementor addons Lite",
          "vendor": "Roxnor",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.0.6",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.0.5",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "nh4tvd | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite \u003c= 4.0.5 versions."
            }
          ],
          "value": "Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite \u003c= 4.0.5 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T18:14:31.298Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/elementskit-lite/vulnerability/wordpress-elementskit-elementor-addons-lite-plugin-4-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress ElementsKit Elementor addons Lite Plugin to the latest available version (at least 4.0.6)."
            }
          ],
          "value": "Update the WordPress ElementsKit Elementor addons Lite Plugin to the latest available version (at least 4.0.6)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress ElementsKit Elementor addons Lite plugin \u003c= 4.0.5 - Cross Site Scripting (XSS) vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-94500",
    "datePublished": "2026-09-23T18:14:31.298Z",
    "dateReserved": "2026-09-21T17:53:41.813Z",
    "dateUpdated": "2026-09-23T18:46:52.294Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-92235 (GCVE-0-2026-92235)

    Vulnerability from cvelistv5 – Published: 2026-09-22 07:41 – Updated: 2026-09-22 10:25
    VLAI
    Title
    WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter
    Summary
    The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
    Severity
    8.1 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-22 10:08 UTC
    CWE
    • CWE-94 - Improper Control of Generation of Code ('Code Injection')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    roxnor WP Ultimate Review Affected: 0 , ≤ 2.4.2 (semver)
    		Create a notification for this product.
    Credits
    jtb75
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92235",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T10:08:59.756351Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T10:25:32.150Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Ultimate Review",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "2.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "jtb75"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T07:41:13.593Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dc0fe855-97b7-46ef-b1c8-1602447e97e6?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/app/content.php#L360"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/app/content.php#L341"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/app/content.php#L189"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/app/content.php#L56"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/init.php#L271"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/views/public/meta-box-user-review.php#L538"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3703958%40wp-ultimate-review\u0026new=3703958%40wp-ultimate-review"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T19:36:06.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-21T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Ultimate Review \u003c= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via \u0027xs_submit_review_data[xs_reviw_summery]\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-92235",
    "datePublished": "2026-09-22T07:41:13.593Z",
    "dateReserved": "2026-09-15T19:31:28.783Z",
    "dateUpdated": "2026-09-22T10:25:32.150Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-85575 (GCVE-0-2026-85575)

    Vulnerability from cvelistv5 – Published: 2026-09-15 01:03 – Updated: 2026-09-15 13:54
    VLAI
    Title
    The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter
    Summary
    The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengine_product_title_header_size’ parameter in all versions up to, and including, 4.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
    Severity
    6.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-15 13:25 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Credits
    Romain Deperne (ang3L)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85575",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T13:25:18.606994Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T13:54:32.586Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ShopEngine Elementor WooCommerce Builder Addon \u2013 All in One WooCommerce Solution with eCommerce Templates \u0026 Woo Widgets",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "4.9.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Romain Deperne (ang3L)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The ShopEngine Elementor WooCommerce Builder Addon \u2013 All in One WooCommerce Solution with eCommerce Templates \u0026 Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018shopengine_product_title_header_size\u2019 parameter in all versions up to, and including, 4.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T01:03:08.299Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/acd7b1b5-9618-4e8a-b320-bb65978d2c92?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3693396/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-01T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2026-09-04T11:10:09.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-14T11:05:47.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "The ShopEngine Elementor WooCommerce Builder Addon \u2013 All in One WooCommerce Solution with eCommerce Templates \u0026 Woo Widgets  \u003c= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027shopengine_product_title_header_size\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-85575",
    "datePublished": "2026-09-15T01:03:08.299Z",
    "dateReserved": "2026-09-04T10:54:52.809Z",
    "dateUpdated": "2026-09-15T13:54:32.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-75971 (GCVE-0-2026-75971)

    Vulnerability from cvelistv5 – Published: 2026-08-25 11:27 – Updated: 2026-08-25 13:08
    VLAI
    Title
    ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes
    Summary
    The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the `rum_importer()` function being registered on the WordPress core `import_start` action hook with no plugin-owned capability check and no allowlist filtering, causing arbitrary `<wp_option>` name/value pairs parsed from an attacker-supplied WXR import file to be passed directly to `update_option()`. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to write arbitrary WordPress options — most critically setting `users_can_register` to `1` and `default_role` to `administrator` — enabling open self-registration of Administrator accounts and full site takeover. This is exploitable by Shop Manager-level users because WooCommerce grants that role the `import` capability, allowing it to reach the WordPress Importer flow that fires the `import_start` hook on which `rum_importer()` is registered, contrary to the assumption that the hook is restricted to Administrators.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-25 13:08 UTC
    CWE
    • CWE-269 - Improper Privilege Management
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Credits
    Wordfence PRISM
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75971",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T13:08:21.771878Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T13:08:29.780Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ShopEngine Elementor WooCommerce Builder Addon \u2013 All in One WooCommerce Solution with eCommerce Templates \u0026 Woo Widgets",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "4.9.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The ShopEngine Elementor WooCommerce Builder Addon \u2013 All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the `rum_importer()` function being registered on the WordPress core `import_start` action hook with no plugin-owned capability check and no allowlist filtering, causing arbitrary `\u003cwp_option\u003e` name/value pairs parsed from an attacker-supplied WXR import file to be passed directly to `update_option()`. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to write arbitrary WordPress options \u2014 most critically setting `users_can_register` to `1` and `default_role` to `administrator` \u2014 enabling open self-registration of Administrator accounts and full site takeover. This is exploitable by Shop Manager-level users because WooCommerce grants that role the `import` capability, allowing it to reach the WordPress Importer flow that fires the `import_start` hook on which `rum_importer()` is registered, contrary to the assumption that the hook is restricted to Administrators."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T11:27:11.397Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4045d49f-fd12-4906-9e60-97fdb082fe84?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shopengine/tags/4.9.4/core/export-import/import.php#L45"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shopengine/tags/4.9.4/core/export-import/import.php#L19"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shopengine/tags/4.9.4/core/builders/base.php#L57"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-18T17:50:12.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-08-24T22:24:38.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "ShopEngine Elementor WooCommerce Builder Addon \u003c= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import \u0027\u003cwp_option\u003e\u0027 Nodes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-75971",
    "datePublished": "2026-08-25T11:27:11.397Z",
    "dateReserved": "2026-08-18T17:35:04.430Z",
    "dateUpdated": "2026-08-25T13:08:29.780Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-18100 (GCVE-0-2026-18100)

    Vulnerability from cvelistv5 – Published: 2026-08-25 07:39 – Updated: 2026-08-25 18:12
    VLAI
    Title
    MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting
    Summary
    The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mf_form_id' Widget Setting in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses Elementor's save-time wp_kses_post filter because it contains no HTML tags, and MetForm's own str_replace transformation of script tags into JavaScript template literal expressions provides an additional delivery path.
    Severity
    6.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-25 18:12 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Credits
    Jonah Burgess (CryptoCat)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18100",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T18:12:43.152431Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T18:12:52.098Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates \u0026 Custom Form Builder for Elementor",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "4.1.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jonah Burgess (CryptoCat)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The MetForm \u2013 Contact Form, Survey, Quiz, \u0026 Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027mf_form_id\u0027 Widget Setting in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses Elementor\u0027s save-time wp_kses_post filter because it contains no HTML tags, and MetForm\u0027s own str_replace transformation of script tags into JavaScript template literal expressions provides an additional delivery path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T07:39:50.408Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/976f1f01-ad5d-413e-a208-ae4b71a61502?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/metform/tags/4.1.8/utils/util.php#L605"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/metform/tags/4.1.8/controls/form-picker-utils.php#L45"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/metform/tags/4.1.8/widgets/form.php#L143"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/metform/tags/4.1.4/utils/util.php#L605"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/metform/tags/4.1.4/controls/form-picker-utils.php#L45"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/metform/tags/4.1.4/widgets/form.php#L143"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3639278%40metform%2Ftrunk\u0026old=3618333%40metform%2Ftrunk"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-28T17:45:54.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-08-24T19:12:51.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "MetForm \u003c= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027mf_form_id\u0027 Widget Setting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-18100",
    "datePublished": "2026-08-25T07:39:50.408Z",
    "dateReserved": "2026-07-28T17:29:53.289Z",
    "dateUpdated": "2026-08-25T18:12:52.098Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-76063 (GCVE-0-2026-76063)

    Vulnerability from cvelistv5 – Published: 2026-08-25 03:27 – Updated: 2026-08-25 19:22
    VLAI
    Title
    FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter
    Summary
    The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfp_featured_video_url' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The REST endpoint used to submit the video URL has its permission_callback set to __return_true, meaning any authenticated user — including those with Subscriber-level access — can reach the vulnerable code path.
    Severity
    6.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-25 18:32 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Credits
    Wordfence PRISM
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76063",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T18:32:50.975332Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T19:22:31.342Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FundEngine \u2013 Donation and Crowdfunding Platform",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "1.8.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The FundEngine \u2013 Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027wfp_featured_video_url\u0027 parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The REST endpoint used to submit the video URL has its permission_callback set to __return_true, meaning any authenticated user \u2014 including those with Subscriber-level access \u2014 can reach the vulnerable code path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T03:27:06.337Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9cf1230e-759e-4892-8de8-1adb3a0e48a1?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-fundraising-donation/tags/1.8.1/apps/featured.php#L175"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-fundraising-donation/tags/1.8.1/apps/featured.php#L467"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-fundraising-donation/tags/1.8.1/apps/content.php#L1425"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-fundraising-donation/tags/1.8.1/apps/content.php#L1198"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3656562%40wp-fundraising-donation\u0026new=3656562%40wp-fundraising-donation"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-18T21:19:27.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-08-24T14:32:08.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "FundEngine \u003c= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \u0027wfp_featured_video_url\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-76063",
    "datePublished": "2026-08-25T03:27:06.337Z",
    "dateReserved": "2026-08-18T21:04:21.474Z",
    "dateUpdated": "2026-08-25T19:22:31.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-75930 (GCVE-0-2026-75930)

    Vulnerability from cvelistv5 – Published: 2026-08-25 03:27 – Updated: 2026-08-25 15:19
    VLAI
    Title
    FundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' Parameter
    Summary
    The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary posts and pages — overwriting title and content, and seizing ownership by supplying an attacker-controlled post_author integer that bypasses wp_kses_post sanitization. The wp_rest nonce required by the handler is trivially obtainable by any logged-in user via /wp-admin/admin-ajax.php?action=rest-nonce and therefore does not constitute an authorization barrier.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-25 15:18 UTC
    CWE
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2430 records in the last 180 days details
    References
    Impacted products
    Credits
    Wordfence PRISM
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75930",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T15:18:42.413356Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T15:19:49.192Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FundEngine \u2013 Donation and Crowdfunding Platform",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "1.8.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The FundEngine \u2013 Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary posts and pages \u2014 overwriting title and content, and seizing ownership by supplying an attacker-controlled post_author integer that bypasses wp_kses_post sanitization. The wp_rest nonce required by the handler is trivially obtainable by any logged-in user via /wp-admin/admin-ajax.php?action=rest-nonce and therefore does not constitute an authorization barrier."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T03:27:05.464Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/08057fa2-90e1-4537-a828-a2c5902b348c?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-fundraising-donation/tags/1.8.1/apps/content.php#L1228"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-fundraising-donation/tags/1.8.1/apps/content.php#L1195"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-fundraising-donation/tags/1.8.1/apps/content.php#L289"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3656562%40wp-fundraising-donation\u0026new=3656562%40wp-fundraising-donation"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-18T15:58:15.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-08-24T14:32:34.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "FundEngine \u003c= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via \u0027campaign_post\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-75930",
    "datePublished": "2026-08-25T03:27:05.464Z",
    "dateReserved": "2026-08-18T15:43:07.095Z",
    "dateUpdated": "2026-08-25T15:19:49.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-73993 (GCVE-0-2026-73993)

    Vulnerability from cvelistv5 – Published: 2026-08-20 12:07 – Updated: 2026-08-20 16:27
    VLAI
    Title
    WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
    Summary
    Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-20 16:00 UTC
    CWE
    • CWE-502 - Deserialization of Untrusted Data
    Assigner
    Patchstack CNA under the mitre root
    CNA scorecard B 75/100 over 3528 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Roxnor FundEngine Affected: n/a , ≤ 1.7.9 (custom)
    		Create a notification for this product.
    Credits
    Taylsec | Patchstack Bug Bounty Program
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73993",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T16:00:38.130737Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T16:27:27.661Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "wp-fundraising-donation",
          "product": "FundEngine",
          "vendor": "Roxnor",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.8.0",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.7.9",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Taylsec | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unauthenticated PHP Object Injection in FundEngine \u003c= 1.7.9 versions."
            }
          ],
          "value": "Unauthenticated PHP Object Injection in FundEngine \u003c= 1.7.9 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-586",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-586 Object Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T12:07:21.318Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/wp-fundraising-donation/vulnerability/wordpress-fundengine-plugin-1-7-9-php-object-injection-vulnerability-2?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress FundEngine Plugin to the latest available version (at least 1.8.0)."
            }
          ],
          "value": "Update the WordPress FundEngine Plugin to the latest available version (at least 1.8.0)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress FundEngine plugin \u003c= 1.7.9 - PHP Object Injection vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-73993",
    "datePublished": "2026-08-20T12:07:21.318Z",
    "dateReserved": "2026-08-14T10:15:59.205Z",
    "dateUpdated": "2026-08-20T16:27:27.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-32470 (GCVE-0-2026-32470)

    Vulnerability from cvelistv5 – Published: 2026-08-18 13:59 – Updated: 2026-08-18 19:48
    VLAI
    Title
    WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
    Summary
    Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-18 19:31 UTC
    CWE
    • CWE-502 - Deserialization of Untrusted Data
    Assigner
    Patchstack CNA under the mitre root
    CNA scorecard B 75/100 over 3528 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Roxnor FundEngine Affected: n/a , ≤ 1.7.9 (custom)
    		Create a notification for this product.
    Credits
    daroo | Patchstack Bug Bounty Program
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32470",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T19:31:33.940910Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T19:48:24.165Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "wp-fundraising-donation",
          "product": "FundEngine",
          "vendor": "Roxnor",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.8.0",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.7.9",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "daroo | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unauthenticated PHP Object Injection in FundEngine \u003c= 1.7.9 versions."
            }
          ],
          "value": "Unauthenticated PHP Object Injection in FundEngine \u003c= 1.7.9 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-586",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-586 Object Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T13:59:24.334Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/wp-fundraising-donation/vulnerability/wordpress-fundengine-plugin-1-7-9-php-object-injection-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress FundEngine Plugin to the latest available version (at least 1.8.0)."
            }
          ],
          "value": "Update the WordPress FundEngine Plugin to the latest available version (at least 1.8.0)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress FundEngine plugin \u003c= 1.7.9 - PHP Object Injection vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-32470",
    "datePublished": "2026-08-18T13:59:24.334Z",
    "dateReserved": "2026-03-12T11:11:50.221Z",
    "dateUpdated": "2026-08-18T19:48:24.165Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-65440 (GCVE-0-2026-65440)

    Vulnerability from cvelistv5 – Published: 2026-07-27 22:44 – Updated: 2026-07-28 13:32
    VLAI
    Title
    WordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability
    Summary
    Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.
    Severity
    7.1 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-07-28 13:32 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Patchstack CNA under the mitre root
    CNA scorecard B 75/100 over 3528 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Roxnor GetGenie Affected: n/a , ≤ 4.4.3 (custom)
    		Create a notification for this product.
    Credits
    daroo | Patchstack Bug Bounty Program
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-65440",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T13:32:08.657265Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T13:32:17.246Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "getgenie",
          "product": "GetGenie",
          "vendor": "Roxnor",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.5.0",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.4.3",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "daroo | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unauthenticated Cross Site Scripting (XSS) in GetGenie \u003c= 4.4.3 versions."
            }
          ],
          "value": "Unauthenticated Cross Site Scripting (XSS) in GetGenie \u003c= 4.4.3 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-591 Reflected XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-27T22:44:03.223Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/getgenie/vulnerability/wordpress-getgenie-plugin-4-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress GetGenie Plugin to the latest available version (at least 4.5.0)."
            }
          ],
          "value": "Update the WordPress GetGenie Plugin to the latest available version (at least 4.5.0)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress GetGenie plugin \u003c= 4.4.3 - Cross Site Scripting (XSS) vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-65440",
    "datePublished": "2026-07-27T22:44:03.223Z",
    "dateReserved": "2026-07-22T08:52:41.030Z",
    "dateUpdated": "2026-07-28T13:32:17.246Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}