Search
Find a vulnerability
Search criteria
274 vulnerabilities by ThemeIsle
CVE-2026-121519 (GCVE-0-2026-121519)
Vulnerability from nvd – Published: 2026-11-07 02:29 – Updated: 2026-11-07 02:29
VLAI
EPSS
VEX
Title
Social Slider Feed <= 2.3.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' Parameter
Summary
The Social Slider Feed – Social Media Feed & Gallery Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slidespeed' parameter in all versions up to, and including, 2.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The missing current_user_can() check in the Factory framework's connect() dispatcher allows Subscriber-level users to bypass the manage_options capability gate and both harvest a valid wis_edit_feed nonce and overwrite any feed's slidespeed setting, after which the stored payload fires on every public pageview embedding the feed shortcode.
Severity
6.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeisle | Social Slider Feed – Social Media Feed & Gallery Widgets |
Affected:
0 , ≤ 2.3.8
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Social Slider Feed \u2013 Social Media Feed \u0026 Gallery Widgets",
"vendor": "themeisle",
"versions": [
{
"lessThanOrEqual": "2.3.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kuba"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Social Slider Feed \u2013 Social Media Feed \u0026 Gallery Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027slidespeed\u0027 parameter in all versions up to, and including, 2.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The missing current_user_can() check in the Factory framework\u0027s connect() dispatcher allows Subscriber-level users to bypass the manage_options capability gate and both harvest a valid wis_edit_feed nonce and overwrite any feed\u0027s slidespeed setting, after which the stored payload fires on every public pageview embedding the feed shortcode."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T02:29:13.713Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3ae890e7-a5b6-41c5-bc30-792c0b9272a6?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-slider-widget/tags/2.3.8/components/instagram/html_templates/templates/slider.php#L67"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-slider-widget/tags/2.3.8/libs/factory/pages/includes/admin-page.class.php#L342"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-slider-widget/tags/2.3.8/admin/pages/feeds.php#L219"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-slider-widget/tags/2.3.8/includes/class-feeds.php#L105"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-slider-widget/tags/2.3.8/components/instagram/html_templates/templates/slider-overlay.php#L72"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-slider-widget/tags/2.3.9"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T14:44:34.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-11-06T13:51:22.000Z",
"value": "Disclosed"
}
],
"title": "Social Slider Feed \u003c= 2.3.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \u0027slidespeed\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-121519",
"datePublished": "2026-11-07T02:29:13.713Z",
"dateReserved": "2026-11-03T14:26:27.660Z",
"dateUpdated": "2026-11-07T02:29:13.713Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120035 (GCVE-0-2026-120035)
Vulnerability from nvd – Published: 2026-11-06 11:17 – Updated: 2026-11-06 15:00
VLAI
EPSS
VEX
Title
RSS Aggregator by Feedzy <= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Feed Item Title
Summary
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'item_title (parsed from feed <item><title>)' parameter in all versions up to, and including, 5.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have previously configured a Feed-to-Post import pointing at an attacker-controlled feed URL, after which the attacker can rotate payloads at will without any further interaction with the site.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 14:59 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeisle | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator |
Affected:
0 , ≤ 5.2.13
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120035",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T14:59:25.698548Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:00:43.216Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator",
"vendor": "themeisle",
"versions": [
{
"lessThanOrEqual": "5.2.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "churchill11"
}
],
"descriptions": [
{
"lang": "en",
"value": "The RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027item_title (parsed from feed \u003citem\u003e\u003ctitle\u003e)\u0027 parameter in all versions up to, and including, 5.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have previously configured a Feed-to-Post import pointing at an attacker-controlled feed URL, after which the attacker can rotate payloads at will without any further interaction with the site."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T11:17:40.619Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f29b799a-b9cc-4e0e-b9ae-6ede5449986b?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.13/includes/admin/feedzy-rss-feeds-import.php#L2714"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.13/includes/admin/feedzy-rss-feeds-import.php#L2846"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.13/includes/admin/feedzy-rss-feeds-import.php#L3516"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.13/includes/abstract/feedzy-rss-feeds-admin-abstract.php#L2052"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.14"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-30T18:31:47.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-11-05T22:21:07.000Z",
"value": "Disclosed"
}
],
"title": "RSS Aggregator by Feedzy \u003c= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Feed Item Title"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-120035",
"datePublished": "2026-11-06T11:17:40.619Z",
"dateReserved": "2026-10-30T18:14:33.641Z",
"dateUpdated": "2026-11-06T15:00:43.216Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120659 (GCVE-0-2026-120659)
Vulnerability from nvd – Published: 2026-11-06 09:38 – Updated: 2026-11-06 15:20
VLAI
EPSS
VEX
Title
Redirection for Contact Form 7 <= 3.2.14 - Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy via 'wpcf7-redirect' Parameter
Summary
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to write arbitrary post meta values to newly created lead posts and copy arbitrary server-side files with allowed MIME-type extensions into the plugin's uploads directory. Exploitation requires a published Contact Form 7 form configured with the Save Entry (Save Lead) action enabled on the target site.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 15:19 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeisle | Redirection for Contact Form 7 |
Affected:
0 , ≤ 3.2.14
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120659",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:19:54.481926Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:20:07.860Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Redirection for Contact Form 7",
"vendor": "themeisle",
"versions": [
{
"lessThanOrEqual": "3.2.14",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to write arbitrary post meta values to newly created lead posts and copy arbitrary server-side files with allowed MIME-type extensions into the plugin\u0027s uploads directory. Exploitation requires a published Contact Form 7 form configured with the Save Entry (Save Lead) action enabled on the target site."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T09:38:14.568Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a07e05b8-590e-41fa-acf7-bcaac4ee8615?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.14/classes/class-wpcf7r-post-types.php#L264"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.14/classes/class-wpcf7r-post-types.php#L289"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.14/classes/class-wpcf7r-save-files.php#L202"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.14/classes/class-wpcf7r-post-types.php#L28"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.14/classes/actions/class-wpcf7r-action-save-lead.php#L200"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.14/classes/class-wpcf7r-leads-manager.php#L541"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.15"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-02T18:59:17.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-11-05T20:45:36.000Z",
"value": "Disclosed"
}
],
"title": "Redirection for Contact Form 7 \u003c= 3.2.14 - Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy via \u0027wpcf7-redirect\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-120659",
"datePublished": "2026-11-06T09:38:14.568Z",
"dateReserved": "2026-11-02T18:43:37.149Z",
"dateUpdated": "2026-11-06T15:20:07.860Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119054 (GCVE-0-2026-119054)
Vulnerability from nvd – Published: 2026-10-29 13:08 – Updated: 2026-11-04 01:13
VLAI
EPSS
VEX
Title
Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url
Summary
Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}, executing script in administrators' browsers.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 01:13 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://plugins.trac.wordpress.org/changeset/3742… | patch |
| https://plugins.svn.wordpress.org/multiple-pages-… | technical-description |
| https://plugins.svn.wordpress.org/multiple-pages-… | technical-description |
| https://plugins.svn.wordpress.org/multiple-pages-… | technical-description |
| https://wordpress.org/plugins/multiple-pages-gene… | product |
| https://www.vulncheck.com/advisories/multiple-pag… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Themeisle | Multiple Pages Generator by Themeisle |
Affected:
0 , < 4.2.5
(semver)
cpe:2.3:a:themeisle:multiple_page_generator:*:*:*:*:*:wordpress:*:* |
Date Public
2026-10-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119054",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T01:13:49.352342Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T01:13:59.224Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"product": "Multiple Pages Generator by Themeisle",
"repo": "https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/",
"vendor": "Themeisle",
"versions": [
{
"lessThan": "4.2.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:themeisle:multiple_page_generator:*:*:*:*:*:wordpress:*:*",
"versionEndExcluding": "4.2.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "pnn219"
},
{
"lang": "en",
"type": "finder",
"value": "haidz04kma"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}, executing script in administrators\u0027 browsers."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T13:08:54.249Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "WordPress Plugin Changeset 3742674",
"tags": [
"patch"
],
"url": "https://plugins.trac.wordpress.org/changeset/3742674/multiple-pages-generator-by-porthas"
},
{
"tags": [
"technical-description"
],
"url": "https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/tags/4.2.4/controllers/display/loop/Core.php"
},
{
"tags": [
"technical-description"
],
"url": "https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/tags/4.2.4/controllers/display/Base_Display.php"
},
{
"tags": [
"technical-description"
],
"url": "https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/tags/4.2.4/models/CoreModel.php"
},
{
"name": "WordPress Plugin Page",
"tags": [
"product"
],
"url": "https://wordpress.org/plugins/multiple-pages-generator-by-porthas/"
},
{
"name": "VulnCheck Advisory: Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/multiple-pages-generator-by-themeisle-before-4.2.5-stored-xss-via-shortcode-base-url"
}
],
"title": "Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119054",
"datePublished": "2026-10-29T13:08:54.249Z",
"dateReserved": "2026-10-29T11:51:52.445Z",
"dateUpdated": "2026-11-04T01:13:59.224Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110707 (GCVE-0-2026-110707)
Vulnerability from nvd – Published: 2026-10-29 09:25 – Updated: 2026-10-29 10:45
VLAI
EPSS
VEX
Title
RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element
Summary
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:group/media:description (XML element in the imported feed)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to configure a Feed-to-Post import pointing at an attacker-controlled feed URL and trigger the import via the Run Now action or setup wizard, which is the plugin's standard configuration flow.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 10:32 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeisle | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator |
Affected:
0 , ≤ 5.2.12
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110707",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T10:32:13.049893Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T10:45:41.659Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator",
"vendor": "themeisle",
"versions": [
{
"lessThanOrEqual": "5.2.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hamachi_jp"
}
],
"descriptions": [
{
"lang": "en",
"value": "The RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027media:group/media:description (XML element in the imported feed)\u0027 parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to configure a Feed-to-Post import pointing at an attacker-controlled feed URL and trigger the import via the Run Now action or setup wizard, which is the plugin\u0027s standard configuration flow."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T09:25:33.811Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/47c7e74e-91cb-4bfa-8c21-c60ca0b8cb47?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L2472"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L2445"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L282"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L1457"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.13"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-14T14:43:17.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-28T20:46:33.000Z",
"value": "Disclosed"
}
],
"title": "RSS Aggregator by Feedzy \u003c= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-110707",
"datePublished": "2026-10-29T09:25:33.811Z",
"dateReserved": "2026-10-14T14:28:08.349Z",
"dateUpdated": "2026-10-29T10:45:41.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109207 (GCVE-0-2026-109207)
Vulnerability from nvd – Published: 2026-10-16 03:38 – Updated: 2026-10-16 14:39
VLAI
EPSS
VEX
Title
RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL
Summary
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:34 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeisle | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator |
Affected:
0 , ≤ 5.2.11
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109207",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:34:57.621596Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:39:06.482Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator",
"vendor": "themeisle",
"versions": [
{
"lessThanOrEqual": "5.2.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adrien Brunner"
}
],
"descriptions": [
{
"lang": "en",
"value": "The RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027media:thumbnail@url\u0027 parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T03:38:42.150Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ab1d8bcb-688a-4763-970a-c960925cf0b6?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L1241"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L989"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L2951"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L3413"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/abstract/feedzy-rss-feeds-admin-abstract.php#L2134"
},
{
"url": "https://downloads.wordpress.org/plugin/feedzy-rss-feeds.5.2.12.zip"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-12T13:44:47.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-15T15:31:40.000Z",
"value": "Disclosed"
}
],
"title": "RSS Aggregator by Feedzy \u003c= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-109207",
"datePublished": "2026-10-16T03:38:42.150Z",
"dateReserved": "2026-10-12T13:28:50.946Z",
"dateUpdated": "2026-10-16T14:39:06.482Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104801 (GCVE-0-2026-104801)
Vulnerability from nvd – Published: 2026-10-10 06:40 – Updated: 2026-10-11 16:55
VLAI
EPSS
VEX
Title
PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter
Summary
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The relocated file is moved byte-identically into the publicly accessible wp-content/uploads/ppom_files/confirmed/ directory, meaning the attack also results in arbitrary file read for any web-readable file on the server.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:40 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeisle | PPOM – Product Addons & Custom Fields for WooCommerce |
Affected:
0 , ≤ 34.0.10
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104801",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T16:40:51.443288Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:55:16.598Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PPOM \u2013 Product Addons \u0026 Custom Fields for WooCommerce",
"vendor": "themeisle",
"versions": [
{
"lessThanOrEqual": "34.0.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "whatm"
}
],
"descriptions": [
{
"lang": "en",
"value": "The PPOM \u2013 Product Addons \u0026 Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The relocated file is moved byte-identically into the publicly accessible wp-content/uploads/ppom_files/confirmed/ directory, meaning the attack also results in arbitrary file read for any web-readable file on the server."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T06:40:11.824Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/650b510f-dc13-4ba4-af68-187f516b3051?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/WooCommerce/Order/OrderHandler.php#L287"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/WooCommerce/Cart/CartHandler.php#L369"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/Support/Helpers.php#L224"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/Files/Handler.php#L738"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3733313/woocommerce-product-addon/trunk/src/WooCommerce/Order/OrderHandler.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-02T13:30:12.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T17:51:12.000Z",
"value": "Disclosed"
}
],
"title": "PPOM \u003c= 34.0.10 - Unauthenticated Arbitrary File Deletion via \u0027ppom[fields][\u003cdata_name\u003e][n][org]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-104801",
"datePublished": "2026-10-10T06:40:11.824Z",
"dateReserved": "2026-10-02T13:14:55.098Z",
"dateUpdated": "2026-10-11T16:55:16.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104735 (GCVE-0-2026-104735)
Vulnerability from nvd – Published: 2026-10-10 04:26 – Updated: 2026-10-11 12:23
VLAI
EPSS
VEX
Title
RSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title>
Summary
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title> in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is not neutralized at save time because post_content stores only a benign block reference to an external feed URL; the malicious HTML is injected at render time from the attacker-controlled RSS feed title, bypassing any save-time wp_kses filtering.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:17 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeisle | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator |
Affected:
0 , ≤ 5.2.10
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104735",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:17:38.897732Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:23:58.816Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator",
"vendor": "themeisle",
"versions": [
{
"lessThanOrEqual": "5.2.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS \u003ctitle\u003e in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is not neutralized at save time because post_content stores only a benign block reference to an external feed URL; the malicious HTML is injected at render time from the attacker-controlled RSS feed title, bypassing any save-time wp_kses filtering."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T04:26:45.965Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a15a6cf2-aa7d-454c-83d2-9d74ce4505be?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.10/includes/gutenberg/feedzy-rss-feeds-loop-block.php#L207"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.10/includes/gutenberg/feedzy-rss-feeds-loop-block.php#L262"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.10/includes/gutenberg/feedzy-rss-feeds-loop-block.php#L241"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.10/includes/abstract/feedzy-rss-feeds-admin-abstract.php#L1758"
},
{
"url": "https://downloads.wordpress.org/plugin/feedzy-rss-feeds.5.2.11.zip"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-02T12:06:27.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T15:41:09.000Z",
"value": "Disclosed"
}
],
"title": "RSS Aggregator by Feedzy \u003c= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS \u003ctitle\u003e"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-104735",
"datePublished": "2026-10-10T04:26:45.965Z",
"dateReserved": "2026-10-02T11:51:13.843Z",
"dateUpdated": "2026-10-11T12:23:58.816Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97305 (GCVE-0-2026-97305)
Vulnerability from nvd – Published: 2026-10-05 18:08 – Updated: 2026-10-05 18:45 X_Open Source
VLAI
EPSS
VEX
Title
WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability
Summary
Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 18:45 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Themeisle | AI Chatbot for WordPress – Hyve Lite |
Affected:
0 , ≤ 2.0.2
(custom)
|
Date Public
2026-10-03 17:41
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-97305",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T18:45:02.675112Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T18:45:13.106Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "hyve-lite",
"product": "AI Chatbot for WordPress \u2013 Hyve Lite",
"vendor": "Themeisle",
"versions": [
{
"changes": [
{
"at": "2.0.3",
"status": "unaffected"
}
],
"lessThanOrEqual": "2.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ananda Dhakal (Patchstack)"
}
],
"datePublic": "2026-10-03T17:41:05.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress \u2013 Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects AI Chatbot for WordPress \u2013 Hyve Lite: from n/a through 2.0.2.\u003c/p\u003e"
}
],
"value": "Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress \u2013 Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress \u2013 Hyve Lite: from n/a through 2.0.2."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T18:08:36.362Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/hyve-lite/vulnerability/wordpress-ai-chatbot-for-wordpress-hyve-lite-plugin-2-0-2-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress AI Chatbot for WordPress \u2013 Hyve Lite plugin to the latest available version (at least 2.0.3)."
}
],
"value": "Update the WordPress AI Chatbot for WordPress \u2013 Hyve Lite plugin to the latest available version (at least 2.0.3)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress AI Chatbot for WordPress \u2013 Hyve Lite plugin \u003c= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-97305",
"datePublished": "2026-10-05T18:08:36.362Z",
"dateReserved": "2026-09-24T10:23:27.498Z",
"dateUpdated": "2026-10-05T18:45:13.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102002 (GCVE-0-2026-102002)
Vulnerability from nvd – Published: 2026-10-02 07:39 – Updated: 2026-10-03 15:42
VLAI
EPSS
VEX
Title
Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget
Summary
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otter_form_widget_filter' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the email addresses of the five most recent form submitters, their submission dates, and the site's total form submission count. The widget is registered whenever the themeisle_blocks_form_emails option is non-empty — the normal state after any Form block has been saved — meaning the exposure is active on any standard site using the plugin's form feature.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-03 15:34 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeisle | Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE |
Affected:
0 , ≤ 3.2.6
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102002",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-03T15:34:16.779526Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T15:42:49.640Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE",
"vendor": "themeisle",
"versions": [
{
"lessThanOrEqual": "3.2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakub Herman"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the \u0027otter_form_widget_filter\u0027 parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the email addresses of the five most recent form submitters, their submission dates, and the site\u0027s total form submission count. The widget is registered whenever the themeisle_blocks_form_emails option is non-empty \u2014 the normal state after any Form block has been saved \u2014 meaning the exposure is active on any standard site using the plugin\u0027s form feature."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T07:39:24.233Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6cf22af6-3e25-43ae-b10d-f343720e722a?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/otter-blocks/tags/3.2.6/inc/plugins/class-dashboard.php#L865"
},
{
"url": "https://plugins.trac.wordpress.org/browser/otter-blocks/tags/3.2.6/inc/plugins/class-dashboard.php#L852"
},
{
"url": "https://plugins.trac.wordpress.org/browser/otter-blocks/tags/3.2.6/inc/plugins/class-form-records-post-type.php#L58"
},
{
"url": "https://plugins.trac.wordpress.org/browser/otter-blocks/tags/3.2.6/inc/plugins/class-dashboard.php#L874"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3719861%40otter-blocks\u0026new=3719861%40otter-blocks"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-28T17:06:22.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-01T19:21:44.000Z",
"value": "Disclosed"
}
],
"title": "Otter Blocks \u003c= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-102002",
"datePublished": "2026-10-02T07:39:24.233Z",
"dateReserved": "2026-09-28T16:51:18.173Z",
"dateUpdated": "2026-10-03T15:42:49.640Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62073 (GCVE-0-2026-62073)
Vulnerability from nvd – Published: 2026-10-01 14:33 – Updated: 2026-10-03 15:12
VLAI
EPSS
VEX
Title
WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability
Summary
Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-03 15:10 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Themeisle | WP Full Stripe Free |
Affected:
n/a , ≤ 8.5.6
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62073",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-03T15:10:44.226782Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T15:12:24.535Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "wp-full-stripe-free",
"product": "WP Full Stripe Free",
"vendor": "Themeisle",
"versions": [
{
"changes": [
{
"at": "8.5.7",
"status": "unaffected"
}
],
"lessThanOrEqual": "8.5.6",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Broken Access Control in WP Full Stripe Free \u003c= 8.5.6 versions."
}
],
"value": "Unauthenticated Broken Access Control in WP Full Stripe Free \u003c= 8.5.6 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T14:33:54.117Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/wp-full-stripe-free/vulnerability/wordpress-wp-full-stripe-free-plugin-8-5-6-broken-access-control-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress WP Full Stripe Free plugin to the latest available version (at least 8.5.7)."
}
],
"value": "Update the WordPress WP Full Stripe Free plugin to the latest available version (at least 8.5.7)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress WP Full Stripe Free plugin \u003c= 8.5.6 - Broken Access Control vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-62073",
"datePublished": "2026-10-01T14:33:54.117Z",
"dateReserved": "2026-07-13T06:14:52.917Z",
"dateUpdated": "2026-10-03T15:12:24.535Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97302 (GCVE-0-2026-97302)
Vulnerability from nvd – Published: 2026-09-30 12:28 – Updated: 2026-09-30 13:27
VLAI
EPSS
VEX
Title
WordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vulnerability
Summary
Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 13:02 UTC
CWE
- CWE-201 - Insertion of Sensitive Information Into Sent Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-97302",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T13:02:19.770249Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T13:27:16.701Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "multiple-pages-generator-by-porthas",
"product": "MPG",
"vendor": "Themeisle",
"versions": [
{
"changes": [
{
"at": "4.2.4",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.2.3",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Sensitive Data Exposure in MPG \u003c= 4.2.3 versions."
}
],
"value": "Unauthenticated Sensitive Data Exposure in MPG \u003c= 4.2.3 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "CWE-201 Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T12:28:25.365Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/multiple-pages-generator-by-porthas/vulnerability/wordpress-mpg-plugin-4-2-3-sensitive-data-exposure-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress MPG plugin to the latest available version (at least 4.2.4)."
}
],
"value": "Update the WordPress MPG plugin to the latest available version (at least 4.2.4)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress MPG plugin \u003c= 4.2.3 - Sensitive Data Exposure vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-97302",
"datePublished": "2026-09-30T12:28:25.365Z",
"dateReserved": "2026-09-24T10:23:27.497Z",
"dateUpdated": "2026-09-30T13:27:16.701Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85198 (GCVE-0-2026-85198)
Vulnerability from nvd – Published: 2026-09-12 07:39 – Updated: 2026-09-14 18:30
VLAI
EPSS
VEX
Title
MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path
Summary
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when the [mpg_spintax] shortcode is rendered in site-wide content such as a footer or template part, as the vulnerable code path is only reached when the shortcode is active on the requested page.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 18:30 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeisle | MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO |
Affected:
0 , ≤ 4.2.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85198",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T18:30:07.070630Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T18:30:17.856Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MPG \u2013 Multiple Page Generator, Bulk Landing Pages \u0026 Programmatic SEO",
"vendor": "themeisle",
"versions": [
{
"lessThanOrEqual": "4.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nhien Pham (nhienit) (nhienit)"
},
{
"lang": "en",
"type": "finder",
"value": "thevietronin"
}
],
"descriptions": [
{
"lang": "en",
"value": "The MPG \u2013 Multiple Page Generator, Bulk Landing Pages \u0026 Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when the [mpg_spintax] shortcode is rendered in site-wide content such as a footer or template part, as the vulnerable code path is only reached when the shortcode is active on the requested page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-12T07:39:14.796Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/677004db-d8ac-410c-89d9-ee841d643ef7?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.2.0/controllers/SpintaxController.php#L66"
},
{
"url": "https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.2.0/helpers/Helper.php#L215"
},
{
"url": "https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.2.0/controllers/HookController.php#L594"
},
{
"url": "https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.1.7/controllers/SpintaxController.php#L66"
},
{
"url": "https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.1.7/helpers/Helper.php#L215"
},
{
"url": "https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.1.7/controllers/HookController.php#L594"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3687328%40multiple-pages-generator-by-porthas\u0026new=3687328%40multiple-pages-generator-by-porthas"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-03T13:08:05.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-11T18:53:30.000Z",
"value": "Disclosed"
}
],
"title": "MPG \u003c= 4.2.1 - Unauthenticated SQL Injection via URL Path"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-85198",
"datePublished": "2026-09-12T07:39:14.796Z",
"dateReserved": "2026-09-03T12:52:53.344Z",
"dateUpdated": "2026-09-14T18:30:17.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4945 (GCVE-0-2026-4945)
Vulnerability from nvd – Published: 2026-09-07 12:29 – Updated: 2026-09-08 13:57
VLAI
EPSS
VEX
Title
Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass
Summary
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch_checkout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 13:54 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeisle | Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE |
Affected:
0 , ≤ 3.1.7
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4945",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:54:49.391981Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:57:39.203Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE",
"vendor": "themeisle",
"versions": [
{
"lessThanOrEqual": "3.1.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dmitrii Ignatyev"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the \u0027watch_checkout\u0027 function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:29:05.051Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7ecb9f61-68d5-4c70-8d7d-e4fb067fcff9?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/otter-blocks/trunk/inc/render/class-stripe-checkout-block.php#L69"
},
{
"url": "https://plugins.trac.wordpress.org/browser/otter-blocks/trunk/inc/plugins/class-stripe-api.php#L234"
},
{
"url": "https://plugins.trac.wordpress.org/browser/otter-blocks/trunk/inc/plugins/class-stripe-api.php#L304"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3496611/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-27T00:35:23.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-06T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Otter Blocks \u003c= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-4945",
"datePublished": "2026-09-07T12:29:05.051Z",
"dateReserved": "2026-03-27T00:20:00.000Z",
"dateUpdated": "2026-09-08T13:57:39.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61960 (GCVE-0-2026-61960)
Vulnerability from nvd – Published: 2026-08-13 13:36 – Updated: 2026-08-13 15:48
VLAI
EPSS
VEX
Title
WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability
Summary
Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 14:25 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Themeisle | WP Full Stripe Free |
Affected:
n/a , ≤ 8.5.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61960",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T14:25:04.356485Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:48:12.794Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "wp-full-stripe-free",
"product": "WP Full Stripe Free",
"vendor": "Themeisle",
"versions": [
{
"changes": [
{
"at": "8.5.1",
"status": "unaffected"
}
],
"lessThanOrEqual": "8.5.0",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "dutafi | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free \u003c= 8.5.0 versions."
}
],
"value": "Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free \u003c= 8.5.0 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-591",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-591 Reflected XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:36:40.839Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/wp-full-stripe-free/vulnerability/wordpress-wp-full-stripe-free-plugin-8-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress WP Full Stripe Free Plugin to the latest available version (at least 8.5.1)."
}
],
"value": "Update the WordPress WP Full Stripe Free Plugin to the latest available version (at least 8.5.1)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress WP Full Stripe Free plugin \u003c= 8.5.0 - Cross Site Scripting (XSS) vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-61960",
"datePublished": "2026-08-13T13:36:40.839Z",
"dateReserved": "2026-07-13T06:13:44.978Z",
"dateUpdated": "2026-08-13T15:48:12.794Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121519 (GCVE-0-2026-121519)
Vulnerability from cvelistv5 – Published: 2026-11-07 02:29 – Updated: 2026-11-07 02:29
VLAI
EPSS
VEX
Title
Social Slider Feed <= 2.3.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' Parameter
Summary
The Social Slider Feed – Social Media Feed & Gallery Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slidespeed' parameter in all versions up to, and including, 2.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The missing current_user_can() check in the Factory framework's connect() dispatcher allows Subscriber-level users to bypass the manage_options capability gate and both harvest a valid wis_edit_feed nonce and overwrite any feed's slidespeed setting, after which the stored payload fires on every public pageview embedding the feed shortcode.
Severity
6.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeisle | Social Slider Feed – Social Media Feed & Gallery Widgets |
Affected:
0 , ≤ 2.3.8
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Social Slider Feed \u2013 Social Media Feed \u0026 Gallery Widgets",
"vendor": "themeisle",
"versions": [
{
"lessThanOrEqual": "2.3.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kuba"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Social Slider Feed \u2013 Social Media Feed \u0026 Gallery Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027slidespeed\u0027 parameter in all versions up to, and including, 2.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The missing current_user_can() check in the Factory framework\u0027s connect() dispatcher allows Subscriber-level users to bypass the manage_options capability gate and both harvest a valid wis_edit_feed nonce and overwrite any feed\u0027s slidespeed setting, after which the stored payload fires on every public pageview embedding the feed shortcode."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T02:29:13.713Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3ae890e7-a5b6-41c5-bc30-792c0b9272a6?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-slider-widget/tags/2.3.8/components/instagram/html_templates/templates/slider.php#L67"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-slider-widget/tags/2.3.8/libs/factory/pages/includes/admin-page.class.php#L342"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-slider-widget/tags/2.3.8/admin/pages/feeds.php#L219"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-slider-widget/tags/2.3.8/includes/class-feeds.php#L105"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-slider-widget/tags/2.3.8/components/instagram/html_templates/templates/slider-overlay.php#L72"
},
{
"url": "https://plugins.trac.wordpress.org/browser/instagram-slider-widget/tags/2.3.9"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T14:44:34.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-11-06T13:51:22.000Z",
"value": "Disclosed"
}
],
"title": "Social Slider Feed \u003c= 2.3.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \u0027slidespeed\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-121519",
"datePublished": "2026-11-07T02:29:13.713Z",
"dateReserved": "2026-11-03T14:26:27.660Z",
"dateUpdated": "2026-11-07T02:29:13.713Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120035 (GCVE-0-2026-120035)
Vulnerability from cvelistv5 – Published: 2026-11-06 11:17 – Updated: 2026-11-06 15:00
VLAI
EPSS
VEX
Title
RSS Aggregator by Feedzy <= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Feed Item Title
Summary
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'item_title (parsed from feed <item><title>)' parameter in all versions up to, and including, 5.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have previously configured a Feed-to-Post import pointing at an attacker-controlled feed URL, after which the attacker can rotate payloads at will without any further interaction with the site.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 14:59 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeisle | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator |
Affected:
0 , ≤ 5.2.13
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120035",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T14:59:25.698548Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:00:43.216Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator",
"vendor": "themeisle",
"versions": [
{
"lessThanOrEqual": "5.2.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "churchill11"
}
],
"descriptions": [
{
"lang": "en",
"value": "The RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027item_title (parsed from feed \u003citem\u003e\u003ctitle\u003e)\u0027 parameter in all versions up to, and including, 5.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have previously configured a Feed-to-Post import pointing at an attacker-controlled feed URL, after which the attacker can rotate payloads at will without any further interaction with the site."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T11:17:40.619Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f29b799a-b9cc-4e0e-b9ae-6ede5449986b?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.13/includes/admin/feedzy-rss-feeds-import.php#L2714"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.13/includes/admin/feedzy-rss-feeds-import.php#L2846"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.13/includes/admin/feedzy-rss-feeds-import.php#L3516"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.13/includes/abstract/feedzy-rss-feeds-admin-abstract.php#L2052"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.14"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-30T18:31:47.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-11-05T22:21:07.000Z",
"value": "Disclosed"
}
],
"title": "RSS Aggregator by Feedzy \u003c= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Feed Item Title"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-120035",
"datePublished": "2026-11-06T11:17:40.619Z",
"dateReserved": "2026-10-30T18:14:33.641Z",
"dateUpdated": "2026-11-06T15:00:43.216Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120659 (GCVE-0-2026-120659)
Vulnerability from cvelistv5 – Published: 2026-11-06 09:38 – Updated: 2026-11-06 15:20
VLAI
EPSS
VEX
Title
Redirection for Contact Form 7 <= 3.2.14 - Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy via 'wpcf7-redirect' Parameter
Summary
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to write arbitrary post meta values to newly created lead posts and copy arbitrary server-side files with allowed MIME-type extensions into the plugin's uploads directory. Exploitation requires a published Contact Form 7 form configured with the Save Entry (Save Lead) action enabled on the target site.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 15:19 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeisle | Redirection for Contact Form 7 |
Affected:
0 , ≤ 3.2.14
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120659",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:19:54.481926Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:20:07.860Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Redirection for Contact Form 7",
"vendor": "themeisle",
"versions": [
{
"lessThanOrEqual": "3.2.14",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to write arbitrary post meta values to newly created lead posts and copy arbitrary server-side files with allowed MIME-type extensions into the plugin\u0027s uploads directory. Exploitation requires a published Contact Form 7 form configured with the Save Entry (Save Lead) action enabled on the target site."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T09:38:14.568Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a07e05b8-590e-41fa-acf7-bcaac4ee8615?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.14/classes/class-wpcf7r-post-types.php#L264"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.14/classes/class-wpcf7r-post-types.php#L289"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.14/classes/class-wpcf7r-save-files.php#L202"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.14/classes/class-wpcf7r-post-types.php#L28"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.14/classes/actions/class-wpcf7r-action-save-lead.php#L200"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.14/classes/class-wpcf7r-leads-manager.php#L541"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.15"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-02T18:59:17.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-11-05T20:45:36.000Z",
"value": "Disclosed"
}
],
"title": "Redirection for Contact Form 7 \u003c= 3.2.14 - Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy via \u0027wpcf7-redirect\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-120659",
"datePublished": "2026-11-06T09:38:14.568Z",
"dateReserved": "2026-11-02T18:43:37.149Z",
"dateUpdated": "2026-11-06T15:20:07.860Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119054 (GCVE-0-2026-119054)
Vulnerability from cvelistv5 – Published: 2026-10-29 13:08 – Updated: 2026-11-04 01:13
VLAI
EPSS
VEX
Title
Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url
Summary
Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}, executing script in administrators' browsers.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 01:13 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://plugins.trac.wordpress.org/changeset/3742… | patch |
| https://plugins.svn.wordpress.org/multiple-pages-… | technical-description |
| https://plugins.svn.wordpress.org/multiple-pages-… | technical-description |
| https://plugins.svn.wordpress.org/multiple-pages-… | technical-description |
| https://wordpress.org/plugins/multiple-pages-gene… | product |
| https://www.vulncheck.com/advisories/multiple-pag… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Themeisle | Multiple Pages Generator by Themeisle |
Affected:
0 , < 4.2.5
(semver)
cpe:2.3:a:themeisle:multiple_page_generator:*:*:*:*:*:wordpress:*:* |
Date Public
2026-10-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119054",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T01:13:49.352342Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T01:13:59.224Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"product": "Multiple Pages Generator by Themeisle",
"repo": "https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/",
"vendor": "Themeisle",
"versions": [
{
"lessThan": "4.2.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:themeisle:multiple_page_generator:*:*:*:*:*:wordpress:*:*",
"versionEndExcluding": "4.2.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "pnn219"
},
{
"lang": "en",
"type": "finder",
"value": "haidz04kma"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}, executing script in administrators\u0027 browsers."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T13:08:54.249Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "WordPress Plugin Changeset 3742674",
"tags": [
"patch"
],
"url": "https://plugins.trac.wordpress.org/changeset/3742674/multiple-pages-generator-by-porthas"
},
{
"tags": [
"technical-description"
],
"url": "https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/tags/4.2.4/controllers/display/loop/Core.php"
},
{
"tags": [
"technical-description"
],
"url": "https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/tags/4.2.4/controllers/display/Base_Display.php"
},
{
"tags": [
"technical-description"
],
"url": "https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/tags/4.2.4/models/CoreModel.php"
},
{
"name": "WordPress Plugin Page",
"tags": [
"product"
],
"url": "https://wordpress.org/plugins/multiple-pages-generator-by-porthas/"
},
{
"name": "VulnCheck Advisory: Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/multiple-pages-generator-by-themeisle-before-4.2.5-stored-xss-via-shortcode-base-url"
}
],
"title": "Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119054",
"datePublished": "2026-10-29T13:08:54.249Z",
"dateReserved": "2026-10-29T11:51:52.445Z",
"dateUpdated": "2026-11-04T01:13:59.224Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110707 (GCVE-0-2026-110707)
Vulnerability from cvelistv5 – Published: 2026-10-29 09:25 – Updated: 2026-10-29 10:45
VLAI
EPSS
VEX
Title
RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element
Summary
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:group/media:description (XML element in the imported feed)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to configure a Feed-to-Post import pointing at an attacker-controlled feed URL and trigger the import via the Run Now action or setup wizard, which is the plugin's standard configuration flow.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 10:32 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeisle | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator |
Affected:
0 , ≤ 5.2.12
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110707",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T10:32:13.049893Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T10:45:41.659Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator",
"vendor": "themeisle",
"versions": [
{
"lessThanOrEqual": "5.2.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hamachi_jp"
}
],
"descriptions": [
{
"lang": "en",
"value": "The RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027media:group/media:description (XML element in the imported feed)\u0027 parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to configure a Feed-to-Post import pointing at an attacker-controlled feed URL and trigger the import via the Run Now action or setup wizard, which is the plugin\u0027s standard configuration flow."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T09:25:33.811Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/47c7e74e-91cb-4bfa-8c21-c60ca0b8cb47?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L2472"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L2445"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L282"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L1457"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.13"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-14T14:43:17.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-28T20:46:33.000Z",
"value": "Disclosed"
}
],
"title": "RSS Aggregator by Feedzy \u003c= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-110707",
"datePublished": "2026-10-29T09:25:33.811Z",
"dateReserved": "2026-10-14T14:28:08.349Z",
"dateUpdated": "2026-10-29T10:45:41.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109207 (GCVE-0-2026-109207)
Vulnerability from cvelistv5 – Published: 2026-10-16 03:38 – Updated: 2026-10-16 14:39
VLAI
EPSS
VEX
Title
RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL
Summary
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:34 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeisle | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator |
Affected:
0 , ≤ 5.2.11
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109207",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:34:57.621596Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:39:06.482Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator",
"vendor": "themeisle",
"versions": [
{
"lessThanOrEqual": "5.2.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adrien Brunner"
}
],
"descriptions": [
{
"lang": "en",
"value": "The RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027media:thumbnail@url\u0027 parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T03:38:42.150Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ab1d8bcb-688a-4763-970a-c960925cf0b6?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L1241"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L989"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L2951"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L3413"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/abstract/feedzy-rss-feeds-admin-abstract.php#L2134"
},
{
"url": "https://downloads.wordpress.org/plugin/feedzy-rss-feeds.5.2.12.zip"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-12T13:44:47.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-15T15:31:40.000Z",
"value": "Disclosed"
}
],
"title": "RSS Aggregator by Feedzy \u003c= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-109207",
"datePublished": "2026-10-16T03:38:42.150Z",
"dateReserved": "2026-10-12T13:28:50.946Z",
"dateUpdated": "2026-10-16T14:39:06.482Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104801 (GCVE-0-2026-104801)
Vulnerability from cvelistv5 – Published: 2026-10-10 06:40 – Updated: 2026-10-11 16:55
VLAI
EPSS
VEX
Title
PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter
Summary
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The relocated file is moved byte-identically into the publicly accessible wp-content/uploads/ppom_files/confirmed/ directory, meaning the attack also results in arbitrary file read for any web-readable file on the server.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:40 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeisle | PPOM – Product Addons & Custom Fields for WooCommerce |
Affected:
0 , ≤ 34.0.10
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104801",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T16:40:51.443288Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:55:16.598Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PPOM \u2013 Product Addons \u0026 Custom Fields for WooCommerce",
"vendor": "themeisle",
"versions": [
{
"lessThanOrEqual": "34.0.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "whatm"
}
],
"descriptions": [
{
"lang": "en",
"value": "The PPOM \u2013 Product Addons \u0026 Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The relocated file is moved byte-identically into the publicly accessible wp-content/uploads/ppom_files/confirmed/ directory, meaning the attack also results in arbitrary file read for any web-readable file on the server."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T06:40:11.824Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/650b510f-dc13-4ba4-af68-187f516b3051?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/WooCommerce/Order/OrderHandler.php#L287"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/WooCommerce/Cart/CartHandler.php#L369"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/Support/Helpers.php#L224"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/Files/Handler.php#L738"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3733313/woocommerce-product-addon/trunk/src/WooCommerce/Order/OrderHandler.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-02T13:30:12.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T17:51:12.000Z",
"value": "Disclosed"
}
],
"title": "PPOM \u003c= 34.0.10 - Unauthenticated Arbitrary File Deletion via \u0027ppom[fields][\u003cdata_name\u003e][n][org]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-104801",
"datePublished": "2026-10-10T06:40:11.824Z",
"dateReserved": "2026-10-02T13:14:55.098Z",
"dateUpdated": "2026-10-11T16:55:16.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104735 (GCVE-0-2026-104735)
Vulnerability from cvelistv5 – Published: 2026-10-10 04:26 – Updated: 2026-10-11 12:23
VLAI
EPSS
VEX
Title
RSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title>
Summary
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title> in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is not neutralized at save time because post_content stores only a benign block reference to an external feed URL; the malicious HTML is injected at render time from the attacker-controlled RSS feed title, bypassing any save-time wp_kses filtering.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:17 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeisle | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator |
Affected:
0 , ≤ 5.2.10
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104735",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:17:38.897732Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:23:58.816Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator",
"vendor": "themeisle",
"versions": [
{
"lessThanOrEqual": "5.2.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS \u003ctitle\u003e in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is not neutralized at save time because post_content stores only a benign block reference to an external feed URL; the malicious HTML is injected at render time from the attacker-controlled RSS feed title, bypassing any save-time wp_kses filtering."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T04:26:45.965Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a15a6cf2-aa7d-454c-83d2-9d74ce4505be?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.10/includes/gutenberg/feedzy-rss-feeds-loop-block.php#L207"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.10/includes/gutenberg/feedzy-rss-feeds-loop-block.php#L262"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.10/includes/gutenberg/feedzy-rss-feeds-loop-block.php#L241"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.10/includes/abstract/feedzy-rss-feeds-admin-abstract.php#L1758"
},
{
"url": "https://downloads.wordpress.org/plugin/feedzy-rss-feeds.5.2.11.zip"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-02T12:06:27.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T15:41:09.000Z",
"value": "Disclosed"
}
],
"title": "RSS Aggregator by Feedzy \u003c= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS \u003ctitle\u003e"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-104735",
"datePublished": "2026-10-10T04:26:45.965Z",
"dateReserved": "2026-10-02T11:51:13.843Z",
"dateUpdated": "2026-10-11T12:23:58.816Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97305 (GCVE-0-2026-97305)
Vulnerability from cvelistv5 – Published: 2026-10-05 18:08 – Updated: 2026-10-05 18:45 X_Open Source
VLAI
EPSS
VEX
Title
WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability
Summary
Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 18:45 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Themeisle | AI Chatbot for WordPress – Hyve Lite |
Affected:
0 , ≤ 2.0.2
(custom)
|
Date Public
2026-10-03 17:41
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-97305",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T18:45:02.675112Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T18:45:13.106Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "hyve-lite",
"product": "AI Chatbot for WordPress \u2013 Hyve Lite",
"vendor": "Themeisle",
"versions": [
{
"changes": [
{
"at": "2.0.3",
"status": "unaffected"
}
],
"lessThanOrEqual": "2.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ananda Dhakal (Patchstack)"
}
],
"datePublic": "2026-10-03T17:41:05.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress \u2013 Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects AI Chatbot for WordPress \u2013 Hyve Lite: from n/a through 2.0.2.\u003c/p\u003e"
}
],
"value": "Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress \u2013 Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress \u2013 Hyve Lite: from n/a through 2.0.2."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T18:08:36.362Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/hyve-lite/vulnerability/wordpress-ai-chatbot-for-wordpress-hyve-lite-plugin-2-0-2-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress AI Chatbot for WordPress \u2013 Hyve Lite plugin to the latest available version (at least 2.0.3)."
}
],
"value": "Update the WordPress AI Chatbot for WordPress \u2013 Hyve Lite plugin to the latest available version (at least 2.0.3)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress AI Chatbot for WordPress \u2013 Hyve Lite plugin \u003c= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-97305",
"datePublished": "2026-10-05T18:08:36.362Z",
"dateReserved": "2026-09-24T10:23:27.498Z",
"dateUpdated": "2026-10-05T18:45:13.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102002 (GCVE-0-2026-102002)
Vulnerability from cvelistv5 – Published: 2026-10-02 07:39 – Updated: 2026-10-03 15:42
VLAI
EPSS
VEX
Title
Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget
Summary
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otter_form_widget_filter' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the email addresses of the five most recent form submitters, their submission dates, and the site's total form submission count. The widget is registered whenever the themeisle_blocks_form_emails option is non-empty — the normal state after any Form block has been saved — meaning the exposure is active on any standard site using the plugin's form feature.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-03 15:34 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeisle | Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE |
Affected:
0 , ≤ 3.2.6
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102002",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-03T15:34:16.779526Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T15:42:49.640Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE",
"vendor": "themeisle",
"versions": [
{
"lessThanOrEqual": "3.2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakub Herman"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the \u0027otter_form_widget_filter\u0027 parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the email addresses of the five most recent form submitters, their submission dates, and the site\u0027s total form submission count. The widget is registered whenever the themeisle_blocks_form_emails option is non-empty \u2014 the normal state after any Form block has been saved \u2014 meaning the exposure is active on any standard site using the plugin\u0027s form feature."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T07:39:24.233Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6cf22af6-3e25-43ae-b10d-f343720e722a?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/otter-blocks/tags/3.2.6/inc/plugins/class-dashboard.php#L865"
},
{
"url": "https://plugins.trac.wordpress.org/browser/otter-blocks/tags/3.2.6/inc/plugins/class-dashboard.php#L852"
},
{
"url": "https://plugins.trac.wordpress.org/browser/otter-blocks/tags/3.2.6/inc/plugins/class-form-records-post-type.php#L58"
},
{
"url": "https://plugins.trac.wordpress.org/browser/otter-blocks/tags/3.2.6/inc/plugins/class-dashboard.php#L874"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3719861%40otter-blocks\u0026new=3719861%40otter-blocks"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-28T17:06:22.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-01T19:21:44.000Z",
"value": "Disclosed"
}
],
"title": "Otter Blocks \u003c= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-102002",
"datePublished": "2026-10-02T07:39:24.233Z",
"dateReserved": "2026-09-28T16:51:18.173Z",
"dateUpdated": "2026-10-03T15:42:49.640Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62073 (GCVE-0-2026-62073)
Vulnerability from cvelistv5 – Published: 2026-10-01 14:33 – Updated: 2026-10-03 15:12
VLAI
EPSS
VEX
Title
WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability
Summary
Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-03 15:10 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Themeisle | WP Full Stripe Free |
Affected:
n/a , ≤ 8.5.6
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62073",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-03T15:10:44.226782Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T15:12:24.535Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "wp-full-stripe-free",
"product": "WP Full Stripe Free",
"vendor": "Themeisle",
"versions": [
{
"changes": [
{
"at": "8.5.7",
"status": "unaffected"
}
],
"lessThanOrEqual": "8.5.6",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Broken Access Control in WP Full Stripe Free \u003c= 8.5.6 versions."
}
],
"value": "Unauthenticated Broken Access Control in WP Full Stripe Free \u003c= 8.5.6 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T14:33:54.117Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/wp-full-stripe-free/vulnerability/wordpress-wp-full-stripe-free-plugin-8-5-6-broken-access-control-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress WP Full Stripe Free plugin to the latest available version (at least 8.5.7)."
}
],
"value": "Update the WordPress WP Full Stripe Free plugin to the latest available version (at least 8.5.7)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress WP Full Stripe Free plugin \u003c= 8.5.6 - Broken Access Control vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-62073",
"datePublished": "2026-10-01T14:33:54.117Z",
"dateReserved": "2026-07-13T06:14:52.917Z",
"dateUpdated": "2026-10-03T15:12:24.535Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97302 (GCVE-0-2026-97302)
Vulnerability from cvelistv5 – Published: 2026-09-30 12:28 – Updated: 2026-09-30 13:27
VLAI
EPSS
VEX
Title
WordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vulnerability
Summary
Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 13:02 UTC
CWE
- CWE-201 - Insertion of Sensitive Information Into Sent Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-97302",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T13:02:19.770249Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T13:27:16.701Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "multiple-pages-generator-by-porthas",
"product": "MPG",
"vendor": "Themeisle",
"versions": [
{
"changes": [
{
"at": "4.2.4",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.2.3",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Sensitive Data Exposure in MPG \u003c= 4.2.3 versions."
}
],
"value": "Unauthenticated Sensitive Data Exposure in MPG \u003c= 4.2.3 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "CWE-201 Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T12:28:25.365Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/multiple-pages-generator-by-porthas/vulnerability/wordpress-mpg-plugin-4-2-3-sensitive-data-exposure-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress MPG plugin to the latest available version (at least 4.2.4)."
}
],
"value": "Update the WordPress MPG plugin to the latest available version (at least 4.2.4)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress MPG plugin \u003c= 4.2.3 - Sensitive Data Exposure vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-97302",
"datePublished": "2026-09-30T12:28:25.365Z",
"dateReserved": "2026-09-24T10:23:27.497Z",
"dateUpdated": "2026-09-30T13:27:16.701Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85198 (GCVE-0-2026-85198)
Vulnerability from cvelistv5 – Published: 2026-09-12 07:39 – Updated: 2026-09-14 18:30
VLAI
EPSS
VEX
Title
MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path
Summary
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when the [mpg_spintax] shortcode is rendered in site-wide content such as a footer or template part, as the vulnerable code path is only reached when the shortcode is active on the requested page.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 18:30 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeisle | MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO |
Affected:
0 , ≤ 4.2.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85198",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T18:30:07.070630Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T18:30:17.856Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MPG \u2013 Multiple Page Generator, Bulk Landing Pages \u0026 Programmatic SEO",
"vendor": "themeisle",
"versions": [
{
"lessThanOrEqual": "4.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nhien Pham (nhienit) (nhienit)"
},
{
"lang": "en",
"type": "finder",
"value": "thevietronin"
}
],
"descriptions": [
{
"lang": "en",
"value": "The MPG \u2013 Multiple Page Generator, Bulk Landing Pages \u0026 Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when the [mpg_spintax] shortcode is rendered in site-wide content such as a footer or template part, as the vulnerable code path is only reached when the shortcode is active on the requested page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-12T07:39:14.796Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/677004db-d8ac-410c-89d9-ee841d643ef7?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.2.0/controllers/SpintaxController.php#L66"
},
{
"url": "https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.2.0/helpers/Helper.php#L215"
},
{
"url": "https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.2.0/controllers/HookController.php#L594"
},
{
"url": "https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.1.7/controllers/SpintaxController.php#L66"
},
{
"url": "https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.1.7/helpers/Helper.php#L215"
},
{
"url": "https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.1.7/controllers/HookController.php#L594"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3687328%40multiple-pages-generator-by-porthas\u0026new=3687328%40multiple-pages-generator-by-porthas"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-03T13:08:05.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-11T18:53:30.000Z",
"value": "Disclosed"
}
],
"title": "MPG \u003c= 4.2.1 - Unauthenticated SQL Injection via URL Path"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-85198",
"datePublished": "2026-09-12T07:39:14.796Z",
"dateReserved": "2026-09-03T12:52:53.344Z",
"dateUpdated": "2026-09-14T18:30:17.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4945 (GCVE-0-2026-4945)
Vulnerability from cvelistv5 – Published: 2026-09-07 12:29 – Updated: 2026-09-08 13:57
VLAI
EPSS
VEX
Title
Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass
Summary
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch_checkout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 13:54 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeisle | Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE |
Affected:
0 , ≤ 3.1.7
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4945",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:54:49.391981Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:57:39.203Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE",
"vendor": "themeisle",
"versions": [
{
"lessThanOrEqual": "3.1.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dmitrii Ignatyev"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the \u0027watch_checkout\u0027 function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:29:05.051Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7ecb9f61-68d5-4c70-8d7d-e4fb067fcff9?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/otter-blocks/trunk/inc/render/class-stripe-checkout-block.php#L69"
},
{
"url": "https://plugins.trac.wordpress.org/browser/otter-blocks/trunk/inc/plugins/class-stripe-api.php#L234"
},
{
"url": "https://plugins.trac.wordpress.org/browser/otter-blocks/trunk/inc/plugins/class-stripe-api.php#L304"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3496611/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-27T00:35:23.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-06T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Otter Blocks \u003c= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-4945",
"datePublished": "2026-09-07T12:29:05.051Z",
"dateReserved": "2026-03-27T00:20:00.000Z",
"dateUpdated": "2026-09-08T13:57:39.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61960 (GCVE-0-2026-61960)
Vulnerability from cvelistv5 – Published: 2026-08-13 13:36 – Updated: 2026-08-13 15:48
VLAI
EPSS
VEX
Title
WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability
Summary
Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 14:25 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Themeisle | WP Full Stripe Free |
Affected:
n/a , ≤ 8.5.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61960",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T14:25:04.356485Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:48:12.794Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "wp-full-stripe-free",
"product": "WP Full Stripe Free",
"vendor": "Themeisle",
"versions": [
{
"changes": [
{
"at": "8.5.1",
"status": "unaffected"
}
],
"lessThanOrEqual": "8.5.0",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "dutafi | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free \u003c= 8.5.0 versions."
}
],
"value": "Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free \u003c= 8.5.0 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-591",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-591 Reflected XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:36:40.839Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/wp-full-stripe-free/vulnerability/wordpress-wp-full-stripe-free-plugin-8-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress WP Full Stripe Free Plugin to the latest available version (at least 8.5.1)."
}
],
"value": "Update the WordPress WP Full Stripe Free Plugin to the latest available version (at least 8.5.1)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress WP Full Stripe Free plugin \u003c= 8.5.0 - Cross Site Scripting (XSS) vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-61960",
"datePublished": "2026-08-13T13:36:40.839Z",
"dateReserved": "2026-07-13T06:13:44.978Z",
"dateUpdated": "2026-08-13T15:48:12.794Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}