Search
Find a vulnerability
Search criteria
4 vulnerabilities by wpqode
CVE-2026-12560 (GCVE-0-2026-12560)
Vulnerability from nvd – Published: 2026-06-30 04:30 – Updated: 2026-07-01 10:32
VLAI
EPSS
VEX
Title
Editorial Rating <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Link URL' Field
Summary
The Editorial Rating – Product Review & Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Link URL' Field in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The WordPress unfiltered_html capability exemption does not apply here because the payload is stored in post meta (_wpas_er_options via update_post_meta) rather than in post_content or post_excerpt, meaning the restriction affects all administrators regardless of their unfiltered_html status.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpqode | Editorial Rating – Product Review & Rating System |
Affected:
0 , ≤ 4.0.5
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12560",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-01T10:29:00.862165Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T10:32:07.279Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Editorial Rating \u2013 Product Review \u0026 Rating System",
"vendor": "wpqode",
"versions": [
{
"lessThanOrEqual": "4.0.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Supoj Polsawas (sp0x5ec)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Editorial Rating \u2013 Product Review \u0026 Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027Link URL\u0027 Field in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The WordPress unfiltered_html capability exemption does not apply here because the payload is stored in post meta (_wpas_er_options via update_post_meta) rather than in post_content or post_excerpt, meaning the restriction affects all administrators regardless of their unfiltered_html status."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T04:30:17.760Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/26c63d73-6ce2-4b3a-b0d9-29f7d9b368d5?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/editorial-rating/tags/4.0.5/public/template-parts/wpas-theme-1.php#L57"
},
{
"url": "https://plugins.trac.wordpress.org/browser/editorial-rating/tags/4.0.5/public/template-parts/wpas-theme-1.php#L87"
},
{
"url": "https://plugins.trac.wordpress.org/browser/editorial-rating/tags/4.0.5/public/class-average-score-public_display.php#L90"
},
{
"url": "https://plugins.trac.wordpress.org/browser/editorial-rating/tags/4.0.5/admin/wpas-framework/options/metabox-options.php#L446"
},
{
"url": "https://plugins.trac.wordpress.org/browser/editorial-rating/tags/4.0.3/public/template-parts/wpas-theme-1.php#L57"
},
{
"url": "https://plugins.trac.wordpress.org/browser/editorial-rating/tags/4.0.3/public/template-parts/wpas-theme-1.php#L87"
},
{
"url": "https://plugins.trac.wordpress.org/browser/editorial-rating/tags/4.0.3/public/class-average-score-public_display.php#L90"
},
{
"url": "https://plugins.trac.wordpress.org/browser/editorial-rating/tags/4.0.3/admin/wpas-framework/options/metabox-options.php#L446"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-29T16:17:48.000Z",
"value": "Disclosed"
}
],
"title": "Editorial Rating \u003c= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via \u0027Link URL\u0027 Field"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12560",
"datePublished": "2026-06-30T04:30:17.760Z",
"dateReserved": "2026-06-17T20:17:54.429Z",
"dateUpdated": "2026-07-01T10:32:07.279Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-10536 (GCVE-0-2024-10536)
Vulnerability from nvd – Published: 2025-01-07 05:24 – Updated: 2026-04-08 17:29
VLAI
EPSS
VEX
Title
FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor <= 6.0.0 - Missing Authorization to Authenticated (Subscriber+) Shortcode Export
Summary
The FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handle_block_shortcode_export() function in all versions up to, and including, 6.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export shortcodes.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpqode | FancyPost – Post Blocks, Grids & Sliders for Block Editor and Elementor |
Affected:
0 , ≤ 6.0.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10536",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-07T15:52:27.366609Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-07T16:13:30.798Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FancyPost \u2013 Post Blocks, Grids \u0026 Sliders for Block Editor and Elementor",
"vendor": "wpqode",
"versions": [
{
"lessThanOrEqual": "6.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tieu Pham Trong Nhan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The FancyPost \u2013 Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg \u0026 Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handle_block_shortcode_export() function in all versions up to, and including, 6.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export shortcodes."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:29:51.933Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e573648e-215f-4858-a4d3-a3e85119dbcf?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3215521/post-block/trunk/custom-fields/options/admin-backup.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-01-06T16:23:30.000Z",
"value": "Disclosed"
}
],
"title": "FancyPost \u2013 Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg \u0026 Elementor \u003c= 6.0.0 - Missing Authorization to Authenticated (Subscriber+) Shortcode Export"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-10536",
"datePublished": "2025-01-07T05:24:09.055Z",
"dateReserved": "2024-10-30T11:41:18.419Z",
"dateUpdated": "2026-04-08T17:29:51.933Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12560 (GCVE-0-2026-12560)
Vulnerability from cvelistv5 – Published: 2026-06-30 04:30 – Updated: 2026-07-01 10:32
VLAI
EPSS
VEX
Title
Editorial Rating <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Link URL' Field
Summary
The Editorial Rating – Product Review & Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Link URL' Field in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The WordPress unfiltered_html capability exemption does not apply here because the payload is stored in post meta (_wpas_er_options via update_post_meta) rather than in post_content or post_excerpt, meaning the restriction affects all administrators regardless of their unfiltered_html status.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpqode | Editorial Rating – Product Review & Rating System |
Affected:
0 , ≤ 4.0.5
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12560",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-01T10:29:00.862165Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T10:32:07.279Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Editorial Rating \u2013 Product Review \u0026 Rating System",
"vendor": "wpqode",
"versions": [
{
"lessThanOrEqual": "4.0.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Supoj Polsawas (sp0x5ec)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Editorial Rating \u2013 Product Review \u0026 Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027Link URL\u0027 Field in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The WordPress unfiltered_html capability exemption does not apply here because the payload is stored in post meta (_wpas_er_options via update_post_meta) rather than in post_content or post_excerpt, meaning the restriction affects all administrators regardless of their unfiltered_html status."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T04:30:17.760Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/26c63d73-6ce2-4b3a-b0d9-29f7d9b368d5?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/editorial-rating/tags/4.0.5/public/template-parts/wpas-theme-1.php#L57"
},
{
"url": "https://plugins.trac.wordpress.org/browser/editorial-rating/tags/4.0.5/public/template-parts/wpas-theme-1.php#L87"
},
{
"url": "https://plugins.trac.wordpress.org/browser/editorial-rating/tags/4.0.5/public/class-average-score-public_display.php#L90"
},
{
"url": "https://plugins.trac.wordpress.org/browser/editorial-rating/tags/4.0.5/admin/wpas-framework/options/metabox-options.php#L446"
},
{
"url": "https://plugins.trac.wordpress.org/browser/editorial-rating/tags/4.0.3/public/template-parts/wpas-theme-1.php#L57"
},
{
"url": "https://plugins.trac.wordpress.org/browser/editorial-rating/tags/4.0.3/public/template-parts/wpas-theme-1.php#L87"
},
{
"url": "https://plugins.trac.wordpress.org/browser/editorial-rating/tags/4.0.3/public/class-average-score-public_display.php#L90"
},
{
"url": "https://plugins.trac.wordpress.org/browser/editorial-rating/tags/4.0.3/admin/wpas-framework/options/metabox-options.php#L446"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-29T16:17:48.000Z",
"value": "Disclosed"
}
],
"title": "Editorial Rating \u003c= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via \u0027Link URL\u0027 Field"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12560",
"datePublished": "2026-06-30T04:30:17.760Z",
"dateReserved": "2026-06-17T20:17:54.429Z",
"dateUpdated": "2026-07-01T10:32:07.279Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-10536 (GCVE-0-2024-10536)
Vulnerability from cvelistv5 – Published: 2025-01-07 05:24 – Updated: 2026-04-08 17:29
VLAI
EPSS
VEX
Title
FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor <= 6.0.0 - Missing Authorization to Authenticated (Subscriber+) Shortcode Export
Summary
The FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handle_block_shortcode_export() function in all versions up to, and including, 6.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export shortcodes.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpqode | FancyPost – Post Blocks, Grids & Sliders for Block Editor and Elementor |
Affected:
0 , ≤ 6.0.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10536",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-07T15:52:27.366609Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-07T16:13:30.798Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FancyPost \u2013 Post Blocks, Grids \u0026 Sliders for Block Editor and Elementor",
"vendor": "wpqode",
"versions": [
{
"lessThanOrEqual": "6.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tieu Pham Trong Nhan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The FancyPost \u2013 Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg \u0026 Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handle_block_shortcode_export() function in all versions up to, and including, 6.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export shortcodes."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:29:51.933Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e573648e-215f-4858-a4d3-a3e85119dbcf?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3215521/post-block/trunk/custom-fields/options/admin-backup.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-01-06T16:23:30.000Z",
"value": "Disclosed"
}
],
"title": "FancyPost \u2013 Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg \u0026 Elementor \u003c= 6.0.0 - Missing Authorization to Authenticated (Subscriber+) Shortcode Export"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-10536",
"datePublished": "2025-01-07T05:24:09.055Z",
"dateReserved": "2024-10-30T11:41:18.419Z",
"dateUpdated": "2026-04-08T17:29:51.933Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}