CVE Vulnerability Catalog

The WordPress plugin Flexible Chat in versions up to 1.1.0 contains an unauthenticated Sensitive Data Exposure vulnerability. An unauthenticated attacker can access information that should be protected.

Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.

Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.

The Widget Options WordPress plugin in versions up to 4.2.5 contains an author-level Remote Code Execution (RCE) vulnerability.

The WordPress plugin eCommerce Product Catalog in versions up to 3.6.5 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script into the page.

The WordPress plugin Mang Board WP in versions up to 2.4.6 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script into the page.

Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions.

The VikRentCar plugin in versions up to 1.4.9 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript that executes in the user's browser.

The HUSKY plugin in versions up to 1.4.6 contains an unauthenticated Broken Access Control vulnerability. An attacker can bypass access control mechanisms and perform unauthorized actions.

The SMS Alert Order Notifications WordPress plugin in versions up to 4.0.2 contains an unauthenticated privilege escalation vulnerability.

Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.

Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions.

Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions.

CVE-2026-109213 has been rejected and must not be used. It is a reservation duplicate of CVE-2026-113499, which should be referenced instead. All descriptions and references for this candidate have been removed to prevent accidental usage.

The YITH WooCommerce Product Add-Ons plugin in versions up to 4.34.0 contains an unauthenticated bypass vulnerability. The description does not specify the mechanism, but indicates a bypass flaw exploitable without authentication.

The Ad Inserter plugin in versions up to 2.8.19 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript that executes in the user's browser.

The Arraytics Booktics plugin in versions up to 1.0.31 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. The issue affects all versions from the start through 1.0.31.

The Meow Gallery plugin for WordPress is vulnerable to stored cross-site scripting via Attachment Alt Text (aria-label attribute) in all versions up to and including 5.5.1 due to insufficient input sanitization and output escaping. An authenticated attacker with author-level access or above can inject arbitrary scripts that execute when a user accesses an injected page.

The Forminator Forms plugin for WordPress in versions up to and including 1.57.3.1 is vulnerable to Insecure Direct Object Reference via the 'previous_draft_id' parameter due to missing validation on a user-controlled key. Unauthenticated attackers can delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions.

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress in versions up to and including 1.17.10 is vulnerable to stored cross-site scripting via inbound email body due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.