CVE Vulnerability Catalog

The PDF Invoices & Packing Slips for WooCommerce plugin is vulnerable to Stored Cross-Site Scripting via the 'billing_address.first_name / last_name / company, customer_note' parameters in versions up to 5.16.4 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. This is an incomplete fix for CVE-2026-92244: the wp_kses() allow-list introduced in 5.16.2 correctly blocks raw-tag payloads but is bypassed by entity-encoded payloads (e.g., <img onerror=…>) that contain no literal angle-bracket characters and are therefore passed through unmodified before the trailing decode rematerializes them.

The SureCart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in versions up to 4.9.4 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. Successful execution requires the injected comment to be visible on a page that loads SureCart's web-component bundle (e.g., a page containing a SureCart Buy Button block), and the comment must be auto-approved or approved by a moderator.

The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed. This allows unauthenticated attackers to change the payment status of any order in the store regardless of the payment method it was placed with.

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the '__construct' function in all versions up to, and including, 2.20.4. This makes it possible for unauthenticated attackers to delete theme files on the server.

The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export. This allows unauthenticated users to read the content of draft and private posts.

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data. This allows unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the plugin's stored settings.

The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page. This allows unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID.

The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser. This could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content.

The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments. This allows unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.

The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login. This allows an attacker who already knows a user's password to brute force the second factor and take over the account.

The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart. This allows them to create orders for any product at an arbitrary total of their choosing.

The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server. This allows users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls and disclose protected files.

The NextGEN Gallery plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / shortcode attribute desc_below_form (and placeholder as the marker-smuggling helper)' parameter in all versions up to, and including, 1.9.26 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts created through its registration form. Authenticated users with Author-level access and above can cause newly registered accounts, including those created by unauthenticated visitors, to be granted a higher role such as Editor. This is an incomplete fix of CVE-2026-5193: the role-validation control added in 6.6.0 can be circumvented, so versions 6.6.0 through 6.8.7 remain affected.

The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its stored configuration. Users with the Contributor role and above can view secret payment-gateway API credentials, both live and test secret keys, which grant full access to the site owner's payment account.

The Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData.extra' parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5.6.4 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Ninja Forms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.