Search vulnerabilities

Expected end of text, found ':' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,860

CVE-2026-119113

GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the listing description (post_content) in versions up to, and including, 2.8.199 This is due to insufficient input sanitization on save (the bundled geodir_kses_safe_embed_attributes() helper only neutralises data-embed-url, data-src and data-embed, while WordPress core wp_kses_post permits data-* attributes on standard HTML tags) combined with the AyeCode UI library initializing every [data-bs-toggle="popover-html"] element with { html: true, sanitize: false }, which inserts the attacker-controlled data-bs-content value into the popover body as HTML at render time. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Paoltaia Wordpress-extensions
Products
Geodirectory Geodirectory
CVE-2026-62057

WordPress Divi Contact Form 7 plugin <= 4.1.0 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fahim Reza Wordpress-extensions
Products
Divi Contact Form 7 Divi Contact Form 7
CVE-2026-109234

Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5.6.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the administrator to have enabled Output Buffering, the HtmlDomParser engine, and Aggressive Resolve, as well as a stored-HTML submission surface (such as bbPress anonymous replies) whose kses allow-list preserves img attributes; given these preconditions, a one-shot unauthenticated submission can execute arbitrary JavaScript in the context of any user who views the affected page.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Tigroumeow Wordpress-extensions
Products
Meow Lightbox Meow Lightbox
CVE-2026-118043

Bulk Media Register < 2.01 - Author+ Arbitrary File Move via Path Traversal

The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls and disclose protected files.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Bulk Media Register
CVE-2026-118185

Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limiting

The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Security Optimizer