GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    5253 vulnerabilities

    CVE-2026-85117 (GCVE-0-2026-85117)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:25 – Updated: 2026-09-09 06:25
    VLAI
    Title
    Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation
    Summary
    The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
    References
    URL Tags
    https://wpscan.com/vulnerability/e791e4a6-5ec1-49… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Contact Form 7 Captcha Affected: 0.1.7 , < 0.1.9 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "collectionURL": "https://wordpress.org/plugins",
              "defaultStatus": "unaffected",
              "product": "Contact Form 7 Captcha",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "0.1.9",
                  "status": "affected",
                  "version": "0.1.7",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Jakub Herman"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:25:07.194Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/e791e4a6-5ec1-49c7-9448-1d83ec4f4905/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-85117",
        "datePublished": "2026-09-09T06:25:07.194Z",
        "dateReserved": "2026-09-03T07:55:26.694Z",
        "dateUpdated": "2026-09-09T06:25:07.194Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-83537 (GCVE-0-2026-83537)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:25 – Updated: 2026-09-09 06:25
    VLAI
    Title
    WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment
    Summary
    The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.
    References
    URL Tags
    https://wpscan.com/vulnerability/02b39e4f-181d-45… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown WP Express Checkout Affected: 0 , < 2.5.0 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "collectionURL": "https://wordpress.org/plugins",
              "defaultStatus": "unaffected",
              "product": "WP Express Checkout",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "2.5.0",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "ryan zegar"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-345 Insufficient Verification of Data Authenticity",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:25:06.539Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/02b39e4f-181d-4573-9175-bf5a6d71e531/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "WP Express Checkout \u003c 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-83537",
        "datePublished": "2026-09-09T06:25:06.539Z",
        "dateReserved": "2026-08-31T17:01:05.328Z",
        "dateUpdated": "2026-09-09T06:25:06.539Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-80440 (GCVE-0-2026-80440)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:25 – Updated: 2026-09-09 06:25
    VLAI
    Title
    Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders
    Summary
    The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.
    References
    URL Tags
    https://wpscan.com/vulnerability/7b86b462-e021-49… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Hustle Affected: 7.0.0.1 , < 7.8.14.2 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "collectionURL": "https://wordpress.org/plugins",
              "defaultStatus": "unaffected",
              "product": "Hustle",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "7.8.14.2",
                  "status": "affected",
                  "version": "7.0.0.1",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Jakub Herman"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 4.8,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:25:05.901Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/7b86b462-e021-4906-bbf3-bf83f89a03ee/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Hustle \u003c 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-80440",
        "datePublished": "2026-09-09T06:25:05.901Z",
        "dateReserved": "2026-08-26T11:10:10.203Z",
        "dateUpdated": "2026-09-09T06:25:05.901Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-19855 (GCVE-0-2026-19855)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:25 – Updated: 2026-09-09 06:25
    VLAI
    Title
    Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text
    Summary
    The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page.
    References
    URL Tags
    https://wpscan.com/vulnerability/c27f3657-261a-46… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown CleanTalk Affected: 0 , < 6.87 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "collectionURL": "https://wordpress.org/plugins",
              "defaultStatus": "unaffected",
              "product": "CleanTalk",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "6.87",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Jakub Herman"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress\u0027s shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:25:05.235Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/c27f3657-261a-46cd-860c-0bdf5c849190/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Spam protection, Honeypot, Anti-Spam by CleanTalk \u003c 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-19855",
        "datePublished": "2026-09-09T06:25:05.235Z",
        "dateReserved": "2026-08-14T09:43:54.757Z",
        "dateUpdated": "2026-09-09T06:25:05.235Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-85418 (GCVE-0-2026-85418)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    Orbit Fox < 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget
    Summary
    The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor views the affected page.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/8f9ba009-324f-46… exploitvdb-entrytechnical-description
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts \u0026 More",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "3.0.9",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Farid Narimanov"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts \u0026 More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor views the affected page."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-79 Cross-Site Scripting (XSS)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:09.271Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/8f9ba009-324f-46ef-853f-9f2e706c401e/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Orbit Fox \u003c 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-85418",
        "datePublished": "2026-09-09T06:00:09.271Z",
        "dateReserved": "2026-09-03T19:33:55.847Z",
        "dateUpdated": "2026-09-09T06:00:09.271Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-85133 (GCVE-0-2026-85133)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    WPLP Cookie Consent < 4.4.2 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions
    Summary
    The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent WordPress plugin before 4.4.2's stored configuration.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/3c43baf6-e2b1-4d… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown WPLP Cookie Consent Affected: 0 , < 4.4.2 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "WPLP Cookie Consent",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "4.4.2",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Naoki Kawahigashi"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The WPLP Cookie Consent  WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent  WordPress plugin before 4.4.2\u0027s stored configuration."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-862 Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:09.097Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/3c43baf6-e2b1-4d6a-ab3f-b8be26f61c9f/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "WPLP Cookie Consent \u003c 4.4.2 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-85133",
        "datePublished": "2026-09-09T06:00:09.097Z",
        "dateReserved": "2026-09-03T08:39:14.441Z",
        "dateUpdated": "2026-09-09T06:00:09.097Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-85132 (GCVE-0-2026-85132)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc_get_schedule_scan
    Summary
    The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/412f604b-ee33-42… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown WPLP Cookie Consent Affected: 4.0.2 , < 4.4.2 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "WPLP Cookie Consent",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "4.4.2",
                  "status": "affected",
                  "version": "4.0.2",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Karthik Ramakrishnan"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The WPLP Cookie Consent  WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-862 Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:08.871Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/412f604b-ee33-42b6-8a39-00f7564d4e2b/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc_get_schedule_scan",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-85132",
        "datePublished": "2026-09-09T06:00:08.871Z",
        "dateReserved": "2026-09-03T08:39:11.008Z",
        "dateUpdated": "2026-09-09T06:00:08.871Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-85037 (GCVE-0-2026-85037)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    Sunshine Photo Cart < 3.7 - Unauthenticated Price Manipulation via IDOR
    Summary
    The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that price, resulting in financial loss for the site owner.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/81201a99-0fbd-49… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Sunshine Photo Cart Affected: 0 , < 3.7 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Sunshine Photo Cart",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "3.7",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Farid Narimanov"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Sunshine Photo Cart  WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that price, resulting in financial loss for the site owner."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:08.416Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/81201a99-0fbd-494a-9d65-b285a2172224/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Sunshine Photo Cart \u003c 3.7 - Unauthenticated Price Manipulation via IDOR",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-85037",
        "datePublished": "2026-09-09T06:00:08.416Z",
        "dateReserved": "2026-09-02T20:26:12.682Z",
        "dateUpdated": "2026-09-09T06:00:08.416Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-84222 (GCVE-0-2026-84222)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter
    Summary
    The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/56ba6cf9-79c5-40… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Kirki Affected: 6.2.1 , < 6.3.0 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Kirki",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "6.3.0",
                  "status": "affected",
                  "version": "6.2.1",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Mohammed Abd Alrahman"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Kirki  WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-200 Information Exposure",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:08.247Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/56ba6cf9-79c5-40ce-acfc-7616769ac8cf/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via \u0027kirki_data\u0027 Parameter",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-84222",
        "datePublished": "2026-09-09T06:00:08.247Z",
        "dateReserved": "2026-09-01T11:50:25.666Z",
        "dateUpdated": "2026-09-09T06:00:08.247Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-84113 (GCVE-0-2026-84113)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    Quentn WP < 1.2.15 - Admin+ SQLi via 'orderby'/'order' Parameter
    Summary
    The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/359127b1-94a5-40… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Quentn WP Affected: 0 , < 1.2.15 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Quentn WP",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "1.2.15",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Yaswanth Reddy Sunkara"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-89 SQL Injection",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:08.072Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/359127b1-94a5-4007-94ac-a1d813b04ce0/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Quentn WP \u003c 1.2.15 - Admin+ SQLi via \u0027orderby\u0027/\u0027order\u0027 Parameter",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-84113",
        "datePublished": "2026-09-09T06:00:08.072Z",
        "dateReserved": "2026-09-01T07:14:54.114Z",
        "dateUpdated": "2026-09-09T06:00:08.072Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-84068 (GCVE-0-2026-84068)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    Quentn WP 1.2.13 - 1.2.14 - Unauthenticated SQLi via 'qntn_wp' Parameter
    Summary
    The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticated attackers to extract arbitrary data from the database via SQL injection.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/527a59cf-c7a3-4c… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Quentn WP Affected: 1.2.13 , < 1.2.15 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Quentn WP",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "1.2.15",
                  "status": "affected",
                  "version": "1.2.13",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Yaswanth Reddy Sunkara"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticated attackers to extract arbitrary data from the database via SQL injection."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-89 SQL Injection",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:07.890Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/527a59cf-c7a3-4cf0-85f2-378c62eb7fce/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Quentn WP 1.2.13 - 1.2.14 - Unauthenticated SQLi via \u0027qntn_wp\u0027 Parameter",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-84068",
        "datePublished": "2026-09-09T06:00:07.890Z",
        "dateReserved": "2026-09-01T06:07:37.984Z",
        "dateUpdated": "2026-09-09T06:00:07.890Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-83541 (GCVE-0-2026-83541)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    Sina Extension for Elementor 3.7.1 - 3.10.3 - Contributor+ Stored XSS via Table Widget
    Summary
    The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/3bd0cd85-9fc2-41… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Sina Extension for Elementor Affected: 3.7.1 , < 3.10.4 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Sina Extension for Elementor",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "3.10.4",
                  "status": "affected",
                  "version": "3.7.1",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Dmitrii Ignatyev"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-79 Cross-Site Scripting (XSS)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:07.714Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/3bd0cd85-9fc2-4111-a626-cc4d8daa6977/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Sina Extension for Elementor 3.7.1 - 3.10.3 - Contributor+ Stored XSS via Table Widget",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-83541",
        "datePublished": "2026-09-09T06:00:07.714Z",
        "dateReserved": "2026-08-31T17:41:31.563Z",
        "dateUpdated": "2026-09-09T06:00:07.714Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-82848 (GCVE-0-2026-82848)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure
    Summary
    The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifiers. A related gap lets any enrolled user retrieve other learners' enrolment records as well.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/a6e580be-ce42-47… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Masteriyo LMS Affected: 1.3.1 , < 3.4.0 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Masteriyo LMS",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "3.4.0",
                  "status": "affected",
                  "version": "1.3.1",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Karthik Ramakrishnan"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Masteriyo LMS  WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner\u0027s enrolment status, timestamps and course-progress data by walking sequential record identifiers. A related gap lets any enrolled user retrieve other learners\u0027 enrolment records as well."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-862 Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:07.288Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/a6e580be-ce42-479d-97cd-fcfa2f752b2c/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-82848",
        "datePublished": "2026-09-09T06:00:07.288Z",
        "dateReserved": "2026-08-31T08:27:27.917Z",
        "dateUpdated": "2026-09-09T06:00:07.288Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-82185 (GCVE-0-2026-82185)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    WPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset
    Summary
    The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B test results.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/a1ddc435-b25f-4e… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown WPLP Cookie Consent Affected: 3.6.5 , < 4.4.2 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "WPLP Cookie Consent",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "4.4.2",
                  "status": "affected",
                  "version": "3.6.5",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "RIA Labs"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The WPLP Cookie Consent  WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B test results."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-862 Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:07.110Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/a1ddc435-b25f-4e6b-bc7e-55a73d4f60c8/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "WPLP Cookie Consent \u003c 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-82185",
        "datePublished": "2026-09-09T06:00:07.110Z",
        "dateReserved": "2026-08-28T07:40:30.735Z",
        "dateUpdated": "2026-09-09T06:00:07.110Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-82184 (GCVE-0-2026-82184)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option Update
    Summary
    The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/54f2da44-84c2-4c… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown WPLP Cookie Consent Affected: 3.5.0 , < 4.4.2 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "WPLP Cookie Consent",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "4.4.2",
                  "status": "affected",
                  "version": "3.5.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Alex Spataru"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The WPLP Cookie Consent  WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-862 Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:06.932Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/54f2da44-84c2-4c56-88f3-615ae4054ecb/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "WPLP Cookie Consent \u003c 4.4.2 - Unauthenticated IAB TCF Consent Option Update",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-82184",
        "datePublished": "2026-09-09T06:00:06.932Z",
        "dateReserved": "2026-08-28T07:40:28.496Z",
        "dateUpdated": "2026-09-09T06:00:06.932Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-81741 (GCVE-0-2026-81741)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    Groundhogg < 4.7.2 - Open Redirect via 'redirect_to' Parameter
    Summary
    The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirmation flow to the site's own host, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL by way of a crafted link.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/4bfdee51-f2d0-45… exploitvdb-entrytechnical-description
    Impacted products
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Groundhogg \u2014 CRM, Newsletters, and Marketing Automation",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "4.7.2",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Yaswanth Reddy Sunkara"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Groundhogg \u2014 CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirmation flow to the site\u0027s own host, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL by way of a crafted link."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:06.753Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/4bfdee51-f2d0-4549-a9b4-5f4e11f2de4c/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Groundhogg \u003c 4.7.2 - Open Redirect via \u0027redirect_to\u0027 Parameter",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-81741",
        "datePublished": "2026-09-09T06:00:06.753Z",
        "dateReserved": "2026-08-27T11:49:03.085Z",
        "dateUpdated": "2026-09-09T06:00:06.753Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-81022 (GCVE-0-2026-81022)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    SupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code Leak
    Summary
    The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/30866042-7003-43… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown SupportCandy Affected: 3.3.6 , < 3.5.3 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "SupportCandy",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "3.5.3",
                  "status": "affected",
                  "version": "3.3.6",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Mitre Osman Hussein"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The SupportCandy  WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-200 Information Exposure",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:06.580Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/30866042-7003-434d-9d86-c6527f97374b/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "SupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code Leak",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-81022",
        "datePublished": "2026-09-09T06:00:06.580Z",
        "dateReserved": "2026-08-26T14:41:02.758Z",
        "dateUpdated": "2026-09-09T06:00:06.580Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-81021 (GCVE-0-2026-81021)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure
    Summary
    The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/c2e643fc-1d6d-42… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown SupportCandy Affected: 3.2.9 , < 3.5.3 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "SupportCandy",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "3.5.3",
                  "status": "affected",
                  "version": "3.2.9",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Muni Nitish Kumar Yaddala"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The SupportCandy  WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-200 Information Exposure",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:06.404Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/c2e643fc-1d6d-429d-b2f6-d71a558bccaf/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-81021",
        "datePublished": "2026-09-09T06:00:06.404Z",
        "dateReserved": "2026-08-26T14:40:54.909Z",
        "dateUpdated": "2026-09-09T06:00:06.404Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-80341 (GCVE-0-2026-80341)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    Payment Plugins for PayPal WooCommerce < 2.0.26 - Subscriber+ Stored Payment Method Assignment via IDOR
    Summary
    The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer's stored card to their own account and then charge or delete it. Exploitation requires the attacker to already know the payment provider's identifier for the victim's stored method, which the Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not expose.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/83dceac1-c203-48… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Payment Plugins for PayPal WooCommerce Affected: 1.1.0 , < 2.0.26 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Payment Plugins for PayPal WooCommerce",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "2.0.26",
                  "status": "affected",
                  "version": "1.1.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "m1w34p0n \u0026 krypt3d"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer\u0027s stored card to their own account and then charge or delete it.\nExploitation requires the attacker to already know the payment provider\u0027s identifier for the victim\u0027s stored method, which the Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not expose."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-863 Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:05.974Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/83dceac1-c203-4827-ad34-c3971557fb84/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Payment Plugins for PayPal WooCommerce \u003c 2.0.26 - Subscriber+ Stored Payment Method Assignment via IDOR",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-80341",
        "datePublished": "2026-09-09T06:00:05.974Z",
        "dateReserved": "2026-08-26T09:19:38.732Z",
        "dateUpdated": "2026-09-09T06:00:05.974Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-80340 (GCVE-0-2026-80340)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-pay
    Summary
    The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that customer's billing and shipping details, by iterating sequential order identifiers.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/f8fb328e-1152-41… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Payment Plugins for PayPal WooCommerce Affected: 1.0.0 , < 2.0.26 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Payment Plugins for PayPal WooCommerce",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "2.0.26",
                  "status": "affected",
                  "version": "1.0.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Erwan LR (WPScan)"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that customer\u0027s billing and shipping details, by iterating sequential order identifiers."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-200 Information Exposure",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:05.797Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/f8fb328e-1152-4122-8158-08fda66ec9c4/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Payment Plugins for PayPal WooCommerce \u003c 2.0.26 - Unauthenticated Customer PII Disclosure via order-pay",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-80340",
        "datePublished": "2026-09-09T06:00:05.797Z",
        "dateReserved": "2026-08-26T09:19:36.829Z",
        "dateUpdated": "2026-09-09T06:00:05.797Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-80339 (GCVE-0-2026-80339)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    Payment Plugins for Stripe WooCommerce < 4.0.12 - Unauthenticated Customer PII Disclosure via order-pay
    Summary
    The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that gates access to it, by iterating sequential order identifiers.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/736bc501-6e70-40… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Payment Plugins for Stripe WooCommerce Affected: 4.0.0 , < 4.0.12 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Payment Plugins for Stripe WooCommerce",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "4.0.12",
                  "status": "affected",
                  "version": "4.0.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "m1w34p0n"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that gates access to it, by iterating sequential order identifiers."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-200 Information Exposure",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:05.621Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/736bc501-6e70-409c-bf0d-1b4ef59e5430/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Payment Plugins for Stripe WooCommerce \u003c 4.0.12 - Unauthenticated Customer PII Disclosure via order-pay",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-80339",
        "datePublished": "2026-09-09T06:00:05.621Z",
        "dateReserved": "2026-08-26T09:19:33.772Z",
        "dateUpdated": "2026-09-09T06:00:05.621Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-75861 (GCVE-0-2026-75861)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    Ultimate Gift Cards for WooCommerce < 3.2.10 - Subscriber+ Gift Card Theft and Destruction via Unauthorized Redemption
    Summary
    The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not verify that the user redeeming a gift card is its intended recipient, allowing any authenticated user, such as a subscriber, to redeem gift cards belonging to other users, zeroing their balance and crediting the value to themselves. In 3.2.9 an ownership check was added on one of the two affected redemption paths; the one that remains requires a companion Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 from the same vendor to be active.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/a08125a6-e528-49… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Ultimate Gift Cards for WooCommerce Affected: 0 , < 3.2.10 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Ultimate Gift Cards for WooCommerce",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "3.2.10",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Shikhali Jamalzade"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not verify that the user redeeming a gift card is its intended recipient, allowing any authenticated user, such as a subscriber, to redeem gift cards belonging to other users, zeroing their balance and crediting the value to themselves.\n\nIn 3.2.9 an ownership check was added on one of the two affected redemption paths; the one that remains requires a companion Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 from the same vendor to be active."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-862 Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:05.442Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/a08125a6-e528-49f1-82c4-191df80af26c/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Ultimate Gift Cards for WooCommerce \u003c 3.2.10 - Subscriber+ Gift Card Theft and Destruction via Unauthorized Redemption",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-75861",
        "datePublished": "2026-09-09T06:00:05.442Z",
        "dateReserved": "2026-08-18T11:05:29.327Z",
        "dateUpdated": "2026-09-09T06:00:05.442Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-18042 (GCVE-0-2026-18042)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation
    Summary
    The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/8fe9eccf-031a-43… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown WP Travel Affected: 0 , < 12.0.2 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "WP Travel",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "12.0.2",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Erwan LR (WPScan)"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The WP Travel  WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer\u0027s booking."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-862 Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:05.014Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/8fe9eccf-031a-43ad-b88b-b697977dc031/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "WP Travel \u003c 12.0.2 - Unauthenticated Arbitrary Booking Cancellation",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-18042",
        "datePublished": "2026-09-09T06:00:05.014Z",
        "dateReserved": "2026-07-28T09:35:52.827Z",
        "dateUpdated": "2026-09-09T06:00:05.014Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-16960 (GCVE-0-2026-16960)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    Loops & Logic < 4.3.0 - Unauthenticated User Data and Site Option Disclosure
    Summary
    The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/70344f9a-065d-46… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Loops & Logic Affected: 0 , < 4.3.0 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Loops \u0026 Logic",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "4.3.0",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Philipp Doblhofer"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Loops \u0026 Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-200 Information Exposure",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:04.825Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/70344f9a-065d-4611-b958-0297af6f2c63/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loops \u0026 Logic \u003c 4.3.0 - Unauthenticated User Data and Site Option Disclosure",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-16960",
        "datePublished": "2026-09-09T06:00:04.825Z",
        "dateReserved": "2026-07-24T08:12:25.877Z",
        "dateUpdated": "2026-09-09T06:00:04.825Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-14962 (GCVE-0-2026-14962)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    ELEX WooCommerce Request a Quote < 2.4.1 - Unauthenticated SQLi via variation_id
    Summary
    The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/854a0756-ff87-4a… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown ELEX WooCommerce Request a Quote Affected: 0 , < 2.4.1 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "ELEX WooCommerce Request a Quote",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "2.4.1",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Artus KG"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-89 SQL Injection",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:04.638Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/854a0756-ff87-4a65-959a-2e051a302a12/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "ELEX WooCommerce Request a Quote \u003c 2.4.1 - Unauthenticated SQLi via variation_id",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-14962",
        "datePublished": "2026-09-09T06:00:04.638Z",
        "dateReserved": "2026-07-07T14:27:08.375Z",
        "dateUpdated": "2026-09-09T06:00:04.638Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-13146 (GCVE-0-2026-13146)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR
    Summary
    The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a file to it.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/45ce8cd1-b365-4e… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown WP Travel Affected: 0 , < 12.0.2 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "WP Travel",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "12.0.2",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Revanth Hari Narayana Matte"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The WP Travel  WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer\u0027s email address to change that customer\u0027s booking payment state and attach a file to it."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:04.463Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/45ce8cd1-b365-4ea6-ac93-420c1c72ea4b/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "WP Travel \u003c 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-13146",
        "datePublished": "2026-09-09T06:00:04.463Z",
        "dateReserved": "2026-06-24T09:11:40.802Z",
        "dateUpdated": "2026-09-09T06:00:04.463Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-13144 (GCVE-0-2026-13144)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset
    Summary
    The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/6ffdaa34-83fd-4a… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown WP Travel Affected: 0 , < 12.0.2 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "WP Travel",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "12.0.2",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Revanth Hari Narayana Matte"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The WP Travel  WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer\u0027s email address to reset that customer\u0027s booking payment to an unpaid state and wipe its stored deposit-reconciliation data."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-284 Improper Access Control",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:04.289Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/6ffdaa34-83fd-4a05-bf36-071b17f280c4/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "WP Travel \u003c 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-13144",
        "datePublished": "2026-09-09T06:00:04.289Z",
        "dateReserved": "2026-06-24T09:11:36.496Z",
        "dateUpdated": "2026-09-09T06:00:04.289Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2025-15690 (GCVE-0-2025-15690)

    Vulnerability from cvelistv5 – Published: 2026-09-09 06:00 – Updated: 2026-09-09 06:00
    VLAI
    Title
    Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and Styles
    Summary
    The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewing the affected page. The Content Mask WordPress plugin before 1.8.5.6's option to restrict its use by role does not prevent this.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/bb49823c-16f1-4c… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Content Mask Affected: 1.7.1 , < 1.8.5.6 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Content Mask",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "1.8.5.6",
                  "status": "affected",
                  "version": "1.7.1",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Andrea Fiocchi"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewing the affected page.\nThe Content Mask WordPress plugin before 1.8.5.6\u0027s option to restrict its use by role does not prevent this."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-79 Cross-Site Scripting (XSS)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T06:00:04.112Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/bb49823c-16f1-4cce-a212-ae2aa7ea5730/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and Styles",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2025-15690",
        "datePublished": "2026-09-09T06:00:04.112Z",
        "dateReserved": "2026-08-20T07:32:04.074Z",
        "dateUpdated": "2026-09-09T06:00:04.112Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-80437 (GCVE-0-2026-80437)

    Vulnerability from cvelistv5 – Published: 2026-09-06 09:36 – Updated: 2026-09-06 10:43
    VLAI
    Title
    Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags
    Summary
    The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-06 10:41 UTC
    CWE
    References
    URL Tags
    https://wpscan.com/vulnerability/473a3321-7dc6-45… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Ninja Forms Affected: 3.14.10 , < 3.15.2 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-80437",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-06T10:41:40.670780Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-74",
                    "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-06T10:43:11.285Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://wordpress.org/plugins",
              "defaultStatus": "unaffected",
              "product": "Ninja Forms",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "3.15.2",
                  "status": "affected",
                  "version": "3.14.10",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Jakub Herman"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 4.8,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-06T09:36:35.180Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "name": "wpscan.com",
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/473a3321-7dc6-454a-82f4-89b6a393d09a/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-80437",
        "datePublished": "2026-09-06T09:36:35.180Z",
        "dateReserved": "2026-08-26T11:09:47.779Z",
        "dateUpdated": "2026-09-06T10:43:11.285Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-80439 (GCVE-0-2026-80439)

    Vulnerability from cvelistv5 – Published: 2026-09-06 09:36 – Updated: 2026-09-06 10:43
    VLAI
    Title
    Redirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthenticated Arbitrary Shortcode Execution via Action Setting Mail-Tags
    Summary
    The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run any shortcode registered on the site and read its output.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-06 10:41 UTC
    CWE
    References
    URL Tags
    https://wpscan.com/vulnerability/96562897-f18c-45… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Redirection for Contact Form 7 Affected: 2.2.7 , < 3.2.11 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-80439",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-06T10:41:24.479676Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-74",
                    "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-06T10:43:25.729Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://wordpress.org/plugins",
              "defaultStatus": "unaffected",
              "product": "Redirection for Contact Form 7",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "3.2.11",
                  "status": "affected",
                  "version": "2.2.7",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Jakub Herman"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action\u0027s settings and then processes those settings for shortcodes, allowing unauthenticated users to run any shortcode registered on the site and read its output."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 4.8,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-06T09:36:34.507Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "name": "wpscan.com",
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/96562897-f18c-45d3-9f31-0e40e8df1383/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Redirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthenticated Arbitrary Shortcode Execution via Action Setting Mail-Tags",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-80439",
        "datePublished": "2026-09-06T09:36:34.507Z",
        "dateReserved": "2026-08-26T11:10:02.972Z",
        "dateUpdated": "2026-09-06T10:43:25.729Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }