Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Aruba HiSpeed Cache",
          "vendor": "arubadev",
          "versions": [
            {
              "lessThanOrEqual": "3.0.14",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "theviper17y"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T09:27:09.235Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/59650bce-1b7c-4d3f-b4b0-594108510453?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3674227/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-12T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2026-09-09T20:49:42.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Aruba HiSpeed Cache \u003c= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-15889",
    "datePublished": "2026-09-10T09:27:09.235Z",
    "dateReserved": "2026-07-15T15:28:26.029Z",
    "dateUpdated": "2026-09-10T09:27:09.235Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Redux Framework",
          "vendor": "davidanderson",
          "versions": [
            {
              "lessThanOrEqual": "4.5.13.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "h0xilo"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the user_meta_save() function (which only sanitizes array values, not scalar values) and improper output escaping in the Redux_Slider::render() method, which outputs slider values into unquoted HTML attributes. The vulnerability also exploits the fact that the clean_default() method only casts values to numeric types when they are empty or out of bounds, allowing malicious strings like \u00271 tabindex=0 autofocus onfocus=alert(1) x=\u0027 to pass validation through PHP\u0027s loose type comparison. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into their user profile that will execute whenever an Administrator navigates to view the attacker\u0027s profile page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T09:27:08.744Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/31c554cf-eee9-45a8-8fb6-198978620204?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/fields/slider/class-redux-slider.php#L311"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/fields/slider/class-redux-slider.php#L311"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/extensions/users/class-redux-extension-users.php#L1018"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/extensions/users/class-redux-extension-users.php#L1018"
        },
        {
          "url": "https://github.com/reduxframework/redux-framework/pull/4112/changes"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-02T06:49:25.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-09T21:20:33.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Redux Framework \u003c= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-5399",
    "datePublished": "2026-09-10T09:27:08.744Z",
    "dateReserved": "2026-04-02T06:19:06.082Z",
    "dateUpdated": "2026-09-10T09:27:08.744Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Form Maker by 10Web \u2013 Mobile-Friendly Drag \u0026 Drop Contact Form Builder",
          "vendor": "10web",
          "versions": [
            {
              "lessThanOrEqual": "1.15.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "braintx"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Form Maker by 10Web \u2013 Mobile-Friendly Drag \u0026 Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk_action parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T05:31:29.041Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/69c176ae-fa98-40aa-80f5-7ed2f7626398?source=cve"
        },
        {
          "url": "https://plugins.svn.wordpress.org/form-maker/tags/1.15.46/framework/WDW_FM_Library.php#L938"
        },
        {
          "url": "https://plugins.svn.wordpress.org/form-maker/tags/1.15.46/admin/controllers/Submissions_fm.php#L80"
        },
        {
          "url": "https://plugins.svn.wordpress.org/form-maker/tags/1.15.46/admin/controllers/Submissions_fm.php#L127"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3686568%40form-maker%2Ftags%2F1.15.47\u0026old=3652521%40form-maker%2Ftags%2F1.15.46"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3686567/form-maker/trunk/admin/controllers/Submissions_fm.php"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fform-maker/tags/1.15.46\u0026new_path=%2Fform-maker/tags/1.15.47"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-04T13:10:07.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-09T17:29:48.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Form Maker by 10Web \u2013 Mobile-Friendly Drag \u0026 Drop Contact Form Builder \u003c= 1.15.46 - Reflected Cross-Site Scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-85645",
    "datePublished": "2026-09-10T05:31:29.041Z",
    "dateReserved": "2026-09-04T12:54:52.456Z",
    "dateUpdated": "2026-09-10T05:31:29.041Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Direct Download for WooCommerce",
          "vendor": "kamalyon",
          "versions": [
            {
              "lessThanOrEqual": "1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Spy0x7"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the (top-level include) function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The product ownership check only verifies that some free, virtual, downloadable product exists on the site \u2014 not that the requested file path belongs to that product\u0027s configured downloads \u2014 making exploitation viable on any WooCommerce site with at least one such product."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T03:40:42.733Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d79ba062-4666-41a3-a777-0ba6f63a0cb8?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/direct-download-for-woocommerce/trunk/direct-download.php#L26"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/direct-download-for-woocommerce/trunk/direct-download.php#L50"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/direct-download-for-woocommerce/trunk/direct-download.php#L5"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/direct-download-for-woocommerce/trunk/direct-download-for-woocommerce.php#L87"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/direct-download-for-woocommerce/trunk/direct-download-for-woocommerce.php#L97"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-09T14:49:11.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Direct Download for WooCommerce \u003c= 1.19 - Unauthenticated Arbitrary File Read via \u0027file_id\u0027 Path Segment"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-15019",
    "datePublished": "2026-09-10T03:40:42.733Z",
    "dateReserved": "2026-07-07T23:37:29.653Z",
    "dateUpdated": "2026-09-10T03:40:42.733Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Sidebar Manager Light",
          "vendor": "otwthemes",
          "versions": [
            {
              "lessThanOrEqual": "1.18",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nabil Irawan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027sbm_description\u0027 parameter in all versions up to, and including, 1.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T03:40:42.405Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9f376b14-bdb4-4c4d-b464-328d269c9654?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/sidebar-manager-light/trunk/include/otw_list_sidebars.php#L93"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/sidebar-manager-light/trunk/include/otw_process_actions.php#L89"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/sidebar-manager-light/trunk/include/otw_process_actions.php#L139"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-29T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2026-09-09T14:49:27.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Sidebar Manager Light \u003c= 1.18 - Unauthenticated Stored Cross-Site Scripting via \u0027sbm_description\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-76562",
    "datePublished": "2026-09-10T03:40:42.405Z",
    "dateReserved": "2026-08-19T13:02:37.355Z",
    "dateUpdated": "2026-09-10T03:40:42.405Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Bulk Password Reset",
          "vendor": "rubenw",
          "versions": [
            {
              "lessThanOrEqual": "1.3.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Afan"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "moonge"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user\u0027s identity prior to updating their details like arbitrary user passwords, including administrator passwords, to a known plugin-configured custom value, enabling full account takeover of the site. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user\u0027s email addresses, including administrators, and leverage that to reset the user\u0027s password and gain access to their account."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T03:40:42.058Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/93237020-435f-41a6-bcca-fe7b605723ae?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/bulk-password-reset/tags/1.3.3/bulk_password_reset.php#L679"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/bulk-password-reset/tags/1.3.3/bulk_password_reset.php#L659"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/bulk-password-reset/tags/1.3.3/bulk_password_reset.php#L594"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/bulk-password-reset/tags/1.3.3/bulk_password_reset.php#L44"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-09T14:49:19.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Bulk Password Reset \u003c= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-14873",
    "datePublished": "2026-09-10T03:40:42.058Z",
    "dateReserved": "2026-07-06T14:18:17.520Z",
    "dateUpdated": "2026-09-10T03:40:42.058Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Easy Google Fonts",
          "vendor": "sunny_johal",
          "versions": [
            {
              "lessThanOrEqual": "2.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kitch"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the control_selectors meta field in all versions up to, and including, 2.0.4. This is due to the plugin registering the control_selectors meta field with show_in_rest enabled but without a sanitize_callback, and subsequently outputting this unsanitized data directly into \u003cstyle\u003e tags on the frontend without proper escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T03:40:41.727Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7bf1d5a8-84b7-40e3-b258-eef599b64add?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/easy-google-fonts/trunk/src/includes/frontend.php#L185"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/easy-google-fonts/tags/2.0.4/src/includes/frontend.php#L185"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/easy-google-fonts/trunk/src/includes/data.php#L72"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/easy-google-fonts/tags/2.0.4/src/includes/data.php#L72"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/easy-google-fonts/trunk/src/includes/data.php#L214"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/easy-google-fonts/tags/2.0.4/src/includes/data.php#L214"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/easy-google-fonts/trunk/src/includes/settings.php#L123"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/easy-google-fonts/tags/2.0.4/src/includes/settings.php#L123"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/easy-google-fonts/trunk/src/includes/data.php#L24"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/easy-google-fonts/tags/2.0.4/src/includes/data.php#L24"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-09T15:19:39.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Easy Google Fonts \u003c= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta Field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-4657",
    "datePublished": "2026-09-10T03:40:41.727Z",
    "dateReserved": "2026-03-23T15:23:49.727Z",
    "dateUpdated": "2026-09-10T03:40:41.727Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Builderall for WordPress",
          "vendor": "builderall",
          "versions": [
            {
              "lessThanOrEqual": "3.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Photo Module \u0027attributes\u0027 Setting in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T03:40:41.401Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7b2688ee-f416-4fce-b73a-864f31057146?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/builderall-cheetah-for-wp/trunk/modules/photo/includes/frontend.php#L33"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/builderall-cheetah-for-wp/trunk/modules/photo/photo.php#L312"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/builderall-cheetah-for-wp/trunk/classes/class-ba-cheetah-model.php#L4227"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/builderall-cheetah-for-wp/trunk/classes/class-ba-cheetah-model.php#L4106"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/builderall-cheetah-for-wp/trunk/classes/class-ba-cheetah-ajax.php#L165"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-09T14:49:44.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Builderall for WordPress \u003c= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module \u0027attributes\u0027 Setting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-15820",
    "datePublished": "2026-09-10T03:40:41.401Z",
    "dateReserved": "2026-07-15T13:13:09.487Z",
    "dateUpdated": "2026-09-10T03:40:41.401Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Advanced Contact form 7 DB",
          "vendor": "vsourz1td",
          "versions": [
            {
              "lessThanOrEqual": "2.1.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jiang CY"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to import forged CSV submission records into any Contact Form 7 form managed by the plugin."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T03:40:41.068Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/51abaca6-d882-40b8-86b1-e21835566e3b?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/advanced-cf7-db/tags/2.1.3/admin/partials/import_cf7_entry.class.php#L255"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/advanced-cf7-db/tags/2.1.3/admin/partials/import_cf7_entry.class.php#L51"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/advanced-cf7-db/tags/2.1.3/admin/partials/import_cf7_csv.php#L56"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-25T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2026-09-09T15:19:19.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Advanced Contact form 7 DB \u003c= 2.1.3 - Missing Authorization to Authenticated (Custom+) Unauthorized Data Import via \u0027import_cf7_id\u0027"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-18594",
    "datePublished": "2026-09-10T03:40:41.068Z",
    "dateReserved": "2026-08-02T21:21:26.971Z",
    "dateUpdated": "2026-09-10T03:40:41.068Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP BackItUp Community Edition",
          "vendor": "cssimmon",
          "versions": [
            {
              "lessThanOrEqual": "2.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nikola Kojic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.0 via the \u0027backup_file\u0027 parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The basename() normalization present in the handler only executes when the traversed target path does not exist, providing no protection against reads of existing files."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T03:40:40.713Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/50272c8a-2e23-490d-8865-68ae49228895?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-backitup/tags/2.1.0/lib/includes/handler_download.php#L77"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-backitup/tags/2.1.0/lib/includes/handler_download.php#L73"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-backitup/tags/2.1.0/lib/includes/handler_download.php#L30"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-backitup/tags/2.1.0/lib/includes/class-wpbackitup-admin.php#L1391"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-backitup/tags/2.0.0/lib/includes/handler_download.php#L77"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-backitup/tags/2.0.0/lib/includes/handler_download.php#L73"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-backitup/tags/2.0.0/lib/includes/handler_download.php#L30"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-backitup/tags/2.0.0/lib/includes/class-wpbackitup-admin.php#L1391"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-09T15:19:03.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP BackItUp Community Edition \u003c= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via \u0027backup_file\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-18386",
    "datePublished": "2026-09-10T03:40:40.713Z",
    "dateReserved": "2026-07-30T12:57:05.405Z",
    "dateUpdated": "2026-09-10T03:40:40.713Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Builderall for WordPress",
          "vendor": "builderall",
          "versions": [
            {
              "lessThanOrEqual": "3.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable() function in versions up to, and including, 3.0.2. The wp_ajax_ba_cheetah_disable AJAX handler is registered without any capability or nonce verification, and the target post_id is sourced directly from user-controlled $_POST[\u0027ba_cheetah_data\u0027][\u0027post_id\u0027]. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disable the page builder layout on arbitrary posts by setting the _ba_cheetah_enabled post meta to false, including on posts owned by other users."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T03:40:40.380Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/374c8bc8-83b1-48d3-877a-f6c8fa2f044b?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/builderall-cheetah-for-wp/tags/3.0.2/classes/class-ba-cheetah-model.php#L692"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/builderall-cheetah-for-wp/tags/3.0.2/classes/class-ba-cheetah-model.php#L208"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/builderall-cheetah-for-wp/tags/3.0.2/classes/class-ba-cheetah-model.php#L462"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/builderall-cheetah-for-wp/tags/3.0.2/classes/class-ba-cheetah-model.php#L334"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-09T14:49:52.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Builderall for WordPress \u003c= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via \u0027ba_cheetah_data[post_id]\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-15823",
    "datePublished": "2026-09-10T03:40:40.380Z",
    "dateReserved": "2026-07-15T13:23:22.210Z",
    "dateUpdated": "2026-09-10T03:40:40.380Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Builderall for WordPress",
          "vendor": "builderall",
          "versions": [
            {
              "lessThanOrEqual": "3.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027bg_video_service_url\u0027 Setting in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T03:40:39.911Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/258339a5-c3d5-4777-bd15-7141501f1501?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/builderall-cheetah-for-wp/tags/3.0.2/includes/row-video.php#L87"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/builderall-cheetah-for-wp/tags/3.0.2/classes/class-ba-cheetah-utils.php#L178"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/builderall-cheetah-for-wp/tags/3.0.2/classes/class-ba-cheetah-model.php#L4106"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/builderall-cheetah-for-wp/tags/3.0.2/classes/class-ba-cheetah-ajax.php#L189"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-09T14:49:36.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Builderall for WordPress \u003c= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027bg_video_service_url\u0027 Setting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-15796",
    "datePublished": "2026-09-10T03:40:39.911Z",
    "dateReserved": "2026-07-14T20:22:34.381Z",
    "dateUpdated": "2026-09-10T03:40:39.911Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Ninja Forms - Scheduled Exports",
          "vendor": "Saturday Drive",
          "versions": [
            {
              "lessThanOrEqual": "3.0.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nguyen Truong (Roll)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters (interval, format, emailTo) in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level privileges and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The REST endpoint is registered without a permission_callback and only validates a nonce without checking user capabilities."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T02:28:56.048Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/867ad3a9-7e43-48ac-b5bf-8bd47ccfd8c5?source=cve"
        },
        {
          "url": "https://ninjaforms.com/extensions/scheduled-submissions-export/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-14T14:55:18.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-04T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Ninja Forms - Scheduled Exports \u003c= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-87870",
    "datePublished": "2026-09-10T02:28:56.048Z",
    "dateReserved": "2026-09-09T13:32:31.007Z",
    "dateUpdated": "2026-09-10T02:28:56.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Drag and Drop File Upload for Elementor Forms",
          "vendor": "addonsorg",
          "versions": [
            {
              "lessThanOrEqual": "1.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Adam Rayyan Aryasatya"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in the is_file_type_valid() function, which uses the attacker-controlled \u0027type\u0027 parameter as regex keys in the MIME allowlist, allowing blacklist bypass via a crafted extension that sanitize_file_name() later normalizes to a PHP extension. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T01:26:54.181Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/03e853be-510f-4957-a227-17ca9f825b12?source=cve"
        },
        {
          "url": "https://plugins.svn.wordpress.org/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.0/drag-and-drop-file-upload-for-elementor-forms.php"
        },
        {
          "url": "https://plugins.svn.wordpress.org/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.0/fields/file_upload.php"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.0/fields/file_upload.php#L833"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3628051/drag-and-drop-file-upload-for-elementor-forms"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-30T06:16:48.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-09T12:51:01.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Drag and Drop File Upload for Elementor Forms \u003c= 1.6.0 - Unauthenticated Arbitrary File Upload via \u0027type\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-18351",
    "datePublished": "2026-09-10T01:26:54.181Z",
    "dateReserved": "2026-07-30T06:01:04.246Z",
    "dateUpdated": "2026-09-10T01:26:54.181Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14989",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T13:55:25.303945Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T13:55:33.825Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WPLP Cookie Consent \u2013 Cookie Banner \u0026 Consent Management for GDPR, CCPA \u0026 Google Consent Mode",
          "vendor": "wplegalpages",
          "versions": [
            {
              "lessThanOrEqual": "4.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Naoya Takahashi (nakko)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Cookie Banner for GDPR / CCPA \u2013 WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027wpl_user_preference\u0027 parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The consent-logging AJAX endpoint is registered for unauthenticated users and its required nonce (wpl_consent_logging_nonce) is publicly emitted via wp_localize_script on the frontend, meaning any unauthenticated site visitor can plant a payload without any prior authentication or privileged access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T08:28:23.237Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6045c4fd-60ed-4771-93f4-d4df41ef888b?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/gdpr-cookie-consent/tags/4.3.5/public/modules/consent-logs/class-wpl-consent-logs.php#L700"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/gdpr-cookie-consent/tags/4.3.5/public/modules/consent-logs/class-wpl-cookie-consent-consent-logs.php#L594"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/gdpr-cookie-consent/tags/4.3.5/public/modules/consent-logs/class-wpl-cookie-consent-consent-logs.php#L725"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/gdpr-cookie-consent/tags/4.2.7/public/modules/consent-logs/class-wpl-consent-logs.php#L700"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/gdpr-cookie-consent/tags/4.2.7/public/modules/consent-logs/class-wpl-cookie-consent-consent-logs.php#L594"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/gdpr-cookie-consent/tags/4.2.7/public/modules/consent-logs/class-wpl-cookie-consent-consent-logs.php#L725"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3674117%40gdpr-cookie-consent\u0026new=3674117%40gdpr-cookie-consent"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-08T19:57:34.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Cookie Banner for GDPR / CCPA \u003c= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via \u0027wpl_user_preference\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-14989",
    "datePublished": "2026-09-09T08:28:23.237Z",
    "dateReserved": "2026-07-07T18:45:30.233Z",
    "dateUpdated": "2026-09-09T13:55:33.825Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14359",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:06:21.688017Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T15:06:29.751Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "YITH WooCommerce Waitlist Premium",
          "vendor": "Yith",
          "versions": [
            {
              "lessThanOrEqual": "3.35.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Michele Genito"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the add_user_in_waiting_list() function registered on the wp_ajax_yith_wcwtl_add_user action being missing both a capability check and a nonce verification, and using parse_str() + extract() to import attacker-controlled variables from $_POST[\u0027params\u0027] that are then passed to wp_create_user() and $user-\u003eset_role(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator by creating a new user account and assigning it the administrator role."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T08:28:22.843Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/48660afe-1e03-4bf5-b821-6538a4daf201?source=cve"
        },
        {
          "url": "https://yithemes.com/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-08T20:01:42.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "YITH WooCommerce Waitlist Premium \u003c= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-14359",
    "datePublished": "2026-09-09T08:28:22.843Z",
    "dateReserved": "2026-07-01T18:55:01.201Z",
    "dateUpdated": "2026-09-09T15:06:29.751Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80099",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:41:26.162294Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T16:02:13.368Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Plugin Web",
          "vendor": "Newfold",
          "versions": [
            {
              "lessThanOrEqual": "2.3.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Plugin Crazy Domains",
          "vendor": "Newfold",
          "versions": [
            {
              "lessThanOrEqual": "2.5.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Module Data",
          "vendor": "Newfold",
          "versions": [
            {
              "lessThanOrEqual": "2.9.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Plugin Hostgator",
          "vendor": "Newfold",
          "versions": [
            {
              "lessThanOrEqual": "3.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Plugin Bluehost",
          "vendor": "Newfold",
          "versions": [
            {
              "lessThanOrEqual": "4.19.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "sorin vasile"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the `authenticate()` method \u2014 registered on the `rest_authentication_errors` filter and therefore evaluated for every unauthenticated REST API request \u2014 performs an HMAC-style Bearer token comparison that degenerates when `HiiveConnection::get_auth_token()` returns `false`: PHP coerces `strrev(false)` to `strrev(\u0027\u0027)`, collapsing the secret salt to the publicly known constant `hash(\u0027sha256\u0027, \u0027\u0027) = e3b0c44...`, while all remaining hash inputs (HTTP method, request URL, raw request body, and the `X-Timestamp` header) remain fully attacker-controlled. This makes it possible for unauthenticated attackers to compute a valid Bearer token entirely offline, pass the token equality check, and have `wp_set_current_user()` invoked against the first administrator returned by `get_users([\u0027role\u0027 =\u003e \u0027administrator\u0027])`, granting full administrator-level access and enabling arbitrary REST API operations such as creating new administrator accounts and achieving complete site takeover. Vulnerable versions are WP Plugin Crazy Domains (\u003c= 2.5.2), WP Plugin Web (\u003c= 2.3.4), WP Plugin Hostgator (\u003c= 3.1.0), WP Plugin Bluehost (\u003c= 4.17.1). The affected module is vulnerable in versions up to, and including, 2.9.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T08:28:22.335Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee369c0-0d7c-4142-b3ba-a518288647ba?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-module-data/trunk/includes/Data.php#L222"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-module-data/trunk/includes/Data.php#L201"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-module-data/trunk/includes/Data.php#L191"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-module-data/trunk/includes/HiiveConnection.php#L406"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-module-data/trunk/includes/Data.php#L69"
        },
        {
          "url": "https://github.com/newfold-labs/wp-module-data/commit/9d913fd8fa12796c4d9c09081e4aeccfa5cb1301"
        },
        {
          "url": "https://github.com/newfold-labs/wp-plugin-hostgator/compare/3.2.0...3.2.1"
        },
        {
          "url": "https://github.com/newfold-labs/wp-plugin-bluehost/compare/4.19.0...4.19.1"
        },
        {
          "url": "https://github.com/newfold-labs/wp-plugin-web/compare/2.3.5...2.3.6"
        },
        {
          "url": "https://github.com/newfold-labs/wp-plugin-crazy-domains/compare/2.5.2...2.5.3"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-08T20:12:14.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-80099",
    "datePublished": "2026-09-09T08:28:22.335Z",
    "dateReserved": "2026-08-25T18:44:30.101Z",
    "dateUpdated": "2026-09-09T16:02:13.368Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15398",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T14:02:05.291171Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T14:02:17.022Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Eventin \u2013 Event Calendar, Tickets, Registration, Booking \u0026 WooCommerce",
          "vendor": "arraytics",
          "versions": [
            {
              "lessThanOrEqual": "4.1.22",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Eventin \u2013 Event Calendar, Event Registration, Tickets \u0026 Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.22. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to bypass payment for paid events, fraudulently mark orders as completed, deplete ticket inventory, and trigger confirmation emails for tickets never purchased. This is exploitable by unauthenticated attackers because the wp_rest nonce is publicly emitted on every frontend page, and the order creation endpoint mints and returns an order_access_token to any caller possessing that nonce \u2014 giving unauthenticated users all credentials required to reach the privileged update_booking_status branch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T07:40:56.856Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dd7baa69-88f7-4546-96c8-4829a63d0a99?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L926"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/core/Order/OrderController.php#L926"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/core/Order/OrderController.php#L768"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/core/Order/OrderController.php#L733"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/core/Order/OrderController.php#L440"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/utils/locale/vars.php#L35"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/base/Enqueue/frontend.php#L28"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L768"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L733"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L440"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/utils/locale/vars.php#L35"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/base/Enqueue/frontend.php#L28"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3668637%40wp-event-solution\u0026new=3668637%40wp-event-solution"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-10T13:39:59.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-08T19:18:20.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Eventin \u2013 Event Calendar, Event Registration, Tickets \u0026 Booking (AI Powered) \u003c= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-15398",
    "datePublished": "2026-09-09T07:40:56.856Z",
    "dateReserved": "2026-07-10T13:24:49.959Z",
    "dateUpdated": "2026-09-09T14:02:17.022Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-17149",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:49:48.614427Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T16:02:44.225Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "3.2.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027wrapper\u0027 Shortcode Attribute in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T07:40:56.444Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9d8c7e79-00c4-4667-9ef6-e988901bb6a0?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mycred/tags/3.2.0/addons/sell-content/includes/mycred-sell-shortcodes.php#L163"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mycred/tags/3.2.3/addons/sell-content/includes/mycred-sell-shortcodes.php#L163"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mycred/tags/3.2.3/addons/sell-content/includes/mycred-sell-shortcodes.php#L152"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mycred/tags/3.2.3/addons/sell-content/myCRED-addon-sell-content.php#L69"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mycred/tags/3.2.0/addons/sell-content/includes/mycred-sell-shortcodes.php#L152"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mycred/tags/3.2.0/addons/sell-content/myCRED-addon-sell-content.php#L69"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3640734%40mycred\u0026new=3640734%40mycred"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-24T17:49:30.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-08T19:36:26.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "myCred \u2013 Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u003c= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027wrapper\u0027 Shortcode Attribute"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-17149",
    "datePublished": "2026-09-09T07:40:56.444Z",
    "dateReserved": "2026-07-24T17:34:19.630Z",
    "dateUpdated": "2026-09-09T16:02:44.225Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "User Role Editor \u2013 PublishPress Capabilities: Access Control and User Roles",
          "vendor": "publishpress",
          "versions": [
            {
              "lessThanOrEqual": "2.50.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The PublishPress Capabilities \u2013 User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the `addPluginCapabilities()` function unconditionally granting the Editor role all 15 `manage_capabilities_*` capabilities \u2014 including `manage_capabilities`, `manage_capabilities_roles`, `manage_capabilities_settings`, and `manage_capabilities_backup` \u2014 via a hard-coded `$eligible_roles = [\u0027administrator\u0027, \u0027editor\u0027]` assignment that runs automatically on the first `admin_init` after plugin activation with no administrator opt-in, persisting the grants directly to the database. This makes it possible for authenticated attackers with Editor-level access to elevate their privileges to a site-wide capability manager, enabling them to create, rename, and delete non-system roles, modify capabilities of non-administrator roles, restore role backups, and write arbitrary plugin options whose names begin with `cme_`, `capsman`, `pp_capabilities`, or `presspermit` via `update_option()`. The escalation stops short of full Administrator access, as WordPress\u0027s `map_meta_cap` layer still prevents the escalated Editor from granting administrator-only capabilities to other roles; however, all role-management and plugin-settings functionality gated solely on `manage_capabilities_*` capabilities remains fully accessible."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T07:40:56.043Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2f35ab5c-f897-404b-92ea-71bf1c98e0c0?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/capability-manager-enhanced/tags/2.50.0/classes/pp-capabilities-installer.php#L78"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/capability-manager-enhanced/tags/2.50.0/includes/admin-load.php#L758"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/capability-manager-enhanced/tags/2.50.0/includes/functions-admin.php#L361"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/capability-manager-enhanced/tags/2.50.0/includes/settings-handler.php#L22"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/capability-manager-enhanced/tags/2.50.0/includes/manager.php#L1186"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3665572%40capability-manager-enhanced\u0026new=3665572%40capability-manager-enhanced"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-18T15:54:21.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-08T18:41:31.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "PublishPress Capabilities \u003c= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-75927",
    "datePublished": "2026-09-09T07:40:56.043Z",
    "dateReserved": "2026-08-18T15:39:14.778Z",
    "dateUpdated": "2026-09-09T07:40:56.043Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19778",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T13:07:22.272412Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T13:07:29.847Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WPMR Google Feed Manager for WooCommerce \u2013 Sell on Google Merchant Center \u0026 Shopping",
          "vendor": "aukejomm",
          "versions": [
            {
              "lessThanOrEqual": "2.23.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WPMR Google Feed Manager for WooCommerce \u2013 Sell on Google Merchant Center \u0026 Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the \u0027feed\u0027 parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T07:40:55.484Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/12fd3157-6dfc-478f-81eb-49db1fb66b7f?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-product-feed-manager/tags/2.23.7/includes/data/class-wppfm-queries.php#L1113"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-product-feed-manager/tags/2.23.7/includes/data/class-wppfm-data.php#L542"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-product-feed-manager/tags/2.23.7/includes/data/class-wppfm-feed-crud-handler.php#L25"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-product-feed-manager/tags/2.23.7/includes/data/class-wppfm-ajax-data.php#L266"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3677452%40wp-product-feed-manager\u0026new=3677452%40wp-product-feed-manager"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-24T12:52:19.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-08T18:47:09.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WPMR Google Feed Manager for WooCommerce \u003c= 2.23.7 - Authenticated (Administrator+) SQL Injection via \u0027feed\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-19778",
    "datePublished": "2026-09-09T07:40:55.484Z",
    "dateReserved": "2026-08-13T17:39:17.825Z",
    "dateUpdated": "2026-09-09T13:07:29.847Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19802",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:00:42.550619Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T15:00:49.298Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Checkout Custom Fields Builder for WooCommerce",
          "vendor": "stylemix",
          "versions": [
            {
              "lessThanOrEqual": "1.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nabil Irawan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to install and activate an arbitrary attacker-hosted plugin, resulting in remote code execution on the server. The required nonce is emitted inline on all admin pages accessible to subscribers when WooCommerce is inactive, meaning any subscriber-level user can harvest it and trigger the exploit without any additional privileges."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T06:40:41.787Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6d780de5-d333-4af9-b9d8-0d6c8254dd05?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/checkout-custom-fields-builder-for-woocommerce/tags/1.1.4/includes/Load.php#L195"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/checkout-custom-fields-builder-for-woocommerce/tags/1.1.4/includes/Load.php#L168"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/checkout-custom-fields-builder-for-woocommerce/tags/1.1.4/includes/Load.php#L47"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/checkout-custom-fields-builder-for-woocommerce/tags/1.1.4/includes/Load.php#L150"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3678996%40checkout-custom-fields-builder-for-woocommerce\u0026new=3678996%40checkout-custom-fields-builder-for-woocommerce"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-13T20:42:21.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-08T18:37:40.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Checkout Custom Fields Builder for WooCommerce \u003c= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via \u0027plugin\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-19802",
    "datePublished": "2026-09-09T06:40:41.787Z",
    "dateReserved": "2026-08-13T20:27:12.564Z",
    "dateUpdated": "2026-09-09T15:00:49.298Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75905",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:03:03.620600Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T15:03:10.086Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Recipe Maker",
          "vendor": "brechtvds",
          "versions": [
            {
              "lessThanOrEqual": "10.8.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to take ownership of any admin-authored recipe by rewriting its post_author to the attacker\u0027s user ID, and unpublish it by overwriting its post_status with the contributor\u0027s draft or pending post status. This requires the default \u0027recipe_use_author\u0027 setting to be set to \u0027parent\u0027 for the ownership transfer to occur, though unpublishing remains possible regardless of this setting."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T05:31:05.632Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eee25825-2308-4234-b72b-6cb11b658a6e?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-recipe-maker/tags/10.8.0/includes/public/class-wprm-recipe-saver.php#L729"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-recipe-maker/tags/10.8.0/includes/public/class-wprm-recipe-saver.php#L572"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-recipe-maker/tags/10.8.0/includes/public/class-wprm-recipe-saver.php#L630"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3677870%40wp-recipe-maker\u0026new=3677870%40wp-recipe-maker"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-18T15:12:21.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-08T16:48:49.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Recipe Maker \u003c= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via \u0027[wprm-recipe]\u0027 Shortcode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-75905",
    "datePublished": "2026-09-09T05:31:05.632Z",
    "dateReserved": "2026-08-18T14:57:14.698Z",
    "dateUpdated": "2026-09-09T15:03:10.086Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ilGhera Reviso Exporter for WooCommerce",
          "vendor": "ghera74",
          "versions": [
            {
              "lessThanOrEqual": "1.2.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Legion Hunter"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnect_callback() function in versions up to, and including, 1.2.3. The function is registered to the \u0027wp_ajax_wcefr-disconnect\u0027 AJAX action and unconditionally calls delete_option(\u0027wcefr-agt\u0027), which removes the Reviso Agreement Grant Token used to authenticate API calls. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin\u0027s stored Agreement Grant Token, breaking the connection between WooCommerce and the Reviso service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T05:31:05.281Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/894ef079-8c57-4e69-94a9-0be71f2f6176?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wc-exporter-for-reviso/tags/1.2.3/includes/class-wcefr-settings.php#L87"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wc-exporter-for-reviso/tags/1.2.3/includes/class-wcefr-settings.php#L22"
        },
        {
          "url": "https://github.com/ilGhera/wc-exporter-for-reviso/commit/26ef890d596a77ca66ffc15c60b8f806dbf2d4d2"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-14T17:51:48.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-08T17:19:16.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "ilGhera Reviso Exporter for WooCommerce \u003c= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-8615",
    "datePublished": "2026-09-09T05:31:05.281Z",
    "dateReserved": "2026-05-14T17:36:38.095Z",
    "dateUpdated": "2026-09-09T05:31:05.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76009",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T14:01:21.461808Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T14:01:28.611Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Next-Cart Store to WooCommerce Migration",
          "vendor": "martinnguyen1990",
          "versions": [
            {
              "lessThanOrEqual": "3.9.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Samuele Santonicola"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the `NCWM_Kitconnect::run()` function. This is due to the plugin registering the `/wp-json/next_cart/v1/migration` REST route with `permission_callback` set to `__return_true` and relying on a hardcoded fallback value of `__token__` in `get_option(\u0027nextcart_token\u0027, \u0027__token__\u0027)` when the `nextcart_token` option has not yet been written to the database. This makes it possible for unauthenticated attackers to bypass authentication to the migration endpoint by supplying the literal string `__token__` as the token, gaining access to privileged handlers that pass attacker-controlled SQL directly to `$wpdb-\u003equery()` and `$wpdb-\u003eget_results()` \u2014 enabling arbitrary SQL execution including administrator account creation \u2014 and pass an attacker-controlled path to `unlink()`, enabling arbitrary file deletion and full site takeover. The hardcoded fallback is reachable whenever the `nextcart_token` option has not yet been populated, which occurs after WP-CLI, network, or programmatic plugin activation without a subsequent authenticated `wp-admin` visit, as token generation is deferred to `admin_init` via `register_settings()`."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T05:31:04.903Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/739b57d9-8066-4c2a-9419-f6cd9409433c?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/nextcart-woocommerce-migration/trunk/includes/carts/kitconnect-api.php#L23"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/nextcart-woocommerce-migration/trunk/includes/main.php#L40"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/nextcart-woocommerce-migration/trunk/includes/main.php#L123"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/nextcart-woocommerce-migration/trunk/includes/carts/kitconnect-api.php#L120"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/nextcart-woocommerce-migration/trunk/includes/carts/kitconnect-api.php#L336"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3686100%40nextcart-woocommerce-migration\u0026new=3686100%40nextcart-woocommerce-migration"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-26T05:32:35.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-08T17:22:58.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Next-Cart Store to WooCommerce Migration \u003c= 3.9.8 - Unauthenticated Authentication Bypass via Default \u0027__token__\u0027 Fallback in REST Migration Endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-76009",
    "datePublished": "2026-09-09T05:31:04.903Z",
    "dateReserved": "2026-08-18T18:55:14.714Z",
    "dateUpdated": "2026-09-09T14:01:28.611Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-83593",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:51:46.958314Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T16:02:52.544Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WPBot \u2013 AI ChatBot for Live Support, Lead Generation, AI Services",
          "vendor": "quantumcloud",
          "versions": [
            {
              "lessThanOrEqual": "8.7.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ivaylo"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WPBot \u2013 AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027conversation\u0027 parameter in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The action is gated only by a nonce that is localized into every public-facing page via wp_localize_script, rendering the nonce check ineffective as an access control barrier for unauthenticated users."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T05:31:04.546Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/710fb372-4b7e-43e3-86a7-417143536f43?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatbot/tags/8.6.9/includes/chat-sessions/js/admin.js#L86"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatbot/tags/8.6.9/includes/chat-sessions/wpbot-chat-sessions.php#L566"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatbot/tags/8.6.9/functions.php#L1922"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatbot/tags/8.6.9/includes/chat-sessions/wpbot-chat-sessions.php#L564"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatbot/tags/8.6.9/includes/chat-sessions/wpbot-chat-sessions.php#L708"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatbot/tags/8.6.9/qcld-wpwbot.php#L613"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatbot/tags/8.6.9/includes/chat-sessions/wpbot-chat-sessions.php#L866"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatbot/tags/8.5.6/includes/chat-sessions/js/admin.js#L86"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatbot/tags/8.5.6/includes/chat-sessions/wpbot-chat-sessions.php#L566"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatbot/tags/8.5.6/functions.php#L1922"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatbot/tags/8.5.6/includes/chat-sessions/wpbot-chat-sessions.php#L564"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatbot/tags/8.5.6/includes/chat-sessions/wpbot-chat-sessions.php#L708"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatbot/tags/8.5.6/qcld-wpwbot.php#L613"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/chatbot/tags/8.5.6/includes/chat-sessions/wpbot-chat-sessions.php#L866"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3679725%40chatbot\u0026new=3679725%40chatbot"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-31T19:59:05.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-08T16:50:30.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WPBot \u003c= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via \u0027conversation\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-83593",
    "datePublished": "2026-09-09T05:31:04.546Z",
    "dateReserved": "2026-08-31T19:43:55.434Z",
    "dateUpdated": "2026-09-09T16:02:52.544Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84908",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T13:07:55.317127Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T13:08:04.132Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout \u0026 One Click Upsell",
          "vendor": "getwpfunnels",
          "versions": [
            {
              "lessThanOrEqual": "3.12.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the \u0027wpfnl_load_payment\u0027 AJAX action for both authenticated and unauthenticated (wp_ajax_nopriv_) users and the underlying add_offer_product_to_cart() function performing no nonce verification, no capability check, and no validation that the attacker-supplied product_id is the offer product actually configured on the attacker-supplied step_id. This makes it possible for unauthenticated attackers to add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step, enabling price manipulation and revenue loss at checkout."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T05:31:04.199Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5a24d442-56f9-4f6d-bff6-0eb354249895?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.12/includes/core/offer/class-wpfnl-offer.php#L166"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.13/includes/core/offer/class-wpfnl-offer.php#L166"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.13/includes/core/offer/class-wpfnl-offer.php#L71"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.13/includes/core/offer/class-wpfnl-offer.php#L213"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.12/includes/core/offer/class-wpfnl-offer.php#L71"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.12/includes/core/offer/class-wpfnl-offer.php#L213"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3675200%40wpfunnels\u0026new=3675200%40wpfunnels"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-02T15:57:21.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-08T17:13:51.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WPFunnels \u003c= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via \u0027wpfnl_load_payment\u0027 AJAX Action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-84908",
    "datePublished": "2026-09-09T05:31:04.199Z",
    "dateReserved": "2026-09-02T15:42:15.416Z",
    "dateUpdated": "2026-09-09T13:08:04.132Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Awesome Support \u2013 WordPress HelpDesk \u0026 Support Plugin",
          "vendor": "awesomesupport",
          "versions": [
            {
              "lessThanOrEqual": "6.3.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpas_do_mr_deny_user() function, which unlike its counterpart wpas_do_mr_activate_user() does not enforce current_user_can(\u0027edit_users\u0027) or current_user_can(\u0027edit_user\u0027, $user_id), relying solely on a nonce that is not scoped to the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the mr_user_denied flag on any user account \u2014 including administrators \u2014 permanently blocking their moderated activation and dispatching a denial notification email to the victim."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T05:31:03.643Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/208f9475-446c-4cf1-9d70-a845cf9b3005?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.9/includes/functions-user.php#L1731"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.9/includes/functions-actions.php#L25"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.9/includes/functions-user.php#L1650"
        },
        {
          "url": "https://plugins.trac.wordpress.org/log/awesome-support/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-15T17:06:44.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-08T17:09:42.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Awesome Support \u003c= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via \u0027user_id\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-19946",
    "datePublished": "2026-09-09T05:31:03.643Z",
    "dateReserved": "2026-08-15T16:51:37.070Z",
    "dateUpdated": "2026-09-09T05:31:03.643Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11821",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:49:50.407986Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T16:03:07.389Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Eventin \u2013 Event Calendar, Tickets, Registration, Booking \u0026 WooCommerce",
          "vendor": "arraytics",
          "versions": [
            {
              "lessThanOrEqual": "4.1.17",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sushi Com Abacate"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Eventin \u2013 Event Calendar, Event Registration, Tickets \u0026 Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view, create, update, clone, and delete notification flow event automation workflows that should be restricted to administrators."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T04:28:34.581Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/560a3102-c274-450f-9119-ea47ee2e7c65?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.17/vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php#L66"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.18/vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php#L66"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3612206/wp-event-solution/trunk/vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-09T18:01:27.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-08T16:23:30.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Eventin \u003c= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-11821",
    "datePublished": "2026-09-09T04:28:34.581Z",
    "dateReserved": "2026-06-09T17:46:16.572Z",
    "dateUpdated": "2026-09-09T16:03:07.389Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19945",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T13:09:13.340143Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T13:09:44.259Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Crowdfunding",
          "vendor": "themeum",
          "versions": [
            {
              "lessThanOrEqual": "2.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027first_name\u0027 parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An administrator viewing any user\u0027s profile via the ?show_user_id= parameter will render the attacker\u0027s stored payload in the admin\u0027s browser session, enabling cross-privilege script execution."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T04:28:34.103Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0b78d34f-6702-45dd-ba56-46e9c547bc9f?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-crowdfunding/tags/2.2.1/includes/woocommerce/dashboard/profile.php#L62"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-crowdfunding/tags/2.2.1/includes/woocommerce/Actions.php#L79"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-crowdfunding/tags/2.2.1/includes/woocommerce/Actions.php#L116"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3677675%40wp-crowdfunding\u0026new=3677675%40wp-crowdfunding"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-15T17:04:26.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-08T15:51:37.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Crowdfunding \u003c= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \u0027first_name\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-19945",
    "datePublished": "2026-09-09T04:28:34.103Z",
    "dateReserved": "2026-08-15T16:49:20.181Z",
    "dateUpdated": "2026-09-09T13:09:44.259Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}