Artus Kg

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin before 3.5.7's settings page.

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained from a different transaction.

The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash, any order.

The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts.

The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected post, including higher-privileged users such as Editors and Administrators.

The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the same relaxed list to every sanitisation context including untrusted comments, allowing unauthenticated users to store JavaScript that will execute in the browser of any administrator who reviews the comment queue, and of any visitor to the post once the comment is approved.

The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted field value is configured to populate a header.

The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database.

🚨 CVE-2026-84927 The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which are rendered publicly across the site. 🎖@cveNotify

🚨 CVE-2026-84899 The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator who reviews the pending submission. 🎖@cveNotify

🚨 CVE-2026-84930 The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone who views the affected post. 🎖@cveNotify

🚨 CVE-2026-84931 The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of any user who views the post, including higher-privileged users such as administrators. This crosses a privilege boundary even on multisite, where such users are not permitted to post unfiltered HTML. 🎖@cveNotify

🚨 CVE-2026-84934 The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1 settings and store a script that executes in the browser of any visitor or administrator viewing the site. 🎖@cveNotify

🚨 CVE-2026-84935 The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that executes in the browser of any visitor, administrators included, who views the affected menu. 🎖@cveNotify

🚨 CVE-2026-84937 The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database. 🎖@cveNotify

**Nome do Software Vulnerável e Versões Afetadas** Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin versões anteriores a 4.5.13 **Description** A validação e a filtragem insuficientes de valores enviados para alguns campos opcionais de formulários web permitem que usuários não autenticados executem ataques de Cross-Site Scripting (XSS) Armazenado. Isso ocorre quando os dados enviados são armazenados e posteriormente exibidos em uma área administrativa, visando usuários com altos privilégios. **Recommendations** Atualize o plugin para a versão 4.5.13 ou posterior.

**Nome do Software Vulnerável e Versões Afetadas** User Registration & Membership WordPress plugin versões anteriores a 5.2.6 **Description** A falta de verificações de capacidade ao salvar as configurações de login permite que usuários autenticados com permissões de gerenciamento do plugin, mas sem acesso total de administrador, alterem opções arbitrárias do site. Essa falha permite que esses usuários elevem seus privilégios para o nível de administrador. **Recommendations** Atualize o plugin para a versão 5.2.6 ou posterior.

**Nome do Software Vulnerável e Versões Afetadas** Slider Hero with Video Background, Animation WordPress plugin versões anteriores a 9.1.3 **Descrição** A ausência de verificações de autorização e nonce em dois manipuladores de requisição, combinada com a falha em escapar uma configuração armazenada antes da saída, permite que usuários não autenticados realizem um ataque de Cross-Site Scripting (XSS) Armazenado. Isso ocorre quando JavaScript malicioso é armazenado e posteriormente executado no contexto de um administrador que acessa a área administrativa do plugin ou de qualquer visitante que visualize uma página que incorpore um slider. **Recomendações** Atualize o Slider Hero with Video Background, Animation WordPress plugin para a versão 9.1.3 ou posterior.

**Nome do Software Vulnerável e Versões Afetadas** Limit Login Attempts Reloaded versões anteriores a 3.3.5 **Descrição** O plugin falha ao realizar comparações insensíveis a maiúsculas e minúsculas ao verificar logins na lista de negação de nomes de usuário e não considera o endereço de e-mail da conta. Isso permite que contas bloqueadas ignorem a restrição e se autentiquem com sucesso. **Recomendações** Atualize para a versão 3.3.5 ou posterior.