Artus Kg

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin before 3.5.7's settings page.

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained from a different transaction.

The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash, any order.

The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts.

The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected post, including higher-privileged users such as Editors and Administrators.

The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the same relaxed list to every sanitisation context including untrusted comments, allowing unauthenticated users to store JavaScript that will execute in the browser of any administrator who reviews the comment queue, and of any visitor to the post once the comment is approved.

The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted field value is configured to populate a header.

The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database.

🚨 CVE-2026-84927 The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which are rendered publicly across the site. 🎖@cveNotify

🚨 CVE-2026-84899 The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator who reviews the pending submission. 🎖@cveNotify

🚨 CVE-2026-84930 The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone who views the affected post. 🎖@cveNotify

🚨 CVE-2026-84931 The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of any user who views the post, including higher-privileged users such as administrators. This crosses a privilege boundary even on multisite, where such users are not permitted to post unfiltered HTML. 🎖@cveNotify

🚨 CVE-2026-84934 The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1 settings and store a script that executes in the browser of any visitor or administrator viewing the site. 🎖@cveNotify

🚨 CVE-2026-84935 The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that executes in the browser of any visitor, administrators included, who views the affected menu. 🎖@cveNotify

🚨 CVE-2026-84937 The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database. 🎖@cveNotify

**Name of the Vulnerable Software and Affected Versions** Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin versions prior to 4.5.13 **Description** Insufficient validation and escaping of values submitted to optional web form fields allow unauthenticated users to execute Stored Cross-Site Scripting (XSS) attacks. This occurs when the submitted data is stored and subsequently displayed within an administrative area, targeting users with high privileges. **Recommendations** Update the plugin to version 4.5.13 or later.

**Name of the Vulnerable Software and Affected Versions** User Registration & Membership WordPress plugin versions prior to 5.2.6 **Description** Insufficient capability checks during the saving of login settings allow authenticated users with plugin management permissions, but without full administrator access, to modify arbitrary site options. This flaw enables these users to escalate their privileges to the administrator level. **Recommendations** Update the plugin to version 5.2.6 or later.

**Name of the Vulnerable Software and Affected Versions** Slider Hero with Video Background, Animation WordPress plugin versions prior to 9.1.3 **Description** Lack of authorization and nonce checks on two request handlers, combined with a failure to escape a stored setting before output, allows unauthenticated users to perform a Stored Cross-Site Scripting (XSS) attack. This occurs when malicious JavaScript is stored and subsequently executed in the context of an administrator accessing the plugin admin area or any visitor viewing a page that embeds a slider. **Recommendations** Update Slider Hero with Video Background, Animation WordPress plugin to version 9.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** Limit Login Attempts Reloaded versions prior to 3.3.5 **Description** The plugin fails to perform case-insensitive comparisons when checking logins against the username denylist and does not consider the account email address. This allows blocked accounts to bypass the restriction and authenticate successfully. **Recommendations** Update to version 3.3.5 or later.