Vulnerabilities
Summary — last 7 days
New vulnerabilities2,686▼ 84 vs. last week
Critical / high1,444▲ 301 vs. last week
New active exploitation (KEV)7▼ 3 vs. last week
Unscored (no CVSS)64▼ 462 vs. last week
430 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Medium (5.1) | 0.26% | — | Getgrav Grav Shortcode CoreAI | 9/4/2026 | 9/8/2026 | Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the [lorem] tag parameter and [details] summary parameter that are written to rendered pages without escaping. Attackers with page-edit access can inject arbitrary HTML and JavaScript that executes in the browsers of all page… | |
| Deferred | Medium (5.9) | 0.14% | — | Livejournal ShortcodeAI | 9/2/2026 | 9/3/2026 | The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | |
| Deferred | High (8.5) | 0.46% | — | Grav Shortcode CoreAI | 8/19/2026 | 9/9/2026 | Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss() because it contains no literal less-than character, then ColorShortcode.php and related… | |
| Deferred | Medium (6.5) | 0.22% | — | Wufoo ShortcodeAI | 8/18/2026 | 8/20/2026 | Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions. | |
| Deferred | Medium (6.4) | 0.33% | — | Yeken Snippet ShortcodesAI | 8/16/2026 | 8/20/2026 | The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to… | |
| Deferred | Medium (4.3) | 0.25% | — | EC ShortcodesAI | 8/15/2026 | 8/26/2026 | The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding configuration of posts they do… | |
| Deferred | Medium (6.4) | 0.32% | — | Mythemeshop WP ShortcodeAI | 7/23/2026 | 7/23/2026 | The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the [tab] shortcode in versions up to, and including, 1.4.17. This is due to insufficient input sanitization and output escaping in the mts_tabs() function, which outputs the title shortcode… | |
| Deferred | High (7.5) | 0.51% | — | Saurabhsharma Newsplus ShortcodesAIPHPAI | 7/13/2026 | 7/13/2026 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SaurabhSharma NewsPlus Shortcodes newsplus-shortcodes allows PHP Local File Inclusion.This issue affects NewsPlus Shortcodes: from n/a through <= 4.2.0. | |
| Deferred | Medium (6.4) | 0.33% | — | Sudoku ShortcodeAI | 7/10/2026 | 7/10/2026 | The Sudoku Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background' parameter in the 'sudoku-sc' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with… | |
| Deferred | Medium (6.5) | 0.22% | — | Surbma Yoast SEO Breadcrumb ShortcodeAI | 7/2/2026 | 7/2/2026 | Contributor Cross Site Scripting (XSS) in Surbma | Yoast SEO Breadcrumb Shortcode <= 1.2 versions. | |
| Deferred | Medium (6.5) | 0.22% | — | Averta Shortcodes AND Extra Features FOR Phlox ThemeAI | 7/1/2026 | 7/2/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta LTD Shortcodes and extra features for Phlox theme allows DOM-Based XSS. This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.16. | |
| Deferred | Medium (6.4) | 0.33% | — | Surbma Infusionsoft ShortcodeAI | 6/27/2026 | 6/29/2026 | The Surbma | Infusionsoft Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'infusionsoft-form' shortcode in versions up to, and including, 2.0.1. This is due to insufficient input sanitization and output escaping on user-supplied 'account' and 'id' shortcode attributes in the… | |
| Deferred | Medium (5.4) | 0.29% | — | Designsandcode Forget About Shortcode ButtonsAI | 6/26/2026 | 9/29/2026 | Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions. | |
| Deferred | Medium (6.4) | 0.32% | — | MIR Blocks AND ShortcodesAI | 6/24/2026 | 6/30/2026 | The MIR blocks and shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute (and other attributes such as 'ready_animation_text') of the 'msc_stats' shortcode in versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on… | |
| Deferred | Medium (6.4) | 0.23% | — | Tinymce Shortcode AddonAI | 6/9/2026 | 7/23/2026 | The TinyMCE shortcode Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'btnrel' Shortcode Attribute in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and… | |
| Deferred | Medium (6.4) | 0.32% | — | Demomentsomtres ShortcodesAI | 6/2/2026 | 7/22/2026 | The DeMomentSomTres Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'callout' shortcode in all versions up to, and including, 1.1.1. This is due to insufficient input sanitization and output escaping on the 'width' and 'align' shortcode attributes within the st_callout()… | |
| Deferred | Medium (6.4) | 0.33% | — | Simple Divi ShortcodeAI | 5/29/2026 | 7/21/2026 | The Simple Divi Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [showmodule] shortcode in versions up to, and including, 1.2 This is due to insufficient input sanitization and output escaping in the showmodule_shortcode() function, which concatenates the 'id'… | |
| Deferred | Medium (6.4) | 0.32% | — | Github ShortcodeAI | 5/27/2026 | 6/17/2026 | The Github Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repo' shortcode attribute in the 'github' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with… | |
| Deferred | High (7.5) | 0.83% | — | Query ShortcodeAI | 5/27/2026 | 6/17/2026 | The Query Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.2.1 via the shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the… | |
| Deferred | Medium (6.4) | 0.32% | — | Shortcode BuddyAI | 5/27/2026 | 6/17/2026 | The Shortcode Buddy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 0.1.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject… | |
| Deferred | Medium (6.4) | 0.32% | — | Listen ShortcodeAI | 5/27/2026 | 6/17/2026 | The Listen Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'listen' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes (src, start, end) in the listenEmbedJS() function, which are echoed… | |
| Deferred | Medium (6.4) | 0.32% | — | HK ShortcodeAI | 5/27/2026 | 6/17/2026 | The hk_shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title-plane' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes in the huankong_post_short_title_plane() function, where the… | |
| Deferred | Medium (6.4) | 0.32% | — | MY Email ShortcodeAI | 5/27/2026 | 6/17/2026 | The My Email Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subject' shortcode attribute in the 'my-email' shortcode in all versions up to, and including, 0.91 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with… | |
| Deferred | Medium (6.4) | 0.32% | — | FAQ ShortcodeAI | 5/27/2026 | 6/17/2026 | The faq shortocde plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' shortcode attribute in the 'faq' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level… | |
| Deferred | Medium (6.4) | 0.32% | — | Bootstrap ShortcodeAI | 5/12/2026 | 6/17/2026 | The Bootstrap Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `box` shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with… |