Vulnerabilities

TI-2026-02326 CVE-2026-2718 · GHSA-v9v3-ph54-r6qw

Dealia <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block Attributes

LOW 28

The Dealia – Request a Quote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Gutenberg block attributes in all versions up to, and including, 1.0.8.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00218 Published 2026-02-19 No fix listed CWE-79

TI-2026-02131 CVE-2026-2504 · GHSA-f4vx-r87q-vg6c

Dealia – Request a quote <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Plugin Configuration Reset

LOW 20

The Dealia – Request a quote plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on multiple AJAX handlers in all versions up to, and including, 1.0.7.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00242 Published 2026-02-19 No fix listed CWE-862

Vulnerabilities

Filters

Dealia <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block Attributes

Dealia – Request a quote <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Plugin Configuration Reset