Vulnerabilities

TI-2026-06599 CVE-2026-7509 · GHSA-m4c4-9rgw-f76c

KIA Subtitle <= 4.0.1 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]

LOW 28

The KIA Subtitle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `the-subtitle` shortcode `before` and `after` attributes in all versions up to, and including, 4.0.1.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00249 Published 2026-05-22 No fix listed CWE-79

TI-2023-15594 CVE-2023-32298 · GHSA-93jh-qvjc-gqxh

WordPress Simple User Listing Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS)

LOW 32

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kathy Darling Simple User Listing plugin <= 1.9.2 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00476 Published 2023-11-08 No fix listed CWE-79

TI-2020-18909 CVE-2020-36740 · GHSA-7835-39wm-qxqw

Radio Buttons for Taxonomies <= 2.0.5 - Cross-Site Request Forgery Bypass

LOW 38

The Radio Buttons for Taxonomies plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.5.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00472 Published 2023-07-01 Fixed in 2.0.6 CWE-352

Vulnerabilities

Filters

KIA Subtitle <= 4.0.1 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]

WordPress Simple User Listing Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS)

Radio Buttons for Taxonomies <= 2.0.5 - Cross-Site Request Forgery Bypass