Vulnerabilities

TI-2026-83498 CVE-2026-119089 · GHSA-f35f-w577-x9q2

Stored cross-site scripting in ThirstyAffiliates plugin for WordPress

LOW 31

The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including,…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00236 Published 2026-10-31 No fix listed CWE-79

TI-2026-04417 CVE-2026-5062 · GHSA-r28m-4r72-h337

PrettyLinks <= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' Parameter

LOW 23

The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' (search) parameter on the Pretty Links listing page in…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00442 Published 2026-08-05 No fix listed CWE-89

TI-2026-10665 CVE-2026-12426 · GHSA-5xr4-65q6-7jp8

Members <= 3.2.22 - Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channel

LOW 31

The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via the members_filter_protected_posts_for_rest.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00475 Published 2026-07-11 No fix listed CWE-200

TI-2026-01011 CVE-2026-1295 · GHSA-87j3-3j5h-4g3m

Buy Now Plus <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

LOW 28

The Buy Now Plus – Buy Now buttons for Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buynowplus' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitiz…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00294 Published 2026-01-28 No fix listed CWE-79

TI-2024-10199 CVE-2024-11008 · GHSA-frrj-qvq9-wx5m

Members <= 3.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

LOW 30

The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.10 via the WordPress core search feature.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00376 Published 2024-12-11 No fix listed CWE-200