Vulnerabilities

TI-2026-07086 CVE-2026-8040 · GHSA-xxv4-8678-c28f

faq shortocde <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute

LOW 28

The faq shortocde plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' shortcode attribute in the 'faq' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitizat…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00187 Published 2026-05-27 No fix listed CWE-79

TI-2026-02129 CVE-2026-2502 · GHSA-m9jv-r277-q8wc

xmlrpc attacks blocker <= 1.0 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For'

LOW 27

The xmlrpc attacks blocker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0, via the 'X-Forwarded-For' HTTP header.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00316 Published 2026-02-19 No fix listed CWE-79

Vulnerabilities

Filters

faq shortocde <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute

xmlrpc attacks blocker <= 1.0 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For'