codesupplyco

12 results · Clear filters · Feed

• Medium 6.4
  CVE-2026-11996

  Advanced Popups <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field

  The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authe…

  codesupplyco Advanced Popups Web / CMS
  Sep 16, 2026
• Medium 6.4
  CVE-2026-2390

  Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing

  The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'content_process_images' function using a flawed regex-based HTML attrib…

  codesupplyco Powerkit – Supercharge your WordPress Site Web / CMS
  Sep 7, 2026
• Medium 6.5
  CVE-2026-28178

  WordPress Powerkit plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

  Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.

  codesupplyco Powerkit
  Aug 6, 2026
• Medium 6.4
  CVE-2026-15644

  Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute

  The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes…

  codesupplyco Powerkit – Supercharge your WordPress Site Web / CMS
  Aug 1, 2026
• Medium 6.4
  CVE-2026-15649

  Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

  The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it pos…

  codesupplyco Powerkit – Supercharge your WordPress Site Web / CMS
  Aug 1, 2026
• Medium 6.4
  CVE-2026-15645

  Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Shortcode Attribute

  The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes i…

  codesupplyco Powerkit – Supercharge your WordPress Site Web / CMS
  Aug 1, 2026
• Medium 6.4
  CVE-2026-9629

  Canvas <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Block Attribute

  The Canvas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' parameter in all versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi…

  codesupplyco Canvas Web / CMS
  Jun 13, 2026
• Medium 5.3
  CVE-2024-9025

  Sight – Professional Image Gallery and Portfolio <= 1.1.2 - Missing Authorization to Sensitive Information Exposure in handler_post_title

  The Sight – Professional Image Gallery and Portfolio plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handler_post_title' function in all versions up to, and including, 1.1.2. This makes it possible f…

  codesupplyco Sight – Professional Image Gallery and Portfolio Web / CMS
  Sep 26, 2024
• Medium 6.4
  CVE-2024-2458

  Powerkit – Supercharge your WordPress Site <= 2.9.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

  The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping on user supplie…

  codesupplyco Powerkit – Supercharge your WordPress Site Web / CMS
  Apr 6, 2024
• Medium 5.3
  CVE-2024-2962

  Networker - Tech News WordPress Theme with Dark Mode <= 1.1.9 - Missing Authorization

  The Networker - Tech News WordPress Theme with Dark Mode theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_reload_nav_menu() function in all versions up to, and including, 1.1.9. This makes i…

  codesupplyco Networker - Tech News WordPress Theme with Dark Mode Web / CMS
  Mar 27, 2024
• Medium 4.3
  CVE-2021-4426

  Absolute Reviews <= 1.0.8 - Cross-Site Request Forgery Bypass

  The Absolute Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.8. This is due to missing or incorrect nonce validation on the metabox_review_save() function. This makes it possible for unauthenticat…

  codesupplyco Absolute Reviews Web / CMS
  Jul 12, 2023
• Medium 4.3
  CVE-2021-4421

  Advanced Popups <= 1.1.1 - Cross-Site Request Forgery Bypass

  The Advanced Popups plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the metabox_popup_save() function. This makes it possible for unauthenticated…

  codesupplyco Advanced Popups Web / CMS
  Jul 12, 2023