These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weforms_delete_entry_attachments function in all versions up to, and including, 1.6.28. This makes it possible for unauthenticated attackers to delete arbitrary media files on the server. This requires an administrator to perman [truncated]
The Post and Page Builder by BoldGrid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts in pages that will execute when a user accesses an injected page.
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content due to insufficient input sanitization and output escaping. This vulnerability is exploitable when the 'Remove query strings from static resources' option is enabled. Affected deployments should be identified and prioritized for updates or compensating controls. The vulnerability allows unauthenticated [truncated]
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content through the LazyLoad Background Mutator feature in versions up to and including 2.10.5. This vulnerability allows unauthenticated attackers to inject malicious scripts into pages, which execute when a user accesses the injected page. The feature must be enabled, and a moderator must approve the malicio [truncated]
CVE-2026-66708 is an unauthenticated broken access control vulnerability in Total Upkeep plugin versions up to 1.17.2. The vulnerability has a CVSS score of 8.2 and is classified as HIGH severity. Users of Total Upkeep plugin version 1.17.2 or earlier should patch to version 1.17.3 or later and verify access controls are properly configured. This includes administrators and security teams responsible for [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T15:17:22.607Z and has not been modified since then. CVE-2026-66695 is a MEDIUM-severity vulnerability in W3 Total Cache plugin versions <= 2.10.2, allowing unauthenticated path traversal attacks. This vulnerability can be exploited by attackers to access sensitive files and potentially execute ma [truncated]
CVE-2026-57428 is a high-severity unauthenticated Cross Site Scripting (XSS) vulnerability affecting Sprout Clients versions up to 3.2.3. Defenders should assess exposure, prioritize remediation, and verify vendor-provided fixes.
A Missing Authorization vulnerability exists in Client Invoicing by Sprout Invoices versions up to and including 20.8.13. This issue allows for Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity. Defenders should assess their exposure and verify the configuration of access control security levels. The CVE record [truncated]
The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The vulnerability exists due to insufficient validation of user-supplied input, allowing attackers to acces [truncated]
CVE-2026-39595 is a medium-severity vulnerability (CVSS score of 4.7) affecting the W3 Total Cache plugin for WordPress, specifically versions up to 2.9.1. The issue is classified as 'Author Broken Access Control,' indicating a problem with access control mechanisms that could allow unauthorized users to perform actions they shouldn't be able to. This vulnerability was made public on June 17, 2026. Given [truncated]
A Missing Authorization vulnerability in Post and Page Builder by BoldGrid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.9. The vulnerability could lead to unauthorized access or disruption of website operations. Defenders should assess exposure and prioritize verification and updates. The CVE record [truncated]
