These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. Authenticated attackers with subscriber-level access and above can execute arbitrary shortcodes due to improper validation of values before running do_shortcode. This issue arises from WordPress's strip_shortcodes() function unwrapping the [[tag]] double-bracket escape to [truncated]
The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
The Wp Social Login and Register Social Counter plugin for WordPress, specifically versions up to and including 3.2.1, is vulnerable to Stored Cross-Site Scripting via the Avatar Alt Attribute. This vulnerability allows authenticated attackers with subscriber-level access to inject web scripts that execute when a user accesses an injected page. The vulnerability requires a two-step process: first, the att [truncated]
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the `rum_importer()` function being registered on the WordPress core `import_start` action hook with no plugin-owned capability check and no allowlist filtering, causing arbitrary `<wp_option>` name/value [truncated]
PatchSiren debrief for CVE-2026-59560, a Subscriber Broken Access Control vulnerability in FundEngine versions <= 1.7.8. This vulnerability has a CVSS score of 6.5 and a severity of MEDIUM. The CVE record was published on 2026-07-27T15:17:06.303Z and last modified on 2026-07-27T17:46:02.447Z. Users of FundEngine plugin versions <= 1.7.8 should apply patches or mitigations to prevent potential unauthorized access.
A Missing Authorization vulnerability in Roxnor FundEngine wp-fundraising-donation allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FundEngine: from n/a through <= 1.7.6. The vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity. Users of FundEngine wp-fundraising-donation plugin for WordPress should verify their installation and update to a [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-08T09:16:35.213Z and has not been modified since then. The NVD entry is currently Deferred. This CVE-2026-39644 vulnerability, classified as a Missing Authorization issue in the Wp Ultimate Review plugin, allows attackers to exploit incorrectly configured access control security levels. The vulnerab [truncated]
The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ekit_tab_title' parameter in the Simple Tab widget in all versions up to, and including, 3.7.9. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page [truncated]