These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.4.2. This vulnerability is due to insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts. Defenders re [truncated]
The NotificationX plugin for WordPress has a Stored Cross-Site Scripting vulnerability via the 'name' parameter in versions up to 3.3.3. This allows unauthenticated attackers to inject web scripts when an administrator has enabled a WordPress.org Reviews campaign and placed a specific dynamic block on a public page. The vulnerability requires an administrator to have enabled a WordPress.org Reviews campai [truncated]
The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3. This vulnerability allows unauthenticated attackers to inject forged social-proof entries into any enabled non-popup NotificationX campaign. Defenders should assess exposure and prioritize patching or mitigation. The /notificationx/v1/popup-submit RE [truncated]
The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's 'marker' attribute in versions up to, and including, 6.4.5. This is due to insufficient input sanitization and output escaping on marker title/content values, which are stored as JSON and then decoded and concatenated directly into raw H [truncated]
CVE-2026-89330 is a Reflected Cross-Site Scripting vulnerability in the EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress. The vulnerability exists in all versions up to, and including, 4.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scr [truncated]
The BetterLinks plugin for WordPress has an authorization bypass vulnerability in versions up to 3.1.0. This allows authenticated attackers with subscriber-level access and above to create arbitrary short URLs, potentially enabling phishing and SEO abuse. The vulnerability is due to improper verification of user authorization. The Fluent Boards companion plugin must be installed and active for exploitatio [truncated]
The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress has a Remote Code Execution vulnerability due to a filename validation/destination mismatch in the fetch_remote_file function. This allows authenticated attackers with contributor-level access and above to execute code on the server. The vulnerability exists in all versions up to, and [truncated]
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global Color Settings in all versions up to, and including, 6.6.11. This vulnerability exists due to insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access and above to inject arbitrary [truncated]
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Header Injection in all versions up to, and including, 6.6.10. This vulnerability allows authenticated attackers, with Contributor-level access and above, to inject an additional Bcc header into the WordPress administrator's password-reset notification e [truncated]
The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to generic SQL Injection via the 'lang' parameter in all versions up to, and including, 4.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This vulnerability allows authenticated attackers with custom-level access a [truncated]
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar widget in all versions up to, and including, 6.6.2 due to insufficient input sanitization and output escaping on event titles sourced from The Events Calendar. This makes it possible for authenticated attackers, with Author-level access and abo [truncated]
The BetterDocs - Knowledge Base Docs & FAQ Solution for Elementor & Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blockId attribute of the betterdocs/category-slate-layout Gutenberg block in versions up to, and including, 4.5.3. This is due to insufficient input sanitization and output escaping in the CategorySlateLayout::render() method, which echoes the blockId b [truncated]
The EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block 'url' attribute in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitra [truncated]
The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.1.3 via the `save_ai_generated_image()` function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and c [truncated]
