DesignSetGo vulnerabilities
CVEs whose affected-version data names the DesignSetGo package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-111068Medium· 4.4DesignSetGo <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute
The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. This makes it possible…
▾ Sunlitjustinnealey · DesignSetGoEPSS 0.21%via CVEORG
CVE-2026-94683High· 8.8Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.
Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.
▾ TwilightJustin Nealey · designsetgoEPSS 0.34%via NVD