Threat database

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress contains an authentication bypass vulnerability in all versions up to and including 44.1. This flaw arises from improper nonce validation in the deprecated OpenID Connect token processing path when the 'use_id_token_parser_v2' option is enabled. An attacker with a previously issued valid id_token can replay it to authenticate as any WordPress user, including administrators, potentially leading to full site takeover.

SureDash – Community, Courses & Member Dashboard plugin for WordPress versions up to 1.12.1 is vulnerable to a stored DOM-based Cross-Site Scripting (XSS) flaw via the image 'alt' attribute in community post content. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because entity-encoded payloads bypass server-side filtering and are decoded client-side by GLightbox, leading to script execution.

The AutomatorWP plugin for WordPress, up to and including version 5.8.4, contains an authorization bypass vulnerability. This flaw allows authenticated users with subscriber-level access or higher to enumerate all Fluent Forms records, including form IDs and titles, due to improper authorization checks. The vulnerability is tracked as CVE-2026-104728 and has a medium severity rating with a CVSS score of 4.3.

WP Directory Kit versions up to 1.5.9 contain a time-based SQL Injection vulnerability in the 'display_name' profile field. Authenticated users with subscriber-level access can exploit this second-order injection by storing malicious input that is later unsanitized and executed in SQL queries, potentially exposing sensitive database information.

WPAdverts – Classifieds Plugin for WordPress versions up to and including 2.3.4 is vulnerable to stored cross-site scripting (XSS) via the 'adverts_location' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The issue arises from insufficient input sanitization and output escaping.

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 44.1. This vulnerability arises from insufficient input sanitization and output escaping of the 'id_token' parameter, allowing unauthenticated attackers to inject malicious scripts. The malicious payload is stored in the wpo365_errors transient for up to three days and executes when an administrator visits the WPO365 wizard page. No prior authentication or user interaction is required for the initial injection.

The Email Marketing for WordPress and WooCommerce – Retainful plugin versions up to 1.0.10 are vulnerable to a stored Cross-Site Scripting (XSS) flaw. This vulnerability arises from improper sanitization and escaping of the 'data' parameter, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. These scripts execute when any user accesses the affected pages, potentially leading to information disclosure or session hijacking.

The WPCOM Member WordPress plugin contains an authentication bypass vulnerability in all versions up to and including 1.7.27. This flaw allows unauthenticated attackers to log in as any WordPress user, including administrators, by exploiting the social-login callback handler. The vulnerability arises from missing nonce validation, OAuth state verification, and session namespace isolation, enabling attackers to forge session entries and impersonate users if they know or can enumerate the victim's social provider identifier. Exploitation requires the target site to have at least one social provider configured.

A reflected cross-site scripting (XSS) vulnerability exists in the WPForms – AI Form Builder for WordPress plugin in all versions up to and including 2.0.2.1. The flaw arises from insufficient input sanitization and output escaping of a user-controllable parameter referenced by a smart tag in form descriptions. Exploitation requires a site administrator to have saved a form embedding the vulnerable smart tag inside an iframe srcdoc attribute and enabled the form description on a public page. An unauthenticated attacker can inject arbitrary scripts that execute when a user interacts with a crafted link.

Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin versions up to and including 5.2.12 are vulnerable to a stored DOM-based cross-site scripting (XSS) flaw. The vulnerability arises from insufficient input sanitization and output escaping of the 'comment' parameter within the href attribute of comment content. This allows unauthenticated attackers to inject arbitrary scripts that execute when users visit affected pages. The issue affects the free version of the plugin due to the author-filter rewriter not appending a specific marker, making all href attributes attacker-controllable.

The Appointment Booking Plugin – LatePoint for WordPress contains a SQL Injection vulnerability in the 'booking[service_id]' parameter. This affects all versions up to and including 5.7.2. The flaw allows unauthenticated attackers to inject additional SQL commands due to insufficient input escaping and query preparation, potentially exposing sensitive database information. The vulnerability has a high severity score of 7.5 and does not require user interaction or privileges to exploit.

FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the 'shipping_first_name' parameter in all versions up to and including 3.16.0.5. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when a user accesses the affected page. The issue arises from insufficient input sanitization and output escaping.

The Motors – Car Dealership & Classified Listings Plugin for WordPress versions up to 1.4.124 is vulnerable to stored cross-site scripting (XSS) via the 'stm_f_s' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping. The AJAX handler nonce required for exploitation is exposed on every page, facilitating exploitation without higher privileges.

WP Photo Album Plus plugin for WordPress versions up to 9.3.03.002 is vulnerable to stored Cross-Site Scripting (XSS) via the REQUEST_URI session history. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.

CVE-2026-108504 is an unauthorized information disclosure vulnerability in the ZTE Z80 Ultra device. The issue arises from insufficient access control on methods within the device's framework, allowing an attacker to read sensitive device-related information. The vulnerability has a medium severity with a CVSS score of 5.5. No specific affected versions or patches are currently documented.

CVE-2026-62045 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Booklovers product. It allows object injection and affects versions from 0 up to and including 2.13.0. The vulnerability has a high CVSS score of 9.8, indicating severe potential impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.

CVE-2026-62046 is a critical deserialization of untrusted data vulnerability in the ThemeREX Group Gutentype product. It allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The issue affects Gutentype versions from initial releases up to and including 2.1.12. The vulnerability has a CVSS score of 9.8, indicating high severity. No patch or remediation information is provided in the available data.