ZTE Z80 Ultra contains an interface permission validation vulnerability (CWE-276) where system callable functions lack sufficient access control. This flaw allows an attacker to read certain information by leveraging these improperly protected functions. The vulnerability has a low severity rating with a CVSS score of 3.3. No specific affected versions or patches are currently identified.
The Simple Membership plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'country' parameter affecting all versions up to and including 4.8.4. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. Additionally, unauthenticated attackers may exploit this issue if the Enable Free Membership feature is enabled, allowing anonymous registration and profile submission.
The WP Meteor Website Speed Optimization Addon plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the comment author name field. This vulnerability affects all versions up to and including 3.4.18. It allows unauthenticated attackers to inject arbitrary scripts that execute when users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires the malicious comment to pass WordPress's comment moderation process before being displayed.
The SpeedyCache – Cache, Optimization, Performance WordPress plugin up to version 1.4.2 has a vulnerability that allows unauthenticated attackers to extract sensitive information such as the full name and email address of returning commenters. This occurs because the plugin caches pages containing pre-filled comment form fields with commenter data, and the cache write path does not properly validate requests, enabling cache poisoning. The vulnerability is classified as sensitive information exposure with a low CVSS score of 3.7.
The WP CV Builder plugin for WordPress has a vulnerability allowing unauthenticated attackers to upload arbitrary PNG files due to missing authorization checks in the 'wp_save_signature_image' function. This affects all versions up to and including 1.3.1. The vulnerability can lead to unauthorized file uploads to the WordPress uploads directory.
The 10Web Booster WordPress plugin versions up to and including 2.34.8 are vulnerable to a stored cross-site scripting (XSS) flaw via the 'author' parameter. This vulnerability arises from improper input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The issue is due to the plugin's handling of the comment author Name value, which can bypass WordPress core sanitization and break out of an HTML attribute context.
The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes for WordPress contains a stored cross-site scripting (XSS) vulnerability in the comment_content parameter. This affects all versions up to and including 2.4.0. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Exploitation requires a site administrator to approve the crafted comment before the payload is served to visitors.
The Team – Team Members Showcase Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'ttp_filter_taxonomy' parameter. This flaw affects all versions up to and including 6.0.2 and allows authenticated users with contributor-level access or higher to inject malicious scripts. These scripts execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.
The Frontend Admin by DynamiApps WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in all versions up to and including 3.28.36. The vulnerability arises from improper input neutralization in the 'get_dynamic_values' function, which performs text-level replacements without HTML-aware parsing. Authenticated users with Contributor-level access or higher can exploit this to inject malicious scripts that execute when other users view the affected pages. The CVSS 3.1 score is 6.4, indicating a medium severity risk.
The Favicon Rotator plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability in all versions up to and including 1.2.11. This vulnerability arises from insufficient sanitization and escaping of 'fvrt_' prefixed request parameters, allowing unauthenticated attackers to inject arbitrary scripts. Successful exploitation requires tricking a user into clicking a crafted link, leading to script execution in the user's browser.
The WP Booking System – Booking Calendar WordPress plugin is vulnerable to a time-based SQL Injection via the 'current_month' parameter in all versions up to and including 2.1.0.1. This vulnerability allows authenticated users with subscriber-level access or higher to inject additional SQL queries due to insufficient input escaping and lack of proper query preparation. The issue is a regression caused by the removal of a capability check introduced in earlier versions to address a previous vulnerability. This flaw can lead to unauthorized extraction of sensitive database information without requiring user interaction.
The Photo Reviews for WooCommerce WordPress plugin up to version 1.2.30 is vulnerable to stored DOM-based cross-site scripting (XSS) via the 'wcpr_image_upload_id' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view the affected review pages. The issue arises from insufficient input sanitization and output escaping, with no authentication or ownership checks on the stored comment meta data where the payload is saved.
The WP File Download plugin for WordPress contains an authorization bypass vulnerability (CWE-862) in all versions up to and including 6.3.9. This flaw allows authenticated users with subscriber-level access or higher to perform unauthorized actions such as permanently deleting files, emptying the trash, moving files between categories, and publishing or unpublishing files. The vulnerability does not affect confidentiality but impacts integrity and availability of the managed files.
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress contains a critical path traversal vulnerability in the rename_files function affecting all versions up to and including 34.0.10. This flaw allows unauthenticated attackers to delete arbitrary files on the server. The attack can lead to remote code execution by deleting sensitive files such as wp-config.php. Additionally, the vulnerability enables arbitrary file reads by relocating files into a publicly accessible directory.
The Responsive Lightbox & Gallery WordPress plugin up to version 2.7.9 contains a stored cross-site scripting (XSS) vulnerability via the 'comment' parameter. This vulnerability allows authenticated users with editor-level or higher privileges to inject malicious scripts if the plugin's 'Comments' lightbox setting is enabled and a moderator approves the comment. The malicious script executes when a site visitor clicks the affected image to open the lightbox. The vulnerability has a medium severity rating with a CVSS score of 4.4.
Payment Plugins for Stripe WooCommerce versions up to and including 4.0.17 are vulnerable to a reflected cross-site scripting (XSS) flaw via the '#response' URL fragment. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user visits the crafted page. Exploitation depends on the 'Generic Errors' setting being unchecked, which causes raw Stripe error messages to be returned without sanitization.
The Online Scheduling and Appointment Booking System – Bookly WordPress plugin is affected by a PHP Object Injection vulnerability through deserialization of untrusted input in the 'value' parameter. This affects all versions up to and including 28.2. The vulnerability requires authenticated attackers with custom-level access or higher. No known exploit gadget chains are currently available. The vulnerability has a high severity rating with a CVSS score of 7.2.
The SiteOrigin Widgets Bundle WordPress plugin up to version 1.74.3 contains a directory traversal vulnerability in the get_instance_css function. Authenticated users with contributor-level access or higher can exploit this flaw to read arbitrary files on the server. This occurs because the normal input sanitization pipeline is bypassed when the shortcode handler calls the widget function directly on attacker-supplied JSON data.
The VikBooking Hotel Booking Engine & PMS WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the 'attachments[name]' parameter. This vulnerability exists in all versions up to and including 1.8.15 due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject malicious scripts that execute when users access the affected pages. The vulnerability has a high severity with a CVSS score of 7.2.
The Post Grid Gutenberg Blocks – PostX plugin for WordPress versions up to and including 5.1.0 is vulnerable to a stored cross-site scripting (XSS) flaw via the display_name user field. This vulnerability arises from insufficient input sanitization and output escaping, allowing an attacker with Subscriber-level privileges to inject malicious scripts that execute when other users view affected pages. The issue stems from WordPress core's pre_user_display_name filter encoding certain characters but leaving double-quotes unescaped, enabling script injection through attribute breakouts.