Threat database

The Post Grid Gutenberg Blocks – PostX WordPress plugin up to version 5.1.0 is vulnerable to stored cross-site scripting (XSS) via the display_name user field. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users visit affected pages. The issue arises because the plugin insufficiently sanitizes and escapes user input, specifically allowing double-quotes in display_name to break out of HTML attributes.

A stored cross-site scripting (XSS) vulnerability exists in the WordPress plugin User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission. The flaw is due to insufficient input sanitization and output escaping of the 'wpuf_payment_method' parameter in versions up to and including 4.3.12. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability exploits a bypass technique involving appending a valid gateway keyword to evade sanitization functions.

The Fluent Forms plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 6.2.5. This flaw allows authenticated users with Custom-level access or higher to perform unauthorized actions such as reading private form submissions, changing submission statuses, deleting submissions permanently, and modifying global plugin settings.

The Quiz and Survey Master (QSM) plugin for WordPress has a stored DOM-based cross-site scripting (XSS) vulnerability in the 'qsm_hidden_questions' parameter affecting all versions up to and including 11.2.6. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. Exploitation requires triggering a failure in the mlw_results INSERT operation by submitting an over-length or duplicate qsm_unique_key, causing unescaped payloads to be written to the audit trail.

ZTE Z80 Ultra has an information disclosure vulnerability due to improper privilege management. This flaw allows third-party applications to read sensitive information by hooking system APIs. The vulnerability has a low severity score and does not affect system integrity or availability.

The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.

The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control.

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.

The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowing users with instructor level access to reassign the parent of any post on the site, taking other instructors' course content into their own courses and making arbitrary published content unreachable.

The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing the gallery, including administrators.

The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type restriction on it, allowing users with the Author role or higher to plant content that, once an administrator runs the import, copies an arbitrary server-readable file into a publicly served directory, exposing it to unauthenticated retrieval.

The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to an email address they do not own, gaining an authenticated session.

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7's status metadata onto arbitrary posts.

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators.

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as well as site-wide gallery filters.