The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections (Administrators by default) to store JavaScript that executes in the session of any user who later opens that view, including a Super Administrator on multisite.
The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks.
The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.
The Download Manager plugin for WordPress, developed by codename065, is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the 'REFERRER' parameter. This vulnerability exists in all versions up to and including 3.3.57 due to insufficient input sanitization and output escaping. An unauthenticated attacker can exploit this flaw to inject arbitrary scripts that execute in the context of a victim's browser, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 score of 6.1, indicating a medium severity level.
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy WordPress plugin versions up to and including 3.6.9 contain a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper sanitization and escaping of PayPal IPN parameters, allowing unauthenticated attackers to inject malicious scripts that execute when users access affected pages. The vulnerability has a high severity rating with a CVSS score of 7.2.
The Graphene WordPress theme up to version 2.9.4 contains a stored cross-site scripting (XSS) vulnerability in the 'Current location' and 'Author profile image URL' profile fields. Authenticated users with Subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.
The Brizy – Page Builder plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'brizy-compiled-sections' parameter. This vulnerability affects all versions up to and including 2.8.18. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.
JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress versions up to 3.6.6 is vulnerable to reflected DOM-based cross-site scripting (XSS). The vulnerability arises from insufficient input sanitization and output escaping of a query parameter matching the preset's query_var setting. An unauthenticated attacker can exploit this by tricking a user into clicking a crafted link, causing arbitrary script execution on pages embedding a form with specific text field configurations. This vulnerability has a medium severity rating with a CVSS score of 4.7.
The Noptin plugin for WordPress, used for newsletters and email automation, is vulnerable to stored cross-site scripting (XSS) in all versions up to and including 4.3.10. This vulnerability arises from insufficient input sanitization and output escaping of the 'noptin_fields[<custom_field_merge_tag>]' parameter. An unauthenticated attacker can inject malicious scripts that execute when a user accesses a page containing the injected content. Exploitation requires a published campaign post with a subscriber merge tag and involves social engineering to trick privileged users into visiting a crafted campaign preview URL.
The Data Tables Generator by Supsystic WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.12.03. This vulnerability allows authenticated users with contributor-level access or higher to inject malicious scripts via the id attribute, which execute when other users view the affected pages. The issue arises from insufficient input sanitization and output escaping.
The Podlove Podcast Publisher WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability via the Auphonic webhook endpoint in all versions up to and including 4.5.6. This vulnerability allows unauthenticated attackers to inject arbitrary scripts by submitting a crafted POST request where the status_string field is not 'Done'. The injected scripts execute when a user accesses the affected page, potentially leading to session hijacking or other malicious actions.
A stored cross-site scripting (XSS) vulnerability exists in the GiveWP – Donation Plugin and Fundraising Platform for WordPress, affecting versions up to and including 4.17.0. The flaw arises from insufficient sanitization and escaping of user-supplied shortcode attributes, allowing authenticated users with Contributor-level access or higher to inject malicious scripts. These scripts execute whenever a user views the affected page, potentially compromising user interactions.
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress versions up to and including 10.2.1 contains a PHP Object Injection vulnerability via deserialization of untrusted input. This vulnerability requires authenticated users with edit_course capability roles, such as Instructor or Administrator, and is exploitable during lesson creation when a temporary lesson ID triggers a custom metadata path. Exploitation depends on the presence of a PHP Object Injection POP chain in other installed plugins or themes. Without such a POP chain, the vulnerability has no impact. If a POP chain is present, attackers may delete files, retrieve sensitive data, or execute code.
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in versions up to and including 3.7.12. This vulnerability arises from improper input sanitization and output escaping of the Block Font Family attribute. It can be exploited by authenticated users with author-level access or higher to inject malicious scripts that execute when other users view the affected pages. The vulnerability is only triggered if the 'Load Google Fonts Locally' option is enabled, which is not the default setting.
Presto Player plugin for WordPress versions up to and including 4.5.1 is vulnerable to stored cross-site scripting (XSS) via the comment content processed by the <presto-player> tag. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Initial comment approval is required, but subsequent comments from the same author may be auto-approved by default WordPress settings, enabling persistent exploitation.
Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress versions up to 4.8.3 contains a privilege escalation vulnerability via the create_support_user() function. This flaw allows an attacker who controls an account with specific hardcoded credentials to be silently promoted to administrator or super admin on multisite setups. Exploitation requires that an attacker first obtain or create such an account, then a legitimate administrator must trigger the support-access feature to activate the privilege escalation.
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory for WordPress contains a Local File Inclusion vulnerability in all versions up to and including 2.8.187. This vulnerability is exploitable via the 'design_type' parameter and allows unauthenticated attackers to include and execute arbitrary PHP files on the server. The exploit requires a nonce value that is publicly accessible on all frontend pages, meaning no authentication or user interaction is needed. Successful exploitation can lead to bypassing access controls, disclosure of sensitive data, or remote code execution.
The Embed Any Document plugin for WordPress has a stored cross-site scripting (XSS) vulnerability in the 'embeddoc' shortcode in all versions up to and including 2.7.13. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.
The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress contains a privilege escalation vulnerability affecting all versions up to and including 1.43.0. The flaw allows authenticated users with Cashier-level access or higher to change arbitrary users' email addresses without proper identity validation. This can lead to account takeover by resetting passwords of targeted users, including administrators.