The Getwid – Gutenberg Blocks WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the 'data-image-points' parameter. This vulnerability exists in all versions up to and including 3.0.1. Authenticated users with contributor-level access or higher can exploit this flaw to inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.
The Church Admin WordPress plugin up to version 5.1.2 is vulnerable to stored Cross-Site Scripting (XSS) via the 'email' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.
The Real Estate Manager – Property Listing and Agent Management WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the 'first_name' parameter in all versions up to and including 7.3. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The plugin's reCAPTCHA validation can be bypassed by omitting the g-recaptcha-response parameter, making exploitation easier. The vulnerability has a high severity rating with a CVSS score of 7.2.
The Order Export & Order Import for WooCommerce plugin for WordPress up to version 2.7.8 is vulnerable to sensitive information exposure. Unauthenticated attackers can access exported order CSV files containing customer personally identifiable information (PII) such as names, addresses, emails, phone numbers, and order details. This occurs when protective .htaccess and index.php files are missing from the export directory, a state that can arise after uninstall/reinstall cycles, migrations, backup restores, or staging synchronizations. Export filenames are predictable based on timestamps, enabling brute-force access to files over HTTP without authentication.
HivePress – Business Directory, Listings & Classified Ads Plugin for WordPress versions up to and including 1.7.31 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper sanitization and escaping of user input in the 'custom text attribute' parameter, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. Exploitation requires that an administrator has configured a Text attribute displaying the %value% token inside an HTML attribute, a known HivePress pattern.
The Post Export Import with Media plugin for WordPress contains a directory traversal vulnerability in all versions up to and including 1.17.1. Authenticated users with administrator-level privileges can exploit this flaw by uploading a crafted ZIP archive containing a media_metadata.json file with path traversal sequences in the 'file_path' parameter. This allows reading arbitrary files on the server, potentially exposing sensitive information. The vulnerability bypasses extension checks introduced in version 1.13.2. The CVSS score is 4.9, indicating medium severity.
Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress versions up to and including 4.9 contains a privilege escalation vulnerability. Authenticated users with the edit_contacts capability can reassign contact records to arbitrary WordPress user IDs without requiring higher privileges. This allows attackers with sales_rep-level access to escalate to administrator by exploiting the auto-login link feature tied to contact notes.
A stored cross-site scripting (XSS) vulnerability exists in the GamiPress WordPress plugin up to version 7.9.4. The issue arises from improper sanitization and escaping of the 'video_id' parameter, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. These scripts execute when other users access the affected pages, potentially leading to session hijacking or other script-based attacks.
The Sonaar MP3 Audio Player WordPress plugin versions up to and including 5.14.2 contain a stored cross-site scripting (XSS) vulnerability via shortcode attributes. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This occurs because input sanitization and output escaping are insufficient, and WordPress's save-time filtering does not neutralize payloads delivered through shortcode attributes.
FV Player 8 WordPress plugin versions up to 8.1.7 have an arbitrary file upload vulnerability due to insufficient file type validation and missing capability checks. Authenticated users with subscriber-level access or higher can exploit a race condition in the check_mimetype function to upload potentially executable files, enabling remote code execution. The vulnerability has a high severity score of 8.8 CVSS 3.1.
The AI Puffer – AI Chatbot, AI Writer & Automation WordPress plugin (formerly AI Power) contains an authorization bypass vulnerability in all versions up to and including 2.4.89. Authenticated users with subscriber-level access or higher can modify global semantic search settings if an administrator has granted their role access to the Knowledge Base module via the Role Manager. This vulnerability does not allow direct administrative access but permits changes to settings normally restricted to administrators.
The Appointment Booking Plugin – LatePoint for WordPress suffers from an improper privilege management vulnerability allowing privilege escalation. Authenticated users with the 'settings__edit' capability can manipulate the default WordPress role assigned to new customers, potentially setting it to 'administrator'. This enables newly registered LatePoint customer accounts to gain full administrator privileges. The issue affects all versions up to and including 5.7.3. Exploitation requires prior capability assignment by a WordPress administrator and subsequent new customer registration through LatePoint.
The AI Puffer – AI Chatbot, AI Writer & Automation WordPress plugin (formerly AI Power) contains an authorization bypass vulnerability in all versions up to and including 2.4.89. This flaw allows authenticated users with subscriber-level access or higher to modify global plugin configuration settings related to indexing and vector search. Exploitation requires that an administrator has granted 'sources' module access to a lower-privileged role via the plugin's Role Manager. The vulnerability has a low CVSS score and does not impact confidentiality or availability but can affect the integrity of plugin settings.
The Table Field Add-on for ACF and SCF WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.3.35. Authenticated users with Contributor-level access or higher can inject malicious scripts via table cell content, which execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.
The Smart Popup by Supsystic WordPress plugin is vulnerable to SQL Injection via the 'sidx' parameter in versions up to and including 1.13.2. This vulnerability allows authenticated users with administrator-level privileges to inject additional SQL queries due to insufficient input escaping and lack of proper query preparation. The vulnerability has a medium severity rating with a CVSS score of 4.9.
The Booking Calendar plugin for WordPress contains a vulnerability in versions up to and including 11.4.3 that allows unauthenticated attackers to access sensitive customer information. This exposure occurs via the wpbc_is_show_popover_in_flex_timeline() function and can leak names, email addresses, and phone numbers of customers who have made bookings. The vulnerability has a medium severity rating with a CVSS score of 5.3.
The Appointment Booking Plugin – LatePoint for WordPress versions up to and including 5.7.2 contains an Insecure Direct Object Reference (IDOR) vulnerability. This flaw allows unauthenticated attackers to manipulate booking parameters to create approved appointments linked to other customers' order items without proper authorization. The vulnerability arises because certain routes accept an order item ID parameter that is used without verifying ownership, payment status, or capacity. As a result, attackers can also access sensitive customer information such as names, email addresses, and order codes in booking confirmations.