The Appointment Booking Plugin – LatePoint for WordPress versions up to 5.7.2 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to manipulate a user-controlled parameter to create approved appointments linked to other customers' order items. The vulnerability arises because the plugin does not verify ownership, payment status, or capacity for the referenced order items. Attackers can also access personal information such as names, email addresses, and order codes of other customers. The issue is due to insufficient validation in specific routes handling booking steps.
CVE-2026-89301 is a high-severity vulnerability in the rtMedia plugin for WordPress, BuddyPress, and bbPress. It affects all versions up to and including 4.7.13. The flaw involves missing authorization checks that allow unauthenticated attackers to delete arbitrary safe files on the server by exploiting insufficient file path validation. Additionally, a public nonce used for uploads is exposed in frontend JavaScript, making it accessible to unauthenticated visitors.
The Avada (Fusion) Builder WordPress plugin is vulnerable to an authorization bypass vulnerability in all versions up to and including 7.16.1. This flaw allows unauthenticated attackers to invoke arbitrary WordPress action hooks via a crafted form submission, potentially causing severe impacts such as permanent deletion of site content and denial of service. Exploitation requires a published Avada form with AJAX submission and a notification email template including specific placeholders. The vulnerability also allows a blind arbitrary read of user/post meta data, but this information is only delivered to the site owner and cannot be exfiltrated by the attacker. The CVSS score is 9.1, indicating critical severity.
Fastcache by Host.it WordPress plugin versions up to 1.7.4 contain a code injection vulnerability via the cache_cookie_exclude parameter. Authenticated administrators can inject arbitrary Apache directives into the .htaccess file, enabling server-level configuration changes and potential remote code execution. The vulnerability arises from improper sanitization of user input before writing to .htaccess.
The Download Manager plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'not_found' parameter. This vulnerability affects all versions up to and including 3.3.58. Authenticated users with Contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.
The FireBox – WooCommerce Popup Builder plugin for WordPress contains an SQL Injection vulnerability in the FireBox Form Display Condition feature. This affects all versions up to and including 3.1.13. Authenticated attackers with author-level access or higher can exploit this flaw to append additional SQL queries, potentially extracting sensitive database information. On fresh installs of version 3.1.10 and later, exploitation requires administrator-level access, but on upgraded sites from versions prior to 3.1.10, the required privilege is reduced to author-level due to a migration issue.
The Form Maker by 10Web plugin for WordPress is vulnerable to reflected cross-site scripting (XSS) via the 'inputs' parameter in versions up to and including 1.15.48. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link. The issue arises from insufficient input sanitization and output escaping.
The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter in all versions up to and including 6.88. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Exploitation requires that a comment from the attacker's email address be approved; on default WordPress setups, only the first comment from an email is moderated, so subsequent comments auto-approve and expose the payload immediately.
The Simply Schedule Appointments Booking Plugin for WordPress contains an incorrect authorization vulnerability in all versions up to and including 1.6.11.11. The flaw allows unauthenticated attackers to modify admin-controlled fields of appointments via the appointment update REST API endpoint. This includes faking payment confirmation, reassigning appointments to other users, and changing service types.
The RSS Aggregator by Feedzy plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to and including 5.2.10. Authenticated users with contributor-level access or higher can inject malicious scripts via the RSS feed title, which are executed when other users view the affected pages. The vulnerability arises because the plugin does not properly sanitize or escape input from external RSS feed titles at render time, bypassing save-time filtering.
The Download Manager plugin for WordPress up to version 3.3.71 contains a vulnerability that allows authenticated users with subscriber-level access or higher to extract administrator session cookies via the 'first_name' parameter. This occurs when an administrator suspends the attacker's account, triggering a suspension email that includes the administrator's full Cookie header, enabling session hijacking and potential account takeover.
The Filter Everything — WordPress & WooCommerce Filters plugin is affected by a reflected cross-site scripting (XSS) vulnerability in versions up to and including 1.9.6. This vulnerability arises from improper input sanitization and output escaping in the flrt_elementor_load_more_anchor() function, which processes URL query parameters insecurely. An unauthenticated attacker can craft a malicious link that injects arbitrary scripts into pages, potentially executing them when a user interacts with the link.
The FV Flowplayer Video Player WordPress plugin up to version 7.5.54.7212 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient sanitization and escaping of an unquoted popup shortcode attribute, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. Exploitation requires the profile_videos_enable_bio option to be enabled, as the injected scripts execute on author bio or archive pages where the profile-video shortcode is rendered. The vulnerability has a medium severity with a CVSS score of 6.4.
The Hello Plus plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 1.7.7. This flaw allows authenticated users with Contributor-level access or higher to publish their own header/footer templates and draft templates owned by users with higher privileges. The vulnerability arises from improper verification of user authorization when performing certain actions within the plugin.
The Download Manager plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'regurl' parameter affecting all versions up to and including 3.3.71. Authenticated users with contributor-level access or higher can inject malicious scripts that execute for logged-out visitors viewing the injected pages. The vulnerability arises from insufficient input sanitization and output escaping. The injected payload does not affect authenticated users due to template gating based on login status.
The Fluent Forms WordPress plugin up to version 6.2.14 is vulnerable to reflected cross-site scripting (XSS) due to improper input sanitization and output escaping of user-controlled parameters in the {get.*} SmartCode placeholders. An unauthenticated attacker can inject malicious scripts if a site administrator has configured a Custom HTML field with a {get.*} SmartCode inside URL-accepting attributes. Exploitation requires tricking a user into interacting with a crafted link, potentially leading to script execution in the user's browser.
The expivi 3D Product configurator for WooCommerce plugin for WordPress contains a critical remote code execution vulnerability in all versions up to and including 2.16.2. This flaw arises from missing authentication and nonce checks combined with unsanitized input in the 'xpv_image' POST parameter, which is echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled. An attacker can exploit this by sending a single unauthenticated POST request to execute arbitrary code on the server.
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'email (Contact Email custom field htmlvar_name)' parameter. This affects all versions up to and including 2.8.188. Authenticated users with subscriber-level access or higher can inject malicious scripts if the Contact Email custom field is configured and the injected listing is approved by an administrator. The vulnerability arises from insufficient input sanitization and output escaping, allowing script execution when users view the affected listing pages.