The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call('update_cc_details', ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator's login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker's own password, resolves the local WordPress user row via `get_user_by('login', $username)` — which now selects the real Administrator's row — and calls `wp_set_password()` against that Administrator's user ID; because the `user_level != 10` guard only suppresses PilotPress's own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.
The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.
The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has previously enabled a WordPress.org Reviews campaign and placed the notificationx-pro/notificationx dynamic block on a public page, both of which are documented, supported plugin workflows.
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress contains a blind SQL Injection vulnerability in all versions up to and including 3.6.1. The flaw exists in the 'src_by[].val.start / src_by[].val.end' parameters with the 'bt' (BETWEEN) operator, allowing authenticated users with vendor-level access or higher to inject additional SQL commands. This vulnerability is due to insufficient escaping and incomplete patching of a previous SQL injection issue. It can lead to unauthorized extraction of sensitive database information.
The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because WordPress core's esc_url() preserves HTML entity-encoded characters, allowing a crafted entity-encoded payload in the comment 'Website' field to survive storage and be DOM-decoded by the browser into executable markup at the sink.
The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the malicious comment to be approved and an administrator to subsequently open the Visual Inspector and click the attacker's anchor link, both of which are plausible interactions during routine comment triage.
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to, and including, 7.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected link.
The ELEX WordPress HelpDesk & Customer Ticketing System plugin versions up to and including 3.3.7 contain an arbitrary file upload vulnerability due to insufficient validation of IMAP email attachments. This flaw allows unauthenticated attackers to upload potentially executable files, enabling remote code execution. The vulnerability is identified as CWE-434 and has a critical CVSS score of 9.8.
The User Profile Builder plugin for WordPress versions up to 4.0.3 contains a privilege escalation vulnerability via the 'role' parameter in the user registration form. This flaw allows unauthenticated attackers to create a fully activated administrator account by submitting a crafted registration request with 'role=administrator' and confirming via email. Exploitation requires legacy form fields named 'role', email confirmation enabled, and open user registration. The vulnerability arises from insufficient validation of the role parameter in the activation handler.
The 10Web Booster WordPress plugin up to version 2.34.5 contains a path traversal vulnerability that allows unauthenticated attackers to create arbitrary directories outside the intended cache directory and write a cached page file named 'source.html' into them. The vulnerability arises from unsanitized user input being concatenated into file paths without proper containment checks. While attackers cannot write PHP files or execute code, they can poison the cache and create directories with full permissions.
The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has configured at least one custom checkout field of type Html or File, which is a standard documented plugin feature.
The Slim SEO – AI SEO Plugin for WordPress up to version 4.11.1 contains a vulnerability allowing authenticated users with subscriber-level access or higher to execute arbitrary shortcodes. This occurs because the plugin does not properly validate input before running do_shortcode, enabling code injection via the author's Biographical Info field. The injected shortcode executes on unauthenticated front-end requests that display the author's description, such as those using the ?author= query parameter when auto_redirection is disabled.
The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The heatmap recording endpoint accepts unauthenticated requests protected only by a nonce that any visitor can freely obtain via the public opti_behavior_refresh_nonces AJAX action, removing any practical barrier to injecting the malicious payload.
The Lightweight Cookie Notice – Cookie Banner for Cookie Consent WordPress plugin up to version 1.19 contains a vulnerability due to a hardcoded security constant (W3TC_DYNAMIC_SECURITY) with a publicly known value. This exposure allows unauthenticated attackers to discover the W3 Total Cache mfunc security key, potentially enabling arbitrary PHP code injection if W3 Total Cache is also installed. The vulnerability is classified under CWE-330 for use of insufficiently random values.
The Theme My Login plugin for WordPress up to version 7.2.1 contains a critical privilege escalation vulnerability. This flaw allows unauthenticated attackers to change arbitrary users' passwords on multi-site setups due to improper validation of user identity before password updates. The vulnerability enables account takeover without requiring prior authentication.
The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The ingest endpoint is gated only by a nonce that is publicly emitted to every anonymous visitor on tracked pages via optiBehaviorHeatmapConfig.nonce, meaning no account or authentication of any kind is required to write the malicious payload.
The Simply Schedule Appointments WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the 'status' parameter in all versions up to and including 1.6.12.35. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrator views the debug-log viewer, which is accessible with the site-wide Support PIN. The issue arises due to insufficient input sanitization and output escaping combined with debug logging enabled by default.
The Tourfic WordPress plugin up to version 3.0.1 contains a stored cross-site scripting (XSS) vulnerability via the 'type' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because input sanitization and output escaping are insufficient, allowing event handler attributes to persist despite the wp_kses_post filter. This can lead to unauthorized script execution in the context of the website.
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload persists in wp_comments.comment_author independently of the user account, so removing or changing the attacker's display name after the comment is posted does not neutralize the stored script.
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The extension blocklist gatekeeper is bypassed by uploading text-type files (.txt, .csv, .vtt, .srt, .asc) whose contents begin with an HTML payload such as '<BODY onload=…>', as the check classifies these files as text/plain without inspecting their byte content.