The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post strips only HTML tags, a quote-breaking payload containing no angle brackets survives post save intact, and the injected script fires for every viewer of the post — including higher-privileged Editors and Administrators who routinely preview a Contributor's pending content.
The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have published a chart whose SQL query returns a column controllable by a lower-privileged user, such as wp_users.display_name, which a Subscriber can populate with a payload via the standard WordPress profile page at /wp-admin/profile.php.
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce that serves as the only authorization gate is publicly printed in the [saswp-reviews-form] shortcode HTML, making it obtainable by any anonymous visitor and rendering it ineffective as an access control boundary.
The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.
Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin versions up to 4.9.3 contain a path traversal vulnerability in the copy_file function. Authenticated users with Sales Representative-level access or higher, who have the import_contacts capability, can delete arbitrary files on the server. This can lead to remote code execution if critical files like wp-config.php are deleted. The vulnerability arises from insufficient file path validation.
The Modula Image Gallery – Photo Grid & Video Gallery WordPress plugin versions up to and including 3.0.11 have a vulnerability that allows unauthenticated attackers to access sensitive information. Specifically, the plugin's REST API endpoint /wp-json/wp/v2/modula-gallery/{id} does not properly redact password-protected gallery credentials, exposing plaintext usernames and passwords. This occurs because the core REST endpoint lacks the redaction applied in the plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint.
The My Calendar – Accessible Event Manager WordPress plugin versions up to 3.8.7 contain a critical privilege escalation vulnerability. An unauthenticated attacker can inject a crafted shortcode via the public 'mcs' GET parameter, leading to arbitrary PHP function calls. This flaw allows overwriting the Administrator account credentials (user ID 1), granting full administrative access. The vulnerability is exploitable through the plugin's publicly accessible /my-calendar/ page by default upon activation.
The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
The Bulk Page Generator – LPagery WordPress plugin up to version 3.1.0 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can create, modify, and delete pages and bulk page-generation processes without proper authorization checks. On fresh installations without Freemius opted in, the AES-256-CBC key used for Bearer token validation defaults to a publicly known value, making token forgery trivial for any authenticated user.
Klarna for WooCommerce plugin versions up to and including 4.13.3 contain an authorization bypass vulnerability. This flaw allows unauthenticated attackers to enumerate all store orders and access sensitive personal information such as names, emails, phone numbers, and addresses. The vulnerability arises because the plugin fails to verify user authorization before exposing order details via a JavaScript variable. WooCommerce's sequential order IDs facilitate trivial enumeration through GET requests without requiring authentication or order keys.
The FunnelKit – Funnel Builder Plugin for WooCommerce Checkout for WordPress contains an authorization bypass vulnerability in all versions up to and including 3.16.0.6. This flaw allows unauthenticated attackers to retrieve billing personally identifiable information (PII) such as full name, street address, email address, and phone number for any WooCommerce order by submitting sequential order IDs. Exploitation requires the presence of a FunnelKit thank-you page rendering specific shortcodes. The vulnerability has a high severity rating with a CVSS score of 7.5.
The Nexter Extension plugin for WordPress up to version 4.7.11 contains a privilege escalation vulnerability. Authenticated users with Subscriber-level access or higher can exploit a flaw in the role switching feature to regain Administrator privileges if their account previously held that role and was demoted via a bulk role change. This occurs because the plugin does not verify nonces or capabilities in a specific handler and fails to clear stored administrator role metadata during bulk role changes.
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the wp_ajax_nopriv_mb_template endpoint is publicly accessible without authentication, nonce verification is not enforced for the content_reply mode, and admin-ajax.php responds with Content-Type: text/html, causing browsers to execute injected tags embedded in the JSON response body.
Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress versions up to and including 1.58.1 is vulnerable to arbitrary shortcode execution. This vulnerability allows unauthenticated attackers to execute arbitrary shortcodes via a crafted GET request to the search results page or by submitting an anonymous comment on posts with comments enabled. No specific Forminator content or configuration is required to exploit this issue.
The Image Hub plugin for WordPress versions up to and including 1.2.0 exposes plaintext API credentials for six third-party image services to authenticated users with subscriber-level access or higher. These credentials are embedded in every admin page's HTML via wp_localize_script. Additionally, the plugin leaks a valid AJAX nonce and lacks capability checks in its AJAX handler, allowing subscriber-level users to overwrite stored API credentials.
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. WordPress plugin versions up to 1.2.78.6 contain a critical privilege escalation vulnerability. The flaw allows unauthenticated attackers to manipulate the subscribe_to_email_list endpoint by supplying crafted form_custom_field_mappings, enabling them to overwrite any WordPress user account password, including administrators. Exploitation requires a published WordPress User Registration opt-in form but no authentication or capability checks are needed to reach the vulnerable endpoint. This leads to full site compromise.
A privilege escalation vulnerability exists in the InstaWP Connect – 1-click WP Staging & Migration WordPress plugin in all versions up to and including 0.1.4.1. The flaw allows authenticated users with Subscriber-level access or higher to obtain the plaintext master API key due to improper privilege checks on the plugin's admin page. Using this key, attackers can generate a single-use login URL that grants administrator-level access, fully escalating their privileges. Exploitation requires the site to be connected to InstaWP and the attacker's role to be included in the plugin's Sync Tab Access list alongside the administrator role.
NotificationX plugin for WordPress versions up to 3.3.3 has a missing authorization vulnerability in its REST API endpoint /notificationx/v1/popup-submit. This flaw allows unauthenticated attackers to inject arbitrary forged social-proof entries into enabled non-popup NotificationX campaigns, such as WP Comments and WooCommerce sales notifications. The vulnerability arises because the permission callback always returns true, and the handler does not verify the type of campaign before copying its source data.
FluentCart plugin for WordPress versions up to 1.7.0 contains an insecure direct object reference vulnerability. This flaw allows unauthenticated attackers to access other customers' billing and shipping address information by manipulating user-controlled keys in AJAX requests. The vulnerability arises from missing validation on order_id and address_id parameters, enabling enumeration of sequential IDs and bypassing intended access controls. The exposed data includes sensitive personally identifiable information (PII) such as street address, phone number, company name, and VAT number. The vulnerability has a high severity rating with a CVSS score of 7.5.
Mail Mint plugin for WordPress versions up to and including 1.31.4 contains an SQL Injection vulnerability in the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint. The flaw arises from improper escaping of user-supplied filter values before they are interpolated into SQL queries, allowing authenticated users with the 'mint_read_contacts' capability to inject additional SQL commands. This can lead to unauthorized extraction of sensitive database information. The vulnerability has a CVSS score of 6.5, indicating medium severity. No official patch or fix information is provided.