The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitization bypass is further compounded by the ability to omit the data_type parameter in a modify request, which skips the HTMLPurifier branch entirely and leaves only mbw_htmlspecialchars2 encoding — fully reversed at render — as the sole barrier.
The miniOrange OTP Login, Verification and SMS Notifications WordPress plugin up to version 5.5.8 contains an authentication bypass vulnerability. This flaw allows unauthenticated attackers to log in as any user, including administrators, by exploiting the Delay OTP grace period mechanism without supplying correct credentials. Exploitation requires specific plugin settings to be enabled, including OTP-only login and Delay OTP Verification, and the target user must be within the Delay OTP interval.
Forminator Forms plugin for WordPress versions up to 1.58.1 is vulnerable to arbitrary shortcode execution due to improper handling of user-controlled input in notification templates. This vulnerability allows unauthenticated attackers to execute arbitrary WordPress shortcodes by submitting crafted quiz data. The impact depends on other installed plugins and themes that register shortcodes, potentially leading to content injection or information disclosure.
The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login.
The Broken Link Checker WordPress plugin up to version 2.4.14.1 contains a code injection vulnerability (CWE-94) that allows unauthenticated attackers to execute arbitrary shortcodes. This occurs because the plugin does not properly validate input before calling do_shortcode. Exploitation requires that a malicious shortcode payload be submitted in a comment and approved through normal moderation, after which the shortcode executes automatically via WP-Cron.
Wheels CLI versions 4.0.0 through 4.1.1 contain multiple security issues including OS command injection due to insufficient validation or escaping of user-supplied inputs. This allows execution of shell commands on deploy hosts and CI runners. Additional flaws include unintended file deletion, overwriting vendor files, stored XSS in generated views, and improper process termination. These vulnerabilities are fixed in version 4.1.2, but some generated views require manual edits to fully mitigate stored XSS.
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress versions up to 5.2.1 contains an authorization bypass vulnerability via the 'password' parameter. Authenticated users with custom-level access or higher can exploit missing validation on a user-controlled key to change the WordPress password of any customer who has placed an order with the attacking vendor. This enables limited account takeover by logging in as that customer. Vendor-level access is required and can be self-registered if the public vendor registration option is enabled.
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives storage because the widened comment allow-list permits SVG elements with arbitrary data-* attributes; execution occurs because colibri.js, enqueued globally on every front-end page, reads the stored data-target value via jQuery.data() — which HTML-entity-decodes it — and passes the resulting string directly into jQuery(), which parses a leading '<' as HTML and fires the embedded event handler.
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.
The Debloat – Remove Unused CSS, Optimize JS WordPress plugin versions up to 1.3.0 contains a directory traversal vulnerability via the 's' parameter. This flaw allows authenticated users with administrator-level access or higher to read arbitrary files on the server if the Optimize CSS feature with Inline Google Fonts is enabled. The vulnerability can be triggered by an unauthenticated visitor with a crafted GET request to the public search URL. The CVSS score is 5.9, indicating a medium severity issue.
The Customer Email Verification for WooCommerce WordPress plugin (versions up to 3.3.0) contains a privilege escalation vulnerability when the 'Encoding method' is set to 'hashids'. This flaw allows unauthenticated attackers to brute-force a small activation code space to verify any unverified account, including administrators, by exploiting a weak token generation and lack of nonce or rate limiting in the verification handler.
CVE-2026-97339 is a stored cross-site scripting (XSS) vulnerability in the Complianz GDPR/CCPA Cookie Consent Banner WordPress plugin. It affects all versions up to and including 7.5.5. The vulnerability arises from insufficient input sanitization and output escaping in the comment content processed by the plugin's yotu-wp Cookie-Blocker filter. An unauthenticated attacker can inject malicious scripts that execute when users visit the affected pages. The exploit bypasses WordPress's standard comment sanitization by using allowed HTML tags and hiding executable tokens inside quoted attribute values, which are then transformed by the plugin's output filter to enable script execution. The attack requires the malicious comment to be approved before execution occurs.
Backuply – Backup, Restore, Migrate and Clone WordPress plugin versions up to 1.5.8 contains a SQL Injection vulnerability via the Biographical Info field. This second-order injection occurs during backup restoration, allowing authenticated users with subscriber-level access or higher to escalate privileges by modifying database entries such as the default_role option. The vulnerability enables full site takeover without direct data leakage during exploitation.
The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress core's save-time kses sanitization entirely because the payload uses only kses-allowed elements — an <abbr title> attribute and <code> text content — and the XSS is introduced post-save when the plugin's output-buffer rewriter substitutes a double-quote-bearing <code> body into the <abbr title> attribute via predictable, unsalted ___noise___ placeholder keys.
FluentCart, a WordPress eCommerce plugin, contains an SQL Injection vulnerability in versions up to and including 1.7.0. The flaw arises from improper escaping of user-supplied parameters in SQL queries, allowing authenticated users with custom-level access or higher to append malicious SQL commands. On FluentCart Pro, users with the Manager shop role can exploit this without administrator privileges. The vulnerability has a medium severity with a CVSS score of 4.9 and can lead to unauthorized disclosure of sensitive database information.
The Cooked – Recipe Management WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the [cooked-timer] shortcode content. This vulnerability exists in all versions up to and including 1.16.1 and allows authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.
The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
FreeRDP versions prior to 3.32.0 contain a heap buffer overflow vulnerability in the function persistent_cache_read_entry_v3. This flaw allows local attackers to corrupt memory by providing a specially crafted v3 persistent cache file with manipulated width and height values. The vulnerability can lead to buffer overflow during fread operations, potentially enabling code execution.
Backdrop CMS versions 1.34.x before 1.34.6 and 1.35.x before 1.35.2 have a vulnerability where uploaded SVG images are not sufficiently validated to exclude dangerous SVG tags. This can allow execution of embedded scripting if the SVG is accessed directly by URL. The risk is mitigated by the fact that SVGs are normally embedded within <img> tags, which prevents script execution, and the attacker must have upload privileges. The vulnerability is rated medium severity with a CVSS score of 5.3.
A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.