The Advanced Custom Fields: Extended WordPress plugin up to version 0.9.2.7 contains multiple AJAX handlers accessible to unauthenticated users that lack proper authorization checks. This allows attackers to use publicly exposed guest nonces to bypass permissions and access restricted post titles and internal layout data. A partial patch was introduced in version 0.9.2.4.
CMB2, a WordPress plugin by jtsternberg, is affected by a stored cross-site scripting (XSS) vulnerability in all versions up to 2.13.4. The flaw arises from insufficient input sanitization and output escaping of the 'cmb43ex1_grp[0][txt]' parameter, which is a wysiwyg field inside a repeatable group. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. Exploitation requires the plugin's front-end form helper to be used with a wysiwyg field inside a repeatable group on a publicly accessible page.
The easy.jobs WordPress plugin up to version 2.8.2 contains a stored cross-site scripting (XSS) vulnerability in the 'icon' attribute of its Gutenberg block. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping of user-supplied attributes.
The Mang Board plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'align' parameter affecting all versions up to and including 2.4.5. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, allowing the malicious attribute to persist through post submission and execute in viewers' browsers, including administrators previewing posts.
The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter. This affects all versions up to and including 4.7.2. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages.
The Travelly – Tour & Travel Booking Manager for WooCommerce WordPress plugin versions up to 2.3.6 contains an authorization bypass vulnerability. Authenticated users with contributor-level access or higher can exploit this flaw to duplicate arbitrary posts, including private, draft, and pending posts authored by administrators and editors. This duplication exposes the original post's content, excerpt, title, taxonomies, and metadata. The vulnerability arises because the plugin does not properly verify user authorization and uses a static nonce action that is not bound to specific posts, allowing nonce reuse across posts.
The Clean Login WordPress plugin up to version 1.20.1 has a missing authorization vulnerability in the get_pages_with_shortcodes() function. Authenticated users with Contributor-level access or higher can exploit this flaw by embedding plugin shortcodes in their own posts to overwrite certain plugin options related to login and registration URLs and IDs.
The VikRentCar Car Rental Management System WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the 'className' parameter in all versions up to and including 1.4.10. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises due to insufficient input sanitization and output escaping, with wp_kses_post() failing to neutralize the payload because of the context in which the injection occurs.
The Webheadcoder Multi-Step Forms for Contact Form 7 WordPress plugin versions up to and including 4.7 are vulnerable to reflected Cross-Site Scripting (XSS) via the 'l10n_print_after' parameter. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link. Exploitation requires the targeted site to have at least one Contact Form 7 form configured with a [multistep] form-tag. The vulnerability is mitigated in non-multistep forms starting from version 4.7 due to canonicalization blocking the attack path.
The Related Posts for WordPress plugin (up to version 3.0.0) contains a missing authorization vulnerability. Authenticated users with contributor-level access or higher can exploit this flaw via the 'rp4wp_view' parameter to access titles and publication dates of all private posts across the site, which should normally be restricted to editors and above. The plugin's authorization checks are insufficient, allowing contributors to bypass intended access controls.
The Avada (Fusion) Builder WordPress plugin up to version 3.16.2 is vulnerable to stored cross-site scripting (XSS) via the 'tab_index' and 'empty_notice' parameters. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because the plugin insufficiently sanitizes and escapes input, and wp_kses_post does not remove the payload due to its placement within shortcode attribute text.
The If-So Dynamic Content – Elementor & All Page Builders Personalization WordPress plugin versions up to 1.10.2 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users with contributor-level access or higher can inject malicious scripts via multiple parameters, including 'repeater[*][version_uid]' and others. These scripts execute when any user visits the affected page, potentially compromising user data and session integrity.
The Postie plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.9.87. This flaw allows unauthenticated attackers to inject malicious scripts via the Email Body URL Autolink feature. The vulnerability arises because the ?postie=get-mail endpoint is accessible without authentication or capability checks, and the plugin disables WordPress's usual output filtering before saving content, enabling unescaped script injection.
The Innovative Form Builder – IvyForms WordPress plugin (versions up to 1.5.1) contains an arbitrary file upload vulnerability due to insufficient file type validation. Authenticated users with custom-level access can configure file upload fields to allow dangerous file extensions like PHP. This enables unauthenticated visitors to upload potentially executable files via a public REST API endpoint, leading to possible remote code execution.
The Waitlist Woocommerce (Back in stock notifier) WordPress plugin versions up to 2.9.1 contain a stored cross-site scripting (XSS) vulnerability via the 'type' shortcode attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This occurs because shortcode attribute values bypass the usual HTML sanitization filters and are only rendered at page display time.
The Rich Showcase for Google Reviews WordPress plugin up to version 7.1.6 contains an authorization bypass vulnerability. Authenticated users with contributor-level access or higher can retrieve a 127-character site-wide authentication secret (grw_auth_code). This secret allows impersonation of the WordPress site to the RichPlugins backend service, potentially exposing the site to unauthorized actions. The vulnerability is identified as CWE-862 (Missing Authorization).
The Related Posts for WordPress plugin (up to version 3.0.0) contains a missing authorization vulnerability that allows authenticated users with Contributor-level access or higher to read titles of non-public posts authored by higher-privileged users. This occurs because the plugin fails to verify read permissions on child post IDs linked to a parent post, exposing sensitive post titles in the editor meta box.
The VikRentCar Car Rental Management System WordPress plugin up to version 1.4.8 is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to missing or incorrect nonce validation in the condtext_update_tmpl function. This flaw allows unauthenticated attackers to inject arbitrary PHP code into executable template files, which can lead to remote code execution if an administrator is tricked into performing an action such as clicking a malicious link. The plugin's internal placeholder expansion and sanitization bypass mechanisms restore the injected PHP code before it is written to disk. Exploitation requires administrator interaction and cannot be triggered solely by the attacker.
The If-So Dynamic Content – Elementor & All Page Builders Personalization WordPress plugin versions up to 1.10.2 are vulnerable to stored cross-site scripting (XSS) via the 'conversion' shortcode attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages.
The AI ChatBot for WooCommerce – WoowBot WordPress plugin up to version 5.0.0 has an authorization bypass vulnerability. Authenticated users with subscriber-level access can exploit this flaw to trigger repeated RAG document synchronization operations that invoke paid AI embedding API calls charged to the site administrator's API key. The required nonce token is exposed to all authenticated frontend users, making exploitation trivial. This can lead to financial loss due to depletion of AI API credits.