The Clean Login WordPress plugin up to version 1.20.1 has a missing authorization vulnerability in the get_pages_with_shortcodes() function. Authenticated users with Contributor-level access or higher can exploit this flaw by embedding plugin shortcodes in their own posts to overwrite certain plugin options related to login and registration URLs and IDs.
The VikRentCar Car Rental Management System WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the 'className' parameter in all versions up to and including 1.4.10. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises due to insufficient input sanitization and output escaping, with wp_kses_post() failing to neutralize the payload because of the context in which the injection occurs.
The Webheadcoder Multi-Step Forms for Contact Form 7 WordPress plugin versions up to and including 4.7 are vulnerable to reflected Cross-Site Scripting (XSS) via the 'l10n_print_after' parameter. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link. Exploitation requires the targeted site to have at least one Contact Form 7 form configured with a [multistep] form-tag. The vulnerability is mitigated in non-multistep forms starting from version 4.7 due to canonicalization blocking the attack path.
The Related Posts for WordPress plugin (up to version 3.0.0) contains a missing authorization vulnerability. Authenticated users with contributor-level access or higher can exploit this flaw via the 'rp4wp_view' parameter to access titles and publication dates of all private posts across the site, which should normally be restricted to editors and above. The plugin's authorization checks are insufficient, allowing contributors to bypass intended access controls.
The Avada (Fusion) Builder WordPress plugin up to version 3.16.2 is vulnerable to stored cross-site scripting (XSS) via the 'tab_index' and 'empty_notice' parameters. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because the plugin insufficiently sanitizes and escapes input, and wp_kses_post does not remove the payload due to its placement within shortcode attribute text.
The If-So Dynamic Content – Elementor & All Page Builders Personalization WordPress plugin versions up to 1.10.2 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users with contributor-level access or higher can inject malicious scripts via multiple parameters, including 'repeater[*][version_uid]' and others. These scripts execute when any user visits the affected page, potentially compromising user data and session integrity.
The Postie plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.9.87. This flaw allows unauthenticated attackers to inject malicious scripts via the Email Body URL Autolink feature. The vulnerability arises because the ?postie=get-mail endpoint is accessible without authentication or capability checks, and the plugin disables WordPress's usual output filtering before saving content, enabling unescaped script injection.
The Innovative Form Builder – IvyForms WordPress plugin (versions up to 1.5.1) contains an arbitrary file upload vulnerability due to insufficient file type validation. Authenticated users with custom-level access can configure file upload fields to allow dangerous file extensions like PHP. This enables unauthenticated visitors to upload potentially executable files via a public REST API endpoint, leading to possible remote code execution.
The Waitlist Woocommerce (Back in stock notifier) WordPress plugin versions up to 2.9.1 contain a stored cross-site scripting (XSS) vulnerability via the 'type' shortcode attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This occurs because shortcode attribute values bypass the usual HTML sanitization filters and are only rendered at page display time.
The Rich Showcase for Google Reviews WordPress plugin up to version 7.1.6 contains an authorization bypass vulnerability. Authenticated users with contributor-level access or higher can retrieve a 127-character site-wide authentication secret (grw_auth_code). This secret allows impersonation of the WordPress site to the RichPlugins backend service, potentially exposing the site to unauthorized actions. The vulnerability is identified as CWE-862 (Missing Authorization).
The Related Posts for WordPress plugin (up to version 3.0.0) contains a missing authorization vulnerability that allows authenticated users with Contributor-level access or higher to read titles of non-public posts authored by higher-privileged users. This occurs because the plugin fails to verify read permissions on child post IDs linked to a parent post, exposing sensitive post titles in the editor meta box.
The VikRentCar Car Rental Management System WordPress plugin up to version 1.4.8 is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to missing or incorrect nonce validation in the condtext_update_tmpl function. This flaw allows unauthenticated attackers to inject arbitrary PHP code into executable template files, which can lead to remote code execution if an administrator is tricked into performing an action such as clicking a malicious link. The plugin's internal placeholder expansion and sanitization bypass mechanisms restore the injected PHP code before it is written to disk. Exploitation requires administrator interaction and cannot be triggered solely by the attacker.
The If-So Dynamic Content – Elementor & All Page Builders Personalization WordPress plugin versions up to 1.10.2 are vulnerable to stored cross-site scripting (XSS) via the 'conversion' shortcode attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages.
The AI ChatBot for WooCommerce – WoowBot WordPress plugin up to version 5.0.0 has an authorization bypass vulnerability. Authenticated users with subscriber-level access can exploit this flaw to trigger repeated RAG document synchronization operations that invoke paid AI embedding API calls charged to the site administrator's API key. The required nonce token is exposed to all authenticated frontend users, making exploitation trivial. This can lead to financial loss due to depletion of AI API credits.
Cozy Blocks – Website Builder for WordPress Block Editor plugin versions up to 2.2.27 are vulnerable to stored cross-site scripting (XSS) via the productRating.iconColor parameter. This vulnerability allows authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages. The issue occurs only when the productRating option is enabled and the associated WooCommerce product has a non-zero rating.
The PayPal Brasil para WooCommerce WordPress plugin versions up to 1.7.8 contain an authorization bypass vulnerability. This flaw allows unauthenticated attackers to enable or disable the PayPal Brasil BCDC payment gateway and modify its WooCommerce settings, potentially removing PayPal as a payment option for all customers.
The s2Member WordPress plugin is vulnerable to a stored cross-site scripting (XSS) flaw via the 'date_format' parameter in all versions up to and including 261011. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, allowing payloads that bypass WordPress's wp_kses_post() filter by using backslash-escaped sequences that PHP's date() function converts into HTML tags at render time.
The DesignSetGo WordPress plugin up to version 2.11.0 is vulnerable to stored cross-site scripting (XSS) via the 'tagName' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that become active when an administrator runs the plugin's block-conversion migration. Exploitation requires administrative action to activate the payload, preventing attackers from triggering the vulnerability independently.
The Travelly – Tour & Travel Booking Manager plugin for WooCommerce versions up to 2.3.6 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper sanitization and escaping of user-supplied shortcode attributes ('width', 'height', and 'zoom') in the [ttbm-hotel-map] shortcode. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages.
The UiChemy plugin for WordPress versions up to 5.3.0 contains a stored cross-site scripting (XSS) vulnerability. Authenticated users with contributor-level access or higher can inject malicious scripts via a specific URL parameter. The injected script executes when a privileged user clicks the crafted link, potentially compromising the site.