The Copy Anything to Clipboard for WordPress plugin versions before 5.5.5 contains a vulnerability where a shortcode attribute is not properly sanitized and escaped before being stored and rendered via client-side script. This flaw allows users with contributor role or higher to execute stored cross-site scripting (XSS) attacks against users with higher privileges who view or interact with the affected content.
The Persian WooCommerce SMS WordPress plugin versions before 7.3.2 contain a reflected cross-site scripting (XSS) vulnerability. This occurs because the plugin does not properly sanitize and escape a parameter before reflecting it into an HTML attribute. The vulnerability can be exploited when a logged-in privileged user is tricked into submitting a crafted cross-site request, leading to script execution in their browser session.
The Royal Addons for Elementor WordPress plugin versions before 1.7.1070 contain a vulnerability where the email delivery configuration for contact forms is stored in a site-global namespace keyed by a non-secret identifier. This allows users with the Author role or higher to overwrite another user's form email configuration, potentially redirecting form submissions to an attacker-controlled email address.
The Customer Email Verification plugin for WooCommerce on WordPress has an authentication bypass vulnerability in all versions up to 2.8.2. The flaw arises from a predictable email verification token and lack of proper capability or nonce checks in the authentication function. This allows unauthenticated attackers to log in as verified customers or mark existing accounts as verified, bypassing email verification controls. Exploitation depends on the presence of a password column in a specific database table, which exists only on upgraded sites from older versions.
The MP3 Audio Player WordPress plugin versions before 5.16 contain a vulnerability where one of its audio player shortcode attributes is not properly escaped before being output into an HTML attribute. This flaw allows users with Contributor-level access or higher to inject arbitrary JavaScript code. The injected script executes when another user, such as an administrator previewing a pending post, views the content.
The WPOrLogin WordPress plugin versions before 3.1.0 lack capability checks and nonce validation when updating hidden-login URL settings. This vulnerability allows unauthenticated attackers to change login, registration, and password-recovery slugs, potentially locking out administrators from the login interface.
The Essential Addons for Elementor WordPress plugin versions before 6.8.7 contain a vulnerability that allows unauthenticated visitors to bypass restrictions on post type and meta queries to the pagination endpoint. This flaw could enable attackers to access content from non-public post types and retrieve values of private custom fields on published posts.
The Media Library Assistant WordPress plugin versions before 3.42 have a vulnerability where the Empty Trash media action does not verify a CSRF nonce. This allows a cross-site request forgery attack to cause a logged-in user with Editor role or higher to permanently delete all trashed media attachments on the site.
The Royal MCP WordPress plugin versions before 1.5.10 have a vulnerability where the plugin does not perform an object-level permission check before duplicating a requested page. This flaw allows users with contributor-level access to read the full content of any private or draft page and publish it without having the publish capability.
The GoSMTP WordPress plugin versions before 1.2.5 lack an authorization check on the SMTP configuration page, allowing users with roles below administrator to modify outbound mail settings. This vulnerability can lead to administrator account takeover.
The GeoDirectory WordPress plugin versions before 2.8.196 contain a vulnerability where a post badge shortcode attribute is not properly escaped in a JavaScript context. This flaw allows users with Contributor role or higher to execute Stored Cross-Site Scripting (XSS) attacks against anyone who clicks the badge, including administrators.
A vulnerability in the GeoDirectory WordPress plugin before version 2.8.195 allows users with Contributor role and above to view content and custom fields of other users' draft, pending, private, and trashed listings. This occurs because the plugin does not perform status or ownership checks when rendering listings referenced by an id attribute in its field shortcodes.
The Welcart e-Commerce WordPress plugin versions prior to 2.12.6 contain an authorization flaw that allows any authenticated user with Author-level access or higher to manipulate SKU data of any product. This includes reading, modifying, creating, deleting, and re-ordering SKU information such as prices, confidential cost prices, and stock levels, even for products owned by other users.
The Royal MCP WordPress plugin versions before 1.5.10 lack proper object-level and post-type authorization checks in one of its search tools. This vulnerability allows authenticated users with low privileges, such as subscribers, to access the title and content of non-public entries, potentially exposing personal data stored by the plugin.
The Royal Addons for Elementor WordPress plugin versions before 1.7.1070 contain a vulnerability in a map widget's size setting that is not properly sanitized or escaped. This flaw allows users with Contributor role or higher to inject JavaScript code that executes in the browsers of users viewing the affected page, including administrators reviewing submissions.
The Page Builder by SiteOrigin WordPress plugin versions before 2.38.0 have a vulnerability in the Post Loop widget that allows users with contributor role or higher to access draft, pending, scheduled, and private posts and pages of other users. This occurs because the plugin does not restrict query arguments or limit the loop to posts the user is authorized to read.
The Court Reservation WordPress plugin versions before 1.12.4 lack authorization, authentication, and nonce validation on one of its AJAX actions. This flaw allows unauthenticated users to add or delete reservation types in the plugin's configuration, potentially leading to unauthorized modifications.
The Thrive Automator WordPress plugin versions before 11.2 contain a vulnerability where a parameter's array key is not properly sanitized and escaped before being used in a SQL query. This flaw allows authenticated users with editor-level privileges to perform blind SQL injection attacks.
The Menu Cart for WooCommerce WordPress plugin versions before 3.2.1 contains a vulnerability where cart item variation data is not properly sanitized and escaped before being output in the cart slide-out. This allows unauthenticated users to inject Cross-Site Scripting (XSS) payloads that can execute in the session of other users, including administrators.
The Booking Package WordPress plugin versions before 1.7.33 allow unauthenticated users to trigger booking verification-code emails to arbitrary recipients without restriction or server-side binding. This can lead to abuse of the email functionality to send unsolicited templated emails.