The WP Visitor Statistics (Real Time Traffic) plugin for WordPress versions up to and including 8.8 contains an SQL Injection vulnerability via the 'from' and related shortcode attributes in the [wsm_showTrafficStatsList] shortcode. This vulnerability arises from insufficient sanitization of user-supplied shortcode attributes, allowing authenticated users with Contributor-level access or higher to inject malicious SQL queries. The flaw enables attackers to extract sensitive database information without requiring UI interaction.
The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.10.2. This vulnerability arises from insufficient input sanitization and output escaping of certain parameters, allowing authenticated users with contributor-level access or higher to inject malicious scripts. These scripts execute whenever a user accesses the affected page, potentially compromising user data or session integrity.
The AI ChatBot for WooCommerce – WoowBot plugin for WordPress up to version 5.0.0 contains an authorization bypass vulnerability. This flaw allows authenticated users with subscriber-level access or higher to trigger repeated RAG document sync operations that consume paid AI API credits from the site administrator's stored key. The vulnerability arises because the plugin does not properly verify user authorization and exposes a required nonce to all authenticated frontend users, enabling trivial exploitation.
Database backups created by AXIS Camera Station Pro prior to the patched version are vulnerable to offline attacks, potentially exposing sensitive credentials. When the software is updated, it automatically creates an additional backup that is also vulnerable. Users should delete all vulnerable backups and change stored credentials to mitigate risk.
The Advanced Custom Fields: Extended plugin for WordPress versions up to 0.9.2.7 contains multiple AJAX handlers accessible to unauthenticated users that lack proper authorization checks. These handlers expose cryptographic nonces generated for guest users, which are publicly visible on frontend pages using ACF forms. This allows attackers to bypass WordPress visibility permissions and access unauthorized data such as post titles and internal layout structures. A partial patch was introduced in version 0.9.2.4.
The VikRentCar Car Rental Management System plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'className' parameter in all versions up to and including 1.4.10. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because input sanitization and output escaping are insufficient, allowing payloads to break out of HTML attribute contexts despite the use of wp_kses_post() at save time.
The WP Inventory Manager plugin for WordPress versions up to and including 2.5.5 contains a time-based SQL Injection vulnerability via the 'sort_order' shortcode attribute. This flaw allows authenticated users with contributor-level access or higher to inject additional SQL queries due to insufficient escaping and preparation of the 'sort_order' parameter. Exploitation can occur through the [wpinventory_categories] shortcode in a draft post preview without needing the post to be published.
The Rich Showcase for Google Reviews WordPress plugin up to version 7.1.6 contains an authorization bypass vulnerability. This flaw allows authenticated users with contributor-level access or higher to retrieve a sensitive site-wide authentication secret (grw_auth_code). The secret can be used to impersonate the WordPress site to the plugin's backend service, potentially leading to unauthorized actions. The vulnerability is identified as CVE-2026-110020 and has a CVSS score of 6.5 (medium severity).
The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 3.1.8. This vulnerability arises from insufficient input sanitization and output escaping of the 'fields[section][fields][row][col][type]' parameter. Authenticated users with shop manager-level access or higher can exploit this flaw to inject malicious scripts that execute when other users view the affected pages.
The Innovative Form Builder – IvyForms plugin for WordPress versions up to 1.5.1 contains an arbitrary file upload vulnerability. This flaw arises from insufficient file type validation and deliberate override of WordPress's native MIME and extension checks, allowing authenticated users with custom-level access to upload potentially executable files. Attackers can configure a form to accept dangerous file extensions like PHP, enabling unauthenticated users to upload malicious files via a public REST endpoint, potentially leading to remote code execution.
The UiChemy WordPress plugin, which converts Figma, prompts, and AI builds to Elementor, Gutenberg, and Bricks, is vulnerable to stored cross-site scripting (XSS) in all versions up to and including 5.3.0. The vulnerability arises from insufficient input sanitization and output escaping of a specific URL parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when privileged users interact with the injected content. Exploitation requires a privileged user to click the crafted link, triggering the malicious JavaScript payload.
The Related Posts for WordPress plugin (up to version 3.0.0) has a vulnerability that allows authenticated users with contributor-level access or higher to view titles and publication dates of all private posts across the site. This exposure occurs because the plugin's authorization checks are insufficient, permitting contributors to bypass intended restrictions that normally limit access to editors and above.
The Mage Eventpress plugin for WordPress versions up to and including 5.7.8 contains a privilege escalation vulnerability. This flaw arises from the mep_grant_shop_manager_access() function, which improperly grants the manage_options capability when certain request parameters match specific patterns, without validating them against registered EventPress screens. Authenticated users with Shop Manager-level access or higher can exploit this by appending crafted query parameters to admin URLs, thereby elevating their privileges to Administrator.
The Cozy Blocks plugin for WordPress, used for building websites with the WordPress Block Editor and integrating Gutenberg blocks, is vulnerable to stored cross-site scripting (XSS) via the 'productRating.iconColor' parameter. This vulnerability affects all versions up to and including 2.2.27. It allows authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages. The vulnerability is triggered only when the productRating feature is enabled and the WooCommerce product has a non-zero rating.
The Cozy Blocks plugin for WordPress Block Editor (Gutenberg) versions up to and including 2.2.27 is vulnerable to stored cross-site scripting (XSS) via the 'content' block attribute parameters related to icon.view, icon.layout, and icon.gap. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping, as wp_kses_post does not neutralize certain quote-only attribute-breakout payloads lacking '<' characters, leaving exploitable JSON attributes intact at render time.
The Related Posts for WordPress plugin (up to version 3.0.0) has a vulnerability that allows authenticated users with Contributor-level access or higher to read titles of non-public posts authored by others. This occurs because the plugin fails to properly verify read permissions on child post IDs when linking posts, exposing titles of drafts, pending, private, future, or trashed posts in the editor meta box.
The Tour Booking Manager plugin for WordPress versions up to and including 2.3.6 is vulnerable to stored cross-site scripting (XSS) via the 'width', 'height', and 'zoom' shortcode attributes of the [ttbm-hotel-map] shortcode. This vulnerability arises from insufficient input sanitization and output escaping in the ttbm_hotel_map_shortcode() function, allowing authenticated users with contributor-level access or higher to inject arbitrary scripts that execute when the affected page is viewed.
The s2Member WordPress plugin up to version 261011 is vulnerable to stored cross-site scripting (XSS) via the 'date_format' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, allowing payloads that bypass WordPress's wp_kses_post() filter by using backslash-escaped sequences that PHP's date() function converts into HTML tags at render time.
The easy.jobs WordPress plugin up to version 2.8.2 contains a stored cross-site scripting (XSS) vulnerability in the 'icon' attribute of its Gutenberg block. This flaw allows authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.
The Hustle plugin for WordPress, used for email marketing and lead generation, contains a stored cross-site scripting (XSS) vulnerability in the 'content[title]' parameter. This affects all versions up to and including 7.8.14.3. The flaw arises from insufficient input sanitization and output escaping, allowing authenticated users with custom-level access and the 'Create and Update Modules' capability to inject malicious scripts. This capability is not granted by default and must be explicitly assigned by an administrator via the plugin's permissions settings.