CVE-2026-103693 is a vulnerability in the Frontend Dashboard and ProfileGrid WordPress plugins that allows unauthenticated users to store serialized PHP objects in user metadata. These objects are deserialized when a public profile is viewed, enabling PHP object injection. This flaw can lead to arbitrary file writes and potentially remote code execution. Fixed versions are 3.0.5 for Frontend Dashboard and 6.0.0.5 for ProfileGrid.
LetterPress WordPress plugin versions before 2.4.0 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization and escaping of certain settings. This flaw allows high privilege users, such as administrators, to inject malicious scripts even when the unfiltered_html capability is disabled, for example in multisite environments. The vulnerability is fixed in version 2.4.0.
The vTables WordPress plugin versions before 0.3 contain a SQL injection vulnerability due to improper sanitization and escaping of a parameter used in SQL statements. This flaw allows unauthenticated attackers to perform SQL injection attacks and extract data from the database. The issue is fixed in version 0.3.
PAYCOMET for WooCommerce versions from 5.36 up to but not including 5.46 contain an authentication flaw where the plugin does not verify the cryptographic signature on payment notification requests related to tokenisation. This allows unauthenticated attackers to overwrite stored payment tokens for existing orders and delete saved card records. The issue is fixed in version 5.46.
A vulnerability in the Link Library WordPress plugin before version 7.10.0 allows unauthenticated users to access sensitive information such as telephone numbers, email addresses, and submitter names. This occurs because the plugin does not verify that a requested link belongs to the settings set whose display template is used to render it, bypassing configured display restrictions.
The Link Library WordPress plugin before version 7.10.0 contains a missing authorization vulnerability. It does not properly verify the login requirement of the selected library when processing front-end link submissions. This flaw allows unauthenticated users to submit links to libraries that are configured to require login by reusing a form token from another library that does not require login.
A missing authorization vulnerability exists in the Contact Form by Supsystic WordPress plugin before version 1.11.1. This flaw allows unauthenticated attackers to delete stored form statistics via an unrestricted AJAX action.
The Contact Form by Supsystic WordPress plugin before version 1.11.1 contains a server-side template injection vulnerability. This flaw allows an administrator to inject and execute arbitrary code on the server via the form template engine. The injected code executes whenever a visitor loads a page with the vulnerable form, enabling unauthenticated visitors to potentially read sensitive server-side information such as authentication salts and database credentials.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Contact Form by Supsystic WordPress plugin before version 1.11.1. The flaw allows attackers to trick logged-in administrators into performing unauthorized bulk deletion of captured form submissions and wiping of form statistics. This can result in permanent loss of stored contact leads and analytics data.
Contact Form by Supsystic WordPress plugin versions before 1.11.1 have a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows an attacker to overwrite the site's outbound mail settings, including SMTP server details and notification recipients, by tricking a logged-in administrator into visiting a malicious page. The vulnerability is fixed in version 1.11.1.
The Recipe Card Blocks Lite WordPress plugin versions from 2.6.4 up to but not including 3.6.4 contain a vulnerability where unauthenticated users can access sensitive information from unpublished posts. This occurs because the plugin does not perform proper authorization checks before rendering posts via its recipe print feature, exposing titles, IDs, and recipe content of drafts, pending, private, and password-protected posts. The optional protection to print only published posts is ineffective due to a logic flaw in the status check.
The Password Protected WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the Freemius SDK's purchase-completion handler in versions up to 2.8.4. Authenticated users with subscriber-level access or higher can inject malicious scripts through the 'purchased_plan' parameter, which are then stored and executed when an administrator views admin pages. This occurs due to insufficient input sanitization and output escaping in the plugin's handling of this parameter.
Node Version Manager (nvm) versions 0.31.2 through 0.40.5 contain an OS command injection vulnerability in the nvm_ls function. This occurs because version strings with '#' characters can prematurely close a sed address, allowing execution of arbitrary shell commands via GNU sed's 'e' command or BSD sed's 'w' and 'r' commands. This vulnerability can be triggered by attacker-controlled version strings passed to various nvm commands or environment variables, and is exploitable when at least one version is installed. Version 0.40.6 fixes this issue by filtering version patterns containing '#' or newlines before they reach the vulnerable sed command.
The Wild Apricot Login plugin for WordPress versions up to 1.0.18 contains an authentication bypass vulnerability via SSO email-collision account binding. Attackers controlling a Wild Apricot contact with an email matching a WordPress administrator can authenticate as that administrator without proof of account ownership. This allows issuance of a valid network-wide authentication cookie on WordPress Multisite networks, granting administrator access across subsites.
SSL Wireless SMS Notification for WordPress versions up to and including 3.8.1 contains an authentication bypass vulnerability. The flaw allows unauthenticated attackers who know a phone-linked user's number to take over that account by exploiting improper verification in the login process. The vulnerability arises because the final login step matches user sessions based solely on attacker-controlled data without verifying the SMS OTP or server-side state.
The Schema App Structured Data plugin for WordPress up to version 2.3.2 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient input sanitization and output escaping in the 'Remove Microdata' output filter. An unauthenticated attacker can inject malicious scripts via comment content, which execute when users view the affected pages. Exploitation requires that an administrator has enabled the 'Remove Microdata' option and approved the malicious comment.
The Social Web Suite – Social Media Auto Post, Social Media Auto Publish WordPress plugin versions up to 4.1.12 contains a SQL Injection vulnerability via the 'exclude_posts' parameter. This flaw allows unauthenticated attackers to inject arbitrary SQL queries due to insufficient input escaping and query preparation. Additionally, the HMAC authentication protecting the endpoint can be bypassed on fresh installations before the administrator visits the settings page, as the secret key is not yet generated, enabling attackers to compute valid tokens. The vulnerability has a high severity score of 7.5 CVSS v3.1.
The SendPress Newsletters plugin for WordPress contains a time-based SQL Injection vulnerability in the 'subscriberid' parameter affecting all versions up to 1.26.1.20. This flaw allows unauthenticated attackers to inject additional SQL queries due to insufficient input escaping and ineffective nonce protection. The nonce uses a hardcoded action value that is publicly accessible, enabling attackers to bypass access controls and potentially extract sensitive database information.
The Food Store – Online Food Delivery & Pickup WordPress plugin up to version 1.5.5 is vulnerable to a stored cross-site scripting (XSS) flaw via the 'service_type' cookie. An unauthenticated attacker can inject malicious scripts by supplying a crafted payload through the public checkout page's ?type= query parameter. This payload is stored in the cookie, persisted in order metadata, and rendered without proper escaping in the admin panel, leading to script execution when accessed.
The DSGVO All in one for WP WordPress plugin up to version 5.0 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient input sanitization and output escaping in comment content when certain plugin options are enabled. Specifically, exploitation requires the administrator to have enabled both the 'Google Tag Manager' integration and the 'Replace integration automatically [Beta]' option, and the malicious comment must be approved by an administrator. Successful exploitation allows unauthenticated attackers to inject arbitrary scripts that execute in users' browsers when they visit the affected pages.