The Forminator Forms plugin for WordPress versions up to and including 1.55.0.2 contains a vulnerability that allows unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory. This occurs because the plugin accepts arbitrary upload field metadata from POST requests in draft submissions without proper validation, which can be exploited via the previous_draft_id parameter referencing a manipulated draft.
The Content Egg plugin for WordPress up to version 12.0.0 contains an authorization bypass vulnerability. Authenticated users with author-level access or higher can exploit this flaw to create posts attributed to other users, including administrators, by manipulating the preset_id parameter. This allows lower-privileged users to create published posts under an administrator's name if they have the publish_posts capability for the relevant post type.
The Fraud Prevention For WooCommerce and EDD WordPress plugin versions before 2.3.6 lack proper authorization checks when adding customer details to the fraud blacklist. This flaw allows users with the Subscriber role and above to add arbitrary legitimate customers to the fraud blacklist, potentially blocking them from placing orders.
The BuddyForms WordPress plugin versions before 2.10.1 contain a vulnerability where the plugin does not verify that a user editing an existing entry is the original author. This flaw allows users with edit access to a form, including those with low privileges such as Subscriber, to overwrite the title, content, and status of posts or pages authored by other users, including administrators.
The JoomSport plugin for WordPress (up to and including version 5.7.14) contains a SQL Injection vulnerability via the 'pgroup' parameter. This flaw allows authenticated users with contributor-level access or higher to inject additional SQL queries by exploiting insufficient escaping and preparation of the SQL statement. The vulnerability can be triggered by embedding a malicious 'pgroup' value in the [jsMatchPlayerList] shortcode within a post preview, enabling extraction of sensitive database information.
A vulnerability in The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before version 2.191 allows non-super-admin administrators, including subsite administrators on multisite installations, to access the File System Watcher file viewer without proper restrictions. This exposure enables them to read sensitive tracked files such as the main configuration file, disclosing authentication keys, salts, and database credentials.
The WP Visitor Statistics (Real Time Traffic) WordPress plugin versions before 8.8 contain a vulnerability where tracking data from public visitor requests is not properly sanitized or escaped. This flaw allows unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the statistics dashboard.
The Joinchat WordPress plugin versions prior to 6.4.2 contain a vulnerability where the message of its button block is not properly escaped before being output in an HTML attribute on the front end. This flaw allows users with Author role or higher to execute stored cross-site scripting (XSS) attacks against visitors of the post, including administrators.
A vulnerability in The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin versions prior to 2.191 allows bypassing password verification during login when using two-factor authentication. An attacker possessing a valid current authenticator app code can log in as any user, including administrators, without needing the account password.
A vulnerability in the BuddyForms WordPress plugin versions prior to 2.10.3 allows unauthenticated users to export and download the configuration of any form without proper authorization checks. This exposure includes sensitive data such as notification recipient email addresses and reCAPTCHA secret keys that are not publicly visible on the form.
The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress contains a stored DOM-based cross-site scripting (XSS) vulnerability in the '_elementor_data.form_fields[].custom_id' parameter. This affects all versions up to and including 2.7.9. The flaw arises from insufficient input sanitization and output escaping, allowing authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages. The vulnerability bypasses the esc_html() sanitization due to the way the plugin's frontend script processes HTML fragments with jQuery.
The Content Egg plugin for WordPress versions up to and including 12.0.0 has a vulnerability that allows authenticated users with contributor-level access or higher to modify product data on arbitrary posts. This is due to a missing per-post capability check in the ajaxUpdateProducts() function, which trusts the attacker-supplied post ID without verifying if the user has edit rights for that specific post. The flaw enables unauthorized modification of Content Egg product metadata and update timestamps on posts, including those owned by administrators.
The User Frontend WordPress plugin versions before 4.3.14 contain a reflected cross-site scripting (XSS) vulnerability. This occurs because some user-supplied values are not properly sanitized or escaped before being reflected in HTML attributes in an AJAX response accessible to the public. The vulnerable action is protected by a nonce that only validates for logged-out users, so the XSS payload executes against visitors who are not authenticated.
The Enable Media Replace WordPress plugin versions before 4.2.3 contain a vulnerability where deserialization of stored metadata does not restrict allowed classes. This flaw allows unauthenticated attackers to inject PHP objects that are instantiated during media replacement by users with upload access, leading to PHP Object Injection and local file inclusion. The vulnerability can escalate to remote code execution if an attacker-controlled PHP or HTML file exists on the server. This issue is a regression of CVE-2023-4643, which was fixed in version 4.1.3 but reintroduced in 4.1.4.
The Events Made Easy WordPress plugin up to version 3.3.1 contains a stored cross-site scripting (XSS) vulnerability via the 'width' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages.
The Firelight Lightbox WordPress plugin versions prior to 2.3.23 do not properly escape URLs in links opened by its Classic lightbox feature. This vulnerability allows users with Contributor-level permissions to inject stored cross-site scripting (XSS) payloads that execute when other users click crafted links.
The Page and Post Restriction plugin for WordPress up to version 1.6.1 is vulnerable to an authentication bypass via its REST API. The vulnerability arises because the plugin re-authenticates users from the wordpress_logged_in cookie on GET or HEAD REST requests without verifying a REST nonce, bypassing WordPress core's nonce protections. This allows an attacker to read restricted REST API data as if they were a logged-in user by tricking a victim into visiting a malicious page that issues cross-origin credentialed fetch requests. The exposed data includes role-restricted and private post/page content, user profile information, and authorized comments.
A vulnerability in glib-networking affects the client-side TLS 1.3 session cache, which does not limit the number of session tickets retained per host. A malicious server can exploit this by sending excessive session ticket messages, causing unbounded memory growth on the client and leading to a denial of service (DoS) due to memory exhaustion. No mitigation or patch currently meets Red Hat's criteria for deployment.
An Incorrect Authorization vulnerability in the Drupal Field Permissions module allows unauthorized users to perform forceful browsing. This affects versions from 0.0.0 up to 1.6.0 of the module. No CVSS score or patch information is currently available.
A vulnerability in the Drupal S3 File System module allows incorrect permission assignment for critical resources, leading to improperly configured access control security levels. This affects versions from 0.0.0 up to 3.12.0. No CVSS score or detailed impact information is provided.