SEOPress – AI SEO Plugin & On-site SEO for WordPress versions up to 10.3 is vulnerable to stored Cross-Site Scripting (XSS) via the 'display_name' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view affected pages. The vulnerability arises because the plugin substitutes a token in display names after escaping, allowing script injection through crafted display names containing the %%archive_title%% token and HTML event handlers.
The Uncanny Toolkit for LearnDash WordPress plugin versions up to 3.8.2 contains an authentication bypass vulnerability via the email parameter in the uo_login_action() function. This flaw allows unauthenticated attackers to bypass account verification and suspension controls by exploiting a discrepancy in how the plugin and WordPress core sanitize the email input. Attackers with valid credentials for a target account can obtain a valid session cookie without proper approval, enabling unauthorized access. The required nonce for exploitation is publicly accessible, making the attack trivial for anyone with network access and knowledge of the credentials.
The Shield Security plugin for WordPress, up to version 22.3.2, contains a stored cross-site scripting (XSS) vulnerability via the 'REQUEST_URI' parameter. This vulnerability arises from insufficient input sanitization and output escaping in a hidden 'path' column rendered by DataTables using innerHTML, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. A partial fix in version 18.5.8 addressed escaping in a visible column but left the hidden 'path' field vulnerable through version 22.2.6.
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps WordPress plugin versions up to 5.5.88 contains a missing authorization vulnerability. This flaw allows unauthenticated attackers to access sensitive information via the 'rel_tab' parameter if an administrator has published an app with REST API authorization set to 'anonymous'. Exploitation can expose all rows and columns of the underlying database tables, including sensitive user data such as password hashes, email addresses, and password-reset keys from the wp_users table.
A stored cross-site scripting (XSS) vulnerability exists in the PublishPress Authors plugin for WordPress, specifically in the Co-Authors, Multiple Authors and Guest Authors in an Author Box component. The flaw affects all versions up to and including 4.17.0 and allows authenticated users with subscriber-level access or higher to inject malicious scripts via the 'name' parameter. Exploitation requires the attacker to have a mapped author term, which is assigned by an administrator or created automatically for their role. This vulnerability can lead to script execution in the context of users visiting the affected pages.
The Rox Appointment Booking plugin for WordPress up to version 1.3.1 contains a privilege escalation vulnerability via mass assignment. An unauthenticated attacker can inject an arbitrary WordPress user ID into a customer record through a public REST endpoint. If an administrator later opens and updates this poisoned record, the attacker's supplied user ID and email are used to update the administrator's account, enabling full account takeover via password reset. Exploitation requires the attacker to know or guess a valid administrator user ID and for an administrator to interact with the malicious record.
The Product Filter for WooCommerce by WBW plugin for WordPress versions up to 3.4.6 contains a missing authorization vulnerability. This flaw allows unauthenticated attackers to manipulate the 'filterSettings[default_query]' parameter in the 'filtersFrontend' AJAX action, bypassing capability and nonce checks. As a result, attackers can enumerate non-public WooCommerce products, including drafts and pending items, and retrieve their count and rendered listings. The vulnerability also permits unbounded queries that can load all products in a single request.
The Hustle plugin for WordPress up to version 7.8.14.3 has an authorization bypass vulnerability. Authenticated users with the hustle_create capability can overwrite the site's active email service provider (ESP) integration credentials, redirecting lead submissions to an attacker-controlled ESP account. For HubSpot integrations, attackers can also irreversibly delete critical OAuth tokens and options. This flaw arises from improper authorization checks in the plugin's handlers.
The Welcart e-Commerce WordPress plugin up to version 2.12.5 contains an improper authentication vulnerability via the 'member[ID]' parameter. This flaw allows unauthenticated attackers to overwrite any shop member's email and password by supplying the member's numeric ID, enabling full account takeover. Exploitation requires bypassing a wp_verify_nonce() check, but the nonce is exposed to unauthenticated visitors on the New Enrollment Form, making exploitation feasible without prior authentication or special configuration.
The Shipping Zones by Drawing for WooCommerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to and including 3.3.0. This flaw arises from improper sanitization and validation of the 'szbd-picked' checkout parameter, allowing unauthenticated attackers to inject malicious attributes into the Google Maps link shown in the WooCommerce admin order view. The vulnerability can lead to arbitrary script execution when an administrator views the injected order.
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress versions up to 5.16.5 is vulnerable to sensitive information exposure. An unauthenticated attacker can exploit the 'invoice_number' parameter to obtain complete invoice PDFs of other customers, including personal and order details. Exploitation requires the plugin's yearly invoice number reset feature to be enabled and timing conditions involving guest-checkout orders within 60 seconds. The vulnerability has a medium severity rating with a CVSS score of 5.3.
The VikRentCar Car Rental Management System WordPress plugin up to version 1.4.10 is vulnerable to stored Cross-Site Scripting (XSS) via the 'optionals' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.
The Photo Reviews for WooCommerce WordPress plugin (Revopic) up to version 1.2.31 contains a path traversal vulnerability that allows unauthenticated attackers to delete any media library attachment file. This occurs because the plugin's delete_reviews_image() function trusts attachment IDs from a public nonce parameter without verifying ownership or user capabilities. Attackers can embed malicious attachment IDs in review comments and cause permanent deletion when a moderator removes the review or the WordPress scheduled delete cron runs.
The WP Booking System - Booking Calendar WordPress plugin versions up to 2.1.0.5 contains a missing authorization vulnerability. This flaw allows authenticated users with Subscriber-level access or higher to delete arbitrary calendar notes belonging to any calendar. The vulnerability arises from the lack of a capability check in the wpbs_action_ajax_calendar_remove_note() function.
Welcart e-Commerce plugin for WordPress versions up to 2.12.5 is vulnerable to stored Cross-Site Scripting (XSS) via the 'gid' parameter. An unauthenticated attacker can inject malicious scripts by forging a ROBOT PAYMENT browser-return request, which stores the payload in order metadata. The script executes when an administrator views the infected order in the WordPress admin panel.
The VikRentCar Car Rental Management System WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability via the 'poplink' parameter in versions up to and including 1.4.9. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. The attack is facilitated by a WordPress nonce token that is accessible to unauthenticated visitors, enabling exploitation without an account.
The PDF Invoices & Packing Slips for WooCommerce WordPress plugin is affected by a stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 5.16.4. The flaw arises from insufficient input sanitization and output escaping of certain billing and customer note parameters. An incomplete fix introduced in version 5.16.2 can be bypassed using entity-encoded payloads, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user views the affected pages.
The Product Filter for WooCommerce by WBW plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability via the 'wpf_fid' JSON parameter in all versions up to and including 3.4.6. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link. The issue persists despite a partial patch in version 3.4.3, as the sanitization was incomplete.
UsersWP plugin for WordPress versions up to 1.2.78 contains an improper authentication vulnerability due to predictable passwords for built-in dummy user accounts. The shared password is derived from a hash partially exposed in a hidden form field accessible without authentication, allowing attackers to recover the password and log in as any dummy user. Exploitation requires prior creation of dummy users by an administrator. This can lead to unauthorized access and potential privilege escalation if dummy accounts have elevated roles.
The Seraphinite Accelerator plugin for WordPress up to version 2.29.24 contains a vulnerability that allows unauthenticated attackers to access sensitive user information. This occurs through the plugin's Object Cache feature, where attackers can retrieve gzip-serialized cache files containing complete WordPress user records, including usernames, emails, hashed passwords, and activation keys. Exploitation requires triggering the caching of the target user record before accessing the cache file.