The Seraphinite Accelerator plugin for WordPress up to version 2.29.24 contains a vulnerability that allows unauthenticated attackers to access sensitive user information. This occurs through the plugin's Object Cache feature, where attackers can retrieve gzip-serialized cache files containing complete WordPress user records, including usernames, emails, hashed passwords, and activation keys. Exploitation requires triggering the caching of the target user record before accessing the cache file.
The User Submitted Posts plugin for WordPress has a stored DOM-based cross-site scripting (XSS) vulnerability in the 'user-submitted-content' parameter affecting all versions up to and including 20260916. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view the injected content. By default, submitted posts require admin approval before becoming visible, limiting exposure. However, if the plugin's 'publish immediately' option is enabled, the malicious content is published without moderation, increasing risk.
The Discussion Board – WordPress Forum Plugin up to version 2.6.0 is vulnerable to a stored Cross-Site Scripting (XSS) flaw via the user profile Website (user_url) field. This vulnerability arises from insufficient output escaping in the plugin's handling of the user_url value, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. These scripts execute when any user views a Discussion Board topic containing the attacker's reply.
The Mail logging & Catcher plugin for WordPress up to version 2.2.0 has a vulnerability that allows authenticated users with subscriber-level access or higher to extract administrator password-reset keys from stored email logs. This vulnerability arises if the plugin's default_view_role setting is configured to allow low-privileged users to view logs, enabling privilege escalation to administrator by completing the password-reset flow.
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website plugin for WordPress versions up to 2.7.0 is vulnerable to stored Cross-Site Scripting (XSS) via the 'degreetitle' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The plugin’s self-registration allows any visitor to create a subscriber-backed employer account, enabling broad exploitability.
The Relevanssi – A Better Search WordPress plugin is vulnerable to a stored cross-site scripting (XSS) flaw via the 'comment' parameter in versions up to and including 4.28.5. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users visit a page accessed through a Relevanssi search-result permalink with the highlight query parameter. The exploit requires both comment indexing and comment highlighting features to be enabled.
The ThirstyAffiliates WordPress plugin up to version 3.12.1 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the site to use block themes where comment content is processed through a specific rendering function, and the attacker must have one prior approved comment to enable auto-approval of subsequent crafted comments. The vulnerability has a high severity rating with a CVSS score of 7.2.
The W3 Total Cache WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in all versions up to and including 2.10.7. This flaw arises from insufficient input sanitization and output escaping of the 'comment' parameter when HTML Minify is enabled with the default 'mfunc' entry in the ignored-comment stems list. Exploitation requires an attacker to predict a dynamic placeholder namespace based on the server time, which can be inferred from the HTTP Date header. Successful exploitation allows unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the affected pages.
SureCart, a WordPress plugin for ecommerce, is affected by a stored cross-site scripting (XSS) vulnerability in versions up to and including 4.9.4. The flaw arises from insufficient sanitization and escaping of the 'comment' parameter, allowing unauthenticated attackers to inject malicious scripts. These scripts execute when a user views a page containing SureCart's web-component bundle with an injected comment that is auto-approved or moderator-approved.
The FunnelKit Automations plugin for WordPress and WooCommerce versions up to 3.8.5.2 is vulnerable to a time-based SQL Injection via the 'bwfan_cart_id' parameter. This vulnerability allows unauthenticated attackers to inject SQL queries during a guest Store API checkout, potentially extracting sensitive database information. The injection triggers later when a scheduled job processes the stored data upon order status changes.
The PDF Invoice for WooCommerce + Drag and Drop Template Builder WordPress plugin versions up to 7.1.1 is vulnerable to PHP Object Injection via the 'customer_note' parameter. This vulnerability arises from insufficient sanitization of user input, allowing unauthenticated attackers to execute arbitrary code on the server by exploiting the invoice generation process triggered during checkout.
Popup Builder WordPress plugin versions up to 4.4.5 suffer from an authorization bypass vulnerability. This flaw allows unauthenticated attackers to trash all published popups on a site via a single crafted GET request. The issue is worsened by a secondary flaw in the plugin's SGPopup::find() function, which causes all published popups to be targeted simultaneously when a specific parameter is present.
The Webmention plugin for WordPress up to version 5.10.1 is vulnerable to a stored cross-site scripting (XSS) flaw via the Open Graph og:title meta tag of a webmention source URL. This vulnerability arises from insufficient input sanitization, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user views the affected page after an administrator approves the pending webmention comment. Exploitation requires administrator action to approve the comment containing the malicious payload.
The W3 Total Cache WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in versions up to and including 2.10.7. This vulnerability arises from insufficient sanitization and escaping of the 'comment' parameter, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires a previously active Pro license with REST caching enabled that has since become inactive, while Disk Enhanced page caching remains configured, and the attacker must have a previously approved commenter identity.
The Payable Payment Gateway for WooCommerce WordPress plugin versions before 1.3.1 fails to verify the authenticity of incoming payment notifications. This flaw allows unauthenticated attackers to alter the payment status of any order in the store, regardless of the payment method used.
WordPress Core versions 4.7 through 7.1.3 contain a remote code execution vulnerability due to predictable, web-accessible staging paths during full-package core upgrades. This flaw allows unauthenticated attackers to execute code on the server during the upgrade window.
The Quick Event Manager WordPress plugin versions before 9.19 have a vulnerability where the plugin does not verify the status or type of posts before returning their details in a calendar export. This flaw allows unauthenticated users to access the content of draft and private posts.
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress contains a vulnerability that allows unauthenticated attackers to delete theme files on the server. This is due to insufficient file path validation in the '__construct' function affecting all versions up to and including 2.20.4.
The Mapster WP Maps WordPress plugin versions prior to 2.0.6 contain a vulnerability where a REST API route that modifies post data lacks authorization checks. This flaw allows unauthenticated attackers to overwrite post titles, create new published posts, and alter the plugin's stored settings.
The Firelight Lightbox WordPress plugin versions before 2.3.24 improperly escape image attribute values, allowing users with contributor-level access or higher to inject arbitrary web scripts. These scripts execute when other users view or preview the affected content, leading to a cross-site scripting (XSS) vulnerability.