The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'Subject' parameter used in mail-sending features. This vulnerability affects all versions up to and including 6.2 and allows unauthenticated attackers to inject malicious scripts that execute when a user views the affected page. The issue arises due to insufficient input sanitization and output escaping, particularly when OAuth authorization is not completed immediately after plugin activation.
The SEOPress AI SEO Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'display_name' parameter affecting all versions up to and including 10.3. Authenticated users with subscriber-level access or higher can inject malicious scripts via their display name, which are then executed when other users view the affected pages. This occurs due to insufficient input sanitization and output escaping in the plugin's handling of the %%archive_title%% token combined with WordPress's storage of display names without HTML filtering.
The Content Pilot plugin for WordPress versions up to and including 2.2.4 is vulnerable to stored cross-site scripting (XSS). The vulnerability arises because the plugin processes HTML meta descriptions from remotely fetched articles without proper sanitization before storing them as post content. This allows unauthenticated attackers who control RSS feed content configured in the plugin to inject malicious scripts that execute when users view the affected pages.
The WP Data Access – App Builder plugin for WordPress has a vulnerability in all versions up to 5.5.88 that allows unauthenticated attackers to extract sensitive information via the 'rel_tab' parameter. This includes database rows such as WordPress user password hashes, email addresses, and password-reset keys. Exploitation requires that an administrator has published at least one app with REST API authorization set to 'anonymous', which is the default for publicly embedded apps.
The Product Filter for WooCommerce by WBW plugin for WordPress up to version 3.4.6 has a missing authorization vulnerability in its 'filtersFrontend' AJAX action. This flaw allows unauthenticated attackers to manipulate query parameters and enumerate non-public WooCommerce products, including drafts and pending items, and to perform unbounded queries that retrieve all products in a single request.
The Redux Framework plugin for WordPress up to version 4.5.15 suffers from an authorization bypass vulnerability. This flaw allows authenticated users with subscriber-level access or higher to view sensitive configuration data, including plaintext passwords, API keys, license keys, and SMTP credentials, exposed in the inline JavaScript on the wp-admin/profile.php page. The vulnerability arises because the plugin does not properly verify user authorization for certain actions. The Users extension, which is automatically loaded for every Redux instance, causes all sites using Redux Framework to be affected regardless of explicit configuration.
The WP2LEADS WordPress plugin versions up to and including 3.5.6 contain a time-based SQL Injection vulnerability via the 'order' parameter. This flaw allows authenticated users with Subscriber-level access or higher to inject additional SQL queries due to insufficient escaping and lack of proper query preparation. Exploitation can lead to unauthorized extraction of sensitive database information.
The Product Filter for WooCommerce by WBW plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability via the 'wpf_fid' JSON parameter in all versions up to and including 3.4.6. The flaw is due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with crafted content. The vulnerability remains in versions patched at 3.4.3 because the sanitization was incomplete, leaving the JSON-decoded filterSettings payload unsanitized.
The Wp Social Login and Register Social Counter plugin for WordPress contains an authentication bypass vulnerability in all versions up to and including 3.2.2. The flaw arises because the plugin's social login REST callback endpoint allows unauthenticated attackers to log in as any existing WordPress user by presenting an OAuth provider email that matches the target user's registered email. The verification intended to confirm email authenticity is ineffective for Facebook and Twitter adapters, enabling attackers to bypass password checks and gain full authenticated sessions without local credentials or prior access.
The User Frontend WordPress plugin up to version 4.3.13 is vulnerable to reflected cross-site scripting (XSS) via the 'field_attr[required]' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. The nonce check intended to protect the AJAX action is ineffective because the nonce value is publicly accessible to anonymous visitors, enabling attackers to harvest it and bypass protections.
The Seraphinite Accelerator WordPress plugin versions up to and including 2.29.24 contain a vulnerability that allows unauthenticated attackers to access sensitive user information. This occurs through predictable gzip-serialized cache files when the plugin's Object Cache feature is enabled. Attackers can extract user data such as usernames, emails, hashed passwords, and activation keys by triggering caching of the target user record and then retrieving the cache file.
The Popup Builder WordPress plugin up to version 4.4.5 contains an authorization bypass vulnerability that allows unauthenticated attackers to trash all published popups with a single GET request. This is caused by improper authorization checks and is worsened by a logic flaw in the SGPopup::find() function, which triggers the trashing action on all popups when a specific parameter is present.
The UsersWP WordPress plugin versions up to 1.2.78 contain a vulnerability that allows unauthorized account access via predictable passwords. The plugin uses a shared password for 25 built-in dummy user accounts derived from a hash that is also exposed in a hidden form field on the public registration page and AJAX handler, even when registration is disabled. This exposure enables unauthenticated attackers to retrieve the dummy user password and log in as any dummy account, potentially escalating privileges if those accounts have elevated roles. Exploitation requires that an administrator has previously created dummy users via the plugin's Tools page.
The Rox Appointment Booking plugin for WordPress up to version 1.3.1 contains a privilege escalation vulnerability via mass assignment. An unauthenticated attacker can exploit a public REST endpoint to inject an arbitrary WordPress user ID into a customer record. When an administrator later edits and saves this record, the attacker's supplied user ID and email are used to update the administrator's account, enabling account takeover through password reset. Exploitation requires the attacker to know or guess a valid administrator user ID and for an administrator to interact with the poisoned record.
The Mail logging & Catcher plugin for WordPress versions up to and including 2.2.0 is vulnerable to sensitive information exposure via the 'message' parameter. Authenticated users with subscriber-level access or higher can extract administrator password-reset keys from stored email logs if the plugin's default_view_role setting is configured to allow low-privileged users to access logs. This vulnerability enables privilege escalation to administrator by completing the password-reset flow. By default, the plugin restricts log access to administrators only, which mitigates exploitation on untouched installs.
A stored cross-site scripting (XSS) vulnerability exists in the PublishPress Authors plugin for WordPress affecting all versions up to and including 4.17.0. The flaw is due to insufficient input sanitization and output escaping of the 'name' parameter mapped to display_name. Authenticated users with subscriber-level access or higher can exploit this by injecting malicious scripts that execute when other users view the affected pages. Exploitation requires the attacker to have a mapped author term, which occurs when assigned as a co-author or if automatic author term creation is enabled for their role. This mapping is not present by default on a stock installation.
The W3 Total Cache plugin for WordPress up to and including version 2.10.7 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping when HTML Minify is enabled with the default 'mfunc' entry in the ignored-comment stems list. Exploitation requires an attacker to predict a time-based placeholder namespace by reading the server clock from the HTTP Date header. Successful exploitation allows injection of arbitrary scripts that execute when users access the affected pages.
The Perfect Images WordPress plugin up to version 7.2.0 has a vulnerability due to a missing capability check on a REST API endpoint. This flaw allows authenticated users with Author-level access or higher to modify files they do not own via the /wp-json/wp-retina-2x/v1/replace API.
The Welcart e-Commerce plugin for WordPress up to version 2.12.5 suffers from an Insecure Direct Object Reference (IDOR) vulnerability via the 'member[ID]' parameter. This flaw allows unauthenticated attackers to overwrite any shop-member account's email and password by specifying the member's numeric ID. Exploitation requires bypassing a wp_verify_nonce() check, but the nonce is publicly available on the New Enrollment Form, enabling full account takeover without any prior authentication or special configuration.
The User Submitted Posts WordPress plugin is vulnerable to stored DOM-based cross-site scripting (XSS) via the 'user-submitted-content' parameter in all versions up to and including 20260916. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. By default, submitted posts require admin approval before becoming visible, limiting exposure. However, if the plugin's 'publish immediately' option is enabled, injected scripts become live without moderation.