The Project Manager plugin for WordPress versions up to 4.1.1 contains a critical remote code execution vulnerability via the 'id' parameter. This flaw arises because the 'id' parameter is unsanitized and directly concatenated into a validation rule string, which is then split and each token executed as a dynamic PHP function without an allowlist. Due to the way WordPress processes REST API routes, the authorization check is bypassed, allowing unauthenticated attackers to execute arbitrary code on the server.
The FunnelKit Automations plugin for WordPress and WooCommerce is vulnerable to a time-based SQL Injection via the 'bwfan_cart_id' parameter in all versions up to and including 3.8.5.2. This vulnerability allows unauthenticated attackers to inject SQL queries during a guest checkout process, potentially extracting sensitive database information. The attack requires only a publicly obtainable WooCommerce cart nonce and is executed in two steps involving a scheduled Action Scheduler job.
The WP Booking System - Booking Calendar plugin for WordPress versions up to and including 2.1.0.5 contains a vulnerability that allows authenticated users with Subscriber-level access or higher to delete arbitrary calendar notes. This is due to a missing capability check in the wpbs_action_ajax_calendar_remove_note() function, enabling unauthorized modification of data.
The ThirstyAffiliates WordPress plugin up to version 3.12.1 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the site to use block themes like Twenty Twenty-Five and that the attacker has a previously approved comment, enabling subsequent crafted comments to be auto-approved and publicly rendered.
The Relevanssi – A Better Search plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 4.28.5. This vulnerability arises from insufficient input sanitization and output escaping of the 'comment' parameter. Exploitation requires that the site has both comment indexing and comment highlighting enabled. An unauthenticated attacker can inject malicious scripts that execute when a user visits a singular page via a Relevanssi search-result permalink with the highlight query parameter.
The VikRentCar Car Rental Management System plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'poplink' parameter affecting all versions up to and including 1.4.9. This flaw allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. The vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires a WordPress nonce token (vikwp_nonce), which the plugin exposes to unauthenticated visitors on the public booking-confirmation page, enabling attackers to obtain a valid token without authentication.
The Welcart e-Commerce plugin for WordPress versions up to and including 2.12.5 is vulnerable to stored cross-site scripting (XSS) via the 'gid' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. The attack involves forging a ROBOT PAYMENT browser-return request to store a malicious 'gid' value in order metadata, which executes when an administrator views the order in the WordPress admin panel.
The WP Job Portal WordPress plugin up to version 2.7.0 is vulnerable to stored cross-site scripting (XSS) via the 'degreetitle' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The plugin allows self-registration, enabling any visitor to create an account capable of exploiting this vulnerability.
The Photo Reviews for WooCommerce WordPress plugin up to version 1.2.31 contains a vulnerability that allows unauthenticated attackers to delete any media library attachment file. This occurs because the plugin's delete_reviews_image() function trusts attachment IDs from a public POST parameter without verifying ownership or user capabilities. Attackers can embed malicious attachment IDs in review comments and trigger deletion when a moderator removes the review or when WordPress's scheduled trash cleanup runs. The nonce used does not prevent exploitation as it is publicly available on product pages.
The Hustle WordPress plugin (up to version 7.8.14.3) has an authorization bypass vulnerability that allows authenticated users with the hustle_create capability to overwrite the site's active email service provider (ESP) integration credentials. This can redirect lead submissions to an attacker-controlled ESP account and, in the case of HubSpot, delete critical OAuth tokens irreversibly.
The VikRentCar Car Rental Management System plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'optionals' parameter. This vulnerability affects all versions up to and including 1.4.10. It allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.
The Shipping Zones by Drawing for WooCommerce plugin for WordPress versions up to and including 3.3.0 is vulnerable to stored cross-site scripting (XSS) via the 'szbd-picked' checkout parameter. An unauthenticated attacker can submit a crafted JSON payload during guest checkout that injects malicious attributes into a Google Maps link in the WooCommerce admin order view. This malicious code executes when an administrator views the injected order, potentially compromising the admin interface.
The Discussion Board WordPress Forum Plugin is vulnerable to stored cross-site scripting (XSS) in versions up to and including 2.6.0. The vulnerability arises from insufficient output escaping of the user profile Website (user_url) field, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. These scripts execute when any user views a Discussion Board topic containing the attacker's reply.
The W3 Total Cache plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter affecting all versions up to and including 2.10.7. This vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires that a Pro license was previously active with REST caching enabled but is now inactive while Disk Enhanced page caching remains configured, and that the attacker has a previously approved commenter identity.
The Webmention plugin for WordPress versions up to and including 5.10.1 contains a stored cross-site scripting (XSS) vulnerability via the Open Graph og:title meta tag. This vulnerability arises from insufficient input sanitization, allowing unauthenticated attackers to inject arbitrary scripts. However, exploitation requires an administrator to approve the injected webmention comment, as the payload is stored in comment content without proper filtering.
The PDF Invoices & Packing Slips for WooCommerce WordPress plugin up to version 5.16.5 has a vulnerability that allows unauthenticated attackers to access complete invoice PDFs of other customers. This occurs via the 'invoice_number' parameter in the document filename when the plugin's yearly invoice number reset option is enabled. Exploitation requires the attacker to place a guest checkout order that triggers a processing email within 60 seconds of a victim's order sharing the same yearly-reset invoice number. The exposed invoice contains sensitive information such as billing and shipping addresses, private order notes, line items, prices, dates, order ID, and invoice number.
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress contains a critical PHP Object Injection vulnerability in all versions up to and including 7.1.1. This flaw arises from insufficient sanitization of the 'customer_note' checkout field, allowing unauthenticated attackers to execute arbitrary code on the server by exploiting the invoice generation process triggered during checkout.
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress versions up to and including 5.16.4 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient input sanitization and output escaping of certain parameters such as billing_address.first_name, last_name, company, and customer_note. An incomplete fix introduced in version 5.16.2 attempted to block raw-tag payloads but was bypassed by entity-encoded payloads, allowing script injection that executes when a user accesses the affected page.
The SureCart WordPress plugin up to version 4.9.4 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. The injected scripts execute when users visit pages that load SureCart's web-component bundle, such as those containing a SureCart Buy Button block. For exploitation, the injected comment must be auto-approved or approved by a moderator.
CVE-2026-118599 is a file overwrite vulnerability in GNOME Epiphany affecting versions 47.0 and later. The vulnerability arises when installing WebExtension packages from .xpi files, which can be crafted as TAR archives containing hard links. This allows an attacker to overwrite existing user-writable files without warning during installation or opening of the malicious .xpi. The issue requires user interaction and does not affect confidentiality or availability directly. A fix is available that restricts support to ZIP format only.