The Hustle plugin for WordPress up to version 7.8.14.3 has an authorization bypass vulnerability. Authenticated users with the hustle_create capability can overwrite the site's active email service provider (ESP) integration credentials, redirecting lead submissions to an attacker-controlled ESP account. For HubSpot integrations, attackers can also irreversibly delete critical OAuth tokens and options. This flaw arises from improper authorization checks in the plugin's handlers.
The Welcart e-Commerce WordPress plugin up to version 2.12.5 contains an improper authentication vulnerability via the 'member[ID]' parameter. This flaw allows unauthenticated attackers to overwrite any shop member's email and password by supplying the member's numeric ID, enabling full account takeover. Exploitation requires bypassing a wp_verify_nonce() check, but the nonce is exposed to unauthenticated visitors on the New Enrollment Form, making exploitation feasible without prior authentication or special configuration.
The Shipping Zones by Drawing for WooCommerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to and including 3.3.0. This flaw arises from improper sanitization and validation of the 'szbd-picked' checkout parameter, allowing unauthenticated attackers to inject malicious attributes into the Google Maps link shown in the WooCommerce admin order view. The vulnerability can lead to arbitrary script execution when an administrator views the injected order.
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress versions up to 5.16.5 is vulnerable to sensitive information exposure. An unauthenticated attacker can exploit the 'invoice_number' parameter to obtain complete invoice PDFs of other customers, including personal and order details. Exploitation requires the plugin's yearly invoice number reset feature to be enabled and timing conditions involving guest-checkout orders within 60 seconds. The vulnerability has a medium severity rating with a CVSS score of 5.3.
The VikRentCar Car Rental Management System WordPress plugin up to version 1.4.10 is vulnerable to stored Cross-Site Scripting (XSS) via the 'optionals' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.
The Photo Reviews for WooCommerce WordPress plugin (Revopic) up to version 1.2.31 contains a path traversal vulnerability that allows unauthenticated attackers to delete any media library attachment file. This occurs because the plugin's delete_reviews_image() function trusts attachment IDs from a public nonce parameter without verifying ownership or user capabilities. Attackers can embed malicious attachment IDs in review comments and cause permanent deletion when a moderator removes the review or the WordPress scheduled delete cron runs.
The WP Booking System - Booking Calendar WordPress plugin versions up to 2.1.0.5 contains a missing authorization vulnerability. This flaw allows authenticated users with Subscriber-level access or higher to delete arbitrary calendar notes belonging to any calendar. The vulnerability arises from the lack of a capability check in the wpbs_action_ajax_calendar_remove_note() function.
Welcart e-Commerce plugin for WordPress versions up to 2.12.5 is vulnerable to stored Cross-Site Scripting (XSS) via the 'gid' parameter. An unauthenticated attacker can inject malicious scripts by forging a ROBOT PAYMENT browser-return request, which stores the payload in order metadata. The script executes when an administrator views the infected order in the WordPress admin panel.
The VikRentCar Car Rental Management System WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability via the 'poplink' parameter in versions up to and including 1.4.9. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. The attack is facilitated by a WordPress nonce token that is accessible to unauthenticated visitors, enabling exploitation without an account.
The PDF Invoices & Packing Slips for WooCommerce WordPress plugin is affected by a stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 5.16.4. The flaw arises from insufficient input sanitization and output escaping of certain billing and customer note parameters. An incomplete fix introduced in version 5.16.2 can be bypassed using entity-encoded payloads, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user views the affected pages.
The Product Filter for WooCommerce by WBW plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability via the 'wpf_fid' JSON parameter in all versions up to and including 3.4.6. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link. The issue persists despite a partial patch in version 3.4.3, as the sanitization was incomplete.
UsersWP plugin for WordPress versions up to 1.2.78 contains an improper authentication vulnerability due to predictable passwords for built-in dummy user accounts. The shared password is derived from a hash partially exposed in a hidden form field accessible without authentication, allowing attackers to recover the password and log in as any dummy user. Exploitation requires prior creation of dummy users by an administrator. This can lead to unauthorized access and potential privilege escalation if dummy accounts have elevated roles.
The Seraphinite Accelerator plugin for WordPress up to version 2.29.24 contains a vulnerability that allows unauthenticated attackers to access sensitive user information. This occurs through the plugin's Object Cache feature, where attackers can retrieve gzip-serialized cache files containing complete WordPress user records, including usernames, emails, hashed passwords, and activation keys. Exploitation requires triggering the caching of the target user record before accessing the cache file.
The User Submitted Posts plugin for WordPress has a stored DOM-based cross-site scripting (XSS) vulnerability in the 'user-submitted-content' parameter affecting all versions up to and including 20260916. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view the injected content. By default, submitted posts require admin approval before becoming visible, limiting exposure. However, if the plugin's 'publish immediately' option is enabled, the malicious content is published without moderation, increasing risk.
The Discussion Board – WordPress Forum Plugin up to version 2.6.0 is vulnerable to a stored Cross-Site Scripting (XSS) flaw via the user profile Website (user_url) field. This vulnerability arises from insufficient output escaping in the plugin's handling of the user_url value, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. These scripts execute when any user views a Discussion Board topic containing the attacker's reply.
The Mail logging & Catcher plugin for WordPress up to version 2.2.0 has a vulnerability that allows authenticated users with subscriber-level access or higher to extract administrator password-reset keys from stored email logs. This vulnerability arises if the plugin's default_view_role setting is configured to allow low-privileged users to view logs, enabling privilege escalation to administrator by completing the password-reset flow.
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website plugin for WordPress versions up to 2.7.0 is vulnerable to stored Cross-Site Scripting (XSS) via the 'degreetitle' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The plugin’s self-registration allows any visitor to create a subscriber-backed employer account, enabling broad exploitability.
The Relevanssi – A Better Search WordPress plugin is vulnerable to a stored cross-site scripting (XSS) flaw via the 'comment' parameter in versions up to and including 4.28.5. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users visit a page accessed through a Relevanssi search-result permalink with the highlight query parameter. The exploit requires both comment indexing and comment highlighting features to be enabled.
The ThirstyAffiliates WordPress plugin up to version 3.12.1 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the site to use block themes where comment content is processed through a specific rendering function, and the attacker must have one prior approved comment to enable auto-approval of subsequent crafted comments. The vulnerability has a high severity rating with a CVSS score of 7.2.
The W3 Total Cache WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in all versions up to and including 2.10.7. This flaw arises from insufficient input sanitization and output escaping of the 'comment' parameter when HTML Minify is enabled with the default 'mfunc' entry in the ignored-comment stems list. Exploitation requires an attacker to predict a dynamic placeholder namespace based on the server time, which can be inferred from the HTTP Date header. Successful exploitation allows unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the affected pages.