SureCart, a WordPress plugin for ecommerce, is affected by a stored cross-site scripting (XSS) vulnerability in versions up to and including 4.9.4. The flaw arises from insufficient sanitization and escaping of the 'comment' parameter, allowing unauthenticated attackers to inject malicious scripts. These scripts execute when a user views a page containing SureCart's web-component bundle with an injected comment that is auto-approved or moderator-approved.
The FunnelKit Automations plugin for WordPress and WooCommerce versions up to 3.8.5.2 is vulnerable to a time-based SQL Injection via the 'bwfan_cart_id' parameter. This vulnerability allows unauthenticated attackers to inject SQL queries during a guest Store API checkout, potentially extracting sensitive database information. The injection triggers later when a scheduled job processes the stored data upon order status changes.
The PDF Invoice for WooCommerce + Drag and Drop Template Builder WordPress plugin versions up to 7.1.1 is vulnerable to PHP Object Injection via the 'customer_note' parameter. This vulnerability arises from insufficient sanitization of user input, allowing unauthenticated attackers to execute arbitrary code on the server by exploiting the invoice generation process triggered during checkout.
Popup Builder WordPress plugin versions up to 4.4.5 suffer from an authorization bypass vulnerability. This flaw allows unauthenticated attackers to trash all published popups on a site via a single crafted GET request. The issue is worsened by a secondary flaw in the plugin's SGPopup::find() function, which causes all published popups to be targeted simultaneously when a specific parameter is present.
The Webmention plugin for WordPress up to version 5.10.1 is vulnerable to a stored cross-site scripting (XSS) flaw via the Open Graph og:title meta tag of a webmention source URL. This vulnerability arises from insufficient input sanitization, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user views the affected page after an administrator approves the pending webmention comment. Exploitation requires administrator action to approve the comment containing the malicious payload.
The W3 Total Cache WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in versions up to and including 2.10.7. This vulnerability arises from insufficient sanitization and escaping of the 'comment' parameter, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires a previously active Pro license with REST caching enabled that has since become inactive, while Disk Enhanced page caching remains configured, and the attacker must have a previously approved commenter identity.
The Payable Payment Gateway for WooCommerce WordPress plugin versions before 1.3.1 fails to verify the authenticity of incoming payment notifications. This flaw allows unauthenticated attackers to alter the payment status of any order in the store, regardless of the payment method used.
WordPress Core versions 4.7 through 7.1.3 contain a remote code execution vulnerability due to predictable, web-accessible staging paths during full-package core upgrades. This flaw allows unauthenticated attackers to execute code on the server during the upgrade window.
The Quick Event Manager WordPress plugin versions before 9.19 have a vulnerability where the plugin does not verify the status or type of posts before returning their details in a calendar export. This flaw allows unauthenticated users to access the content of draft and private posts.
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress contains a vulnerability that allows unauthenticated attackers to delete theme files on the server. This is due to insufficient file path validation in the '__construct' function affecting all versions up to and including 2.20.4.
The Mapster WP Maps WordPress plugin versions prior to 2.0.6 contain a vulnerability where a REST API route that modifies post data lacks authorization checks. This flaw allows unauthenticated attackers to overwrite post titles, create new published posts, and alter the plugin's stored settings.
The Firelight Lightbox WordPress plugin versions before 2.3.24 improperly escape image attribute values, allowing users with contributor-level access or higher to inject arbitrary web scripts. These scripts execute when other users view or preview the affected content, leading to a cross-site scripting (XSS) vulnerability.
The NextGEN Gallery WordPress plugin (versions up to and including 4.5.4) contains a stored DOM-based cross-site scripting (XSS) vulnerability via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the site to use the Shutter or Shutter Reloaded lightbox and for the injected comment to be approved through WordPress's moderation system before the payload executes for other users.
The Premium Packages WordPress plugin versions prior to 7.2.2 contain a vulnerability that allows unauthenticated visitors to overwrite the stored price of items in their shopping cart. This flaw enables attackers to create orders for any product at an arbitrary total price of their choosing.
The Essential Addons for Elementor WordPress plugin versions before 6.8.8 improperly restrict which users can assign roles to accounts created via its registration form. Authenticated users with Author-level access or higher can escalate the roles of newly registered accounts, including those created by unauthenticated visitors, to higher privileges such as Editor. This issue is a partial regression of CVE-2026-5193, as the role-validation controls introduced in version 6.6.0 can be bypassed by lower-privileged users, leaving versions 6.6.0 through 6.8.7 vulnerable.
The Bulk Media Register WordPress plugin versions before 2.01 contain a vulnerability where user-supplied file paths are not properly validated before moving files on the server. This flaw allows users with the Author role to move or rename arbitrary files, potentially outside the WordPress root directory, which can bypass directory-level access controls and expose protected files.
The Security Optimizer WordPress plugin versions before 1.6.9 have a vulnerability where the number of two-factor authentication (2FA) code submissions for a pending login is not limited. This flaw allows an attacker who already knows a user's password to brute force the second factor and gain unauthorized access to the account.
The Payment Forms for Paystack WordPress plugin versions before 4.0.6 improperly restrict access to a configuration page. This flaw allows users with the Contributor role and above to view sensitive payment gateway API credentials, including live and test secret keys, which provide full access to the site owner's payment account.
The BuddyForms WordPress plugin versions before 2.10.1 contain a vulnerability where the plugin does not properly verify ownership before deleting guest-uploaded attachments. This flaw allows unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.
The PPWP – Password Protect Pages plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.9.26. This vulnerability arises from insufficient input sanitization and output escaping of the 'comment / shortcode attribute desc_below_form' parameter. Unauthenticated attackers can inject arbitrary scripts that execute when users access the affected pages. The vulnerability is exacerbated by WordPress's comment_content filter and comment_whitelist setting, allowing auto-approval of subsequent comments from previously approved users without administrator intervention.