WordPress Core versions 4.7 through 7.1.3 contain a remote code execution vulnerability due to predictable, web-accessible staging paths during full-package core upgrades. This flaw allows unauthenticated attackers to execute code on the server during the upgrade window.
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress contains a vulnerability that allows unauthenticated attackers to delete theme files on the server. This is due to insufficient file path validation in the '__construct' function affecting all versions up to and including 2.20.4.
The Mapster WP Maps WordPress plugin versions prior to 2.0.6 contain a vulnerability where a REST API route that modifies post data lacks authorization checks. This flaw allows unauthenticated attackers to overwrite post titles, create new published posts, and alter the plugin's stored settings.
The Firelight Lightbox WordPress plugin versions before 2.3.24 improperly escape image attribute values, allowing users with contributor-level access or higher to inject arbitrary web scripts. These scripts execute when other users view or preview the affected content, leading to a cross-site scripting (XSS) vulnerability.
The NextGEN Gallery WordPress plugin (versions up to and including 4.5.4) contains a stored DOM-based cross-site scripting (XSS) vulnerability via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the site to use the Shutter or Shutter Reloaded lightbox and for the injected comment to be approved through WordPress's moderation system before the payload executes for other users.
The Premium Packages WordPress plugin versions prior to 7.2.2 contain a vulnerability that allows unauthenticated visitors to overwrite the stored price of items in their shopping cart. This flaw enables attackers to create orders for any product at an arbitrary total price of their choosing.
The Essential Addons for Elementor WordPress plugin versions before 6.8.8 improperly restrict which users can assign roles to accounts created via its registration form. Authenticated users with Author-level access or higher can escalate the roles of newly registered accounts, including those created by unauthenticated visitors, to higher privileges such as Editor. This issue is a partial regression of CVE-2026-5193, as the role-validation controls introduced in version 6.6.0 can be bypassed by lower-privileged users, leaving versions 6.6.0 through 6.8.7 vulnerable.
The Bulk Media Register WordPress plugin versions before 2.01 contain a vulnerability where user-supplied file paths are not properly validated before moving files on the server. This flaw allows users with the Author role to move or rename arbitrary files, potentially outside the WordPress root directory, which can bypass directory-level access controls and expose protected files.
The Security Optimizer WordPress plugin versions before 1.6.9 have a vulnerability where the number of two-factor authentication (2FA) code submissions for a pending login is not limited. This flaw allows an attacker who already knows a user's password to brute force the second factor and gain unauthorized access to the account.
The Payment Forms for Paystack WordPress plugin versions before 4.0.6 improperly restrict access to a configuration page. This flaw allows users with the Contributor role and above to view sensitive payment gateway API credentials, including live and test secret keys, which provide full access to the site owner's payment account.
The BuddyForms WordPress plugin versions before 2.10.1 contain a vulnerability where the plugin does not properly verify ownership before deleting guest-uploaded attachments. This flaw allows unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.
The PPWP – Password Protect Pages plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.9.26. This vulnerability arises from insufficient input sanitization and output escaping of the 'comment / shortcode attribute desc_below_form' parameter. Unauthenticated attackers can inject arbitrary scripts that execute when users access the affected pages. The vulnerability is exacerbated by WordPress's comment_content filter and comment_whitelist setting, allowing auto-approval of subsequent comments from previously approved users without administrator intervention.
The All-in-One Video Gallery WordPress plugin versions before 5.0.0 have a vulnerability where the plugin does not verify a video's publication status before displaying it. This allows unauthenticated users to access the title and source URLs of videos that are private, draft, pending, scheduled, or trashed by referencing their ID.
The Ninja Forms plugin for WordPress up to version 3.15.5 is vulnerable to stored cross-site scripting (XSS) via the 'formData.extra' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. The nonce check intended to prevent unauthorized requests is effectively bypassed due to the nf_ajax_submit endpoint issuing a valid nonce on failure, making exploitation straightforward.
The Ninja Forms WordPress plugin up to version 3.15.5 contains a vulnerability that allows authenticated users with subscriber-level access or higher to execute arbitrary shortcodes. This occurs because the plugin does not properly validate values before running do_shortcode, enabling shortcode injection via the user's display name if an administrator has configured a form field with the {wp:user_display_name} merge tag on a public page.
The Meow Lightbox WordPress plugin up to version 5.6.4 is vulnerable to stored cross-site scripting (XSS) via the 'post_content' parameter used in bbPress reply bodies. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary JavaScript. Exploitation requires specific plugin settings enabled by the administrator, including Output Buffering, the HtmlDomParser engine, Aggressive Resolve, and a stored-HTML submission surface with a permissive kses allow-list. When these conditions are met, the injected script executes in the context of any user viewing the affected page.
The Ninja Forms WordPress plugin up to version 3.15.5 contains a vulnerability that allows unauthenticated attackers to execute arbitrary shortcodes due to improper validation before calling do_shortcode.
The Payable Payment Gateway for WooCommerce plugin prior to version 1.3.1 contains a missing authorization vulnerability. This flaw allows unauthenticated attackers to alter the payment status of any WooCommerce order, marking it as paid or failed without verifying the authenticity of incoming payment notifications.
The Quick Event Manager WordPress plugin versions from 8.4.6 up to but not including 9.19 contain a vulnerability where unauthenticated users can access the content of draft and private posts via calendar export functionality. This occurs because the plugin does not verify the status or type of the requested post before returning its details. The issue is fixed in version 9.19.