A vulnerability in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before version 5.3.3 allows a subsite Administrator on WordPress Multisite to enable marketplace seller status for users outside their own site, including network-level users they cannot normally manage. This occurs because the plugin does not verify that the acting administrator is authorized to manage each selected user before enabling their seller status.
A vulnerability in the Dokan: AI Powered WooCommerce Multivendor Marketplace WordPress plugin before version 5.3.3 allows unauthenticated attackers to spoof the sender address in emails sent via the store contact form. The plugin improperly places the attacker-supplied email address in the From header instead of the Reply-To header, enabling spoofing of emails from the site's own domain. This issue is fixed in version 5.3.3.
A vulnerability in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before version 5.3.3 allows unauthenticated attackers to bypass authorization checks when accessing single orders and their notes. This flaw permits attackers to read customer and order information and to add or delete order notes for some orders.
The Car Dealer (Dealership) and Vehicle sales WordPress plugin up to version 4.73 contains an information disclosure vulnerability. An unauthenticated attacker can access the title, content, and metadata of any private, draft, pending, future, or trashed post by using the single-listing AJAX action with a numeric post ID. This occurs because the plugin does not restrict this AJAX action to published content only.
The Easy Social Icons WordPress plugin before version 4.0.3 contains a cross-site scripting (XSS) vulnerability due to improper sanitization of SVG files. This flaw allows users with the Author role or higher to upload malicious SVG files containing XSS payloads. Additionally, if an older version of the plugin exposes an upload route to unauthenticated visitors, the vulnerability can be exploited without requiring an account.
The IVPAY payments WordPress plugin versions 1.0.0 through 1.0.8 contains an SQL injection vulnerability due to improper sanitization of a payment callback parameter. Additionally, the plugin treats an empty API key as valid authentication, enabling unauthenticated attackers to read arbitrary data from the database.
The Cloud Blocks WordPress plugin up to version 1.1.8 contains a cross-site scripting (XSS) vulnerability. It fails to perform authorization or sanitization when storing block asset URLs, allowing unauthenticated users to inject malicious scripts. These scripts execute in the browsers of privileged users, such as administrators, when they open the block editor.
Easy Social Icons WordPress plugin versions before 4.0.3 contain a stored cross-site scripting (XSS) vulnerability. This occurs because some settings are not properly sanitized or escaped before being output on front-end pages. The vulnerability allows high-privilege users, such as Administrators, to inject malicious scripts when the unfiltered_html capability is disallowed, for example in multisite network environments. The issue is fixed in version 4.0.3.
The EWWW Image Optimizer WordPress plugin versions 8.7.4 through 8.9.0 contain a cross-site scripting (XSS) vulnerability that allows authenticated users with author-level access or higher to inject arbitrary scripts into post content. These scripts execute in the context of any user viewing the affected page, including administrators. The issue is due to improper sanitization and restriction of dynamic script loading. Version 8.9.1 fixes this vulnerability.
A vulnerability in the Essential Real Estate WordPress plugin before version 5.3.5 allows authenticated low-privileged users to access invoices belonging to other users. This occurs because the plugin does not verify invoice ownership before rendering invoice data in an AJAX action, exposing sensitive information such as the invoice owner's name, account email, and financial details.
The Essential Real Estate WordPress plugin before version 5.3.5 contains a missing authorization vulnerability in one of its AJAX actions. This flaw allows a self-registered customer to activate a paid listing package without payment by exploiting the lack of verification that the selected package is genuinely free or that the user is entitled to it. The site then incorrectly records a paid invoice at the full package price.
The Essential Real Estate WordPress plugin versions before 5.3.5 contain an improper access control vulnerability. This flaw allows unauthenticated users to access images attached to unpublished property listings via two AJAX actions due to missing publication-status and authorization checks.
The Essential Real Estate WordPress plugin versions before 5.3.5 contain an improper access control vulnerability. This flaw allows unauthenticated users to send emails to arbitrary recipients with attacker-controlled sender headers and message bodies via a contact email action. The issue is fixed in version 5.3.5.
The Essential Real Estate WordPress plugin before version 5.3.5 contains a vulnerability that allows unauthenticated users to access unpublished property listings and sensitive personal information of listing agents via an AJAX action lacking proper authorization checks.
A race condition vulnerability exists in YITH WooCommerce Gift Cards WordPress plugin versions before 4.38.1. The plugin does not properly lock or atomically update gift card balances during redemption at checkout. This flaw allows an attacker who possesses a gift card code to spend more than the card's funded value by submitting multiple simultaneous checkouts using the same code.
A vulnerability in the Subscriptions for WooCommerce WordPress plugin before version 2.1.1 allows unauthenticated users to bypass membership content restrictions and access restricted posts and pages through alternative routes. This improper access control issue occurs because the plugin only enforces restrictions on standard front-end page views.
The Community Events WordPress plugin versions before 1.6.0 contain a missing authorization vulnerability in one of its AJAX actions. This flaw allows unauthenticated users to access details of event submissions that are pending moderation, which are otherwise not publicly accessible. The issue is fixed in version 1.6.0.
A vulnerability in WP Event Manager WordPress plugin versions 3.4.0 up to but not including 3.4.2 allows unauthenticated attackers to read, overwrite, and convert unpublished posts and pages into events due to lack of verification of user-supplied post identifiers in the front-end event submission flow.
Tutor LMS WordPress plugin versions from 1.6.4 up to but not including 4.2.0 expose correct quiz answers to enrolled students regardless of the configured setting to hide answers. This allows students to view answers before submitting their quiz attempts. The issue is fixed in version 4.2.0.
A Server-Side Request Forgery (SSRF) vulnerability exists in the FV Flowplayer Video Player WordPress plugin before version 7.5.56.7212. The plugin fails to validate user-supplied URLs before fetching them server-side, allowing users with Contributor-level access or higher to perform SSRF attacks. This can lead to reading internal resources when the response is returned with an image content type.