The Flipbox – Awesomes Flip Boxes Image Overlay WordPress plugin versions up to 3.1.1 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper sanitization and escaping of the 'flip-box-image-upload-url-01-alt' parameter, allowing authenticated users with contributor-level access or higher to inject malicious scripts. Exploitation requires specific permission configurations, such as delegated editing capabilities or multisite setups with restricted unfiltered_html. The vulnerability can lead to script execution in any page containing the affected shortcode or block.
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress versions up to and including 3.8.0 contains a missing authorization vulnerability. This flaw allows unauthenticated attackers to delete arbitrary attachments by exploiting a missing capability or ownership check in the ajax_remove_uploaded() function. The vulnerability arises because the AJAX handler is accessible to both authenticated and unauthenticated users and is protected only by a nonce that is publicly available on checkout pages with file upload fields. Exploitation can lead to deletion of important media files and potential denial of service.
The Download Manager plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to and including 7.5.9. This vulnerability arises from insufficient input sanitization and output escaping of certain registration form parameters, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the WordPress site to have user registration enabled, the plugin's registration form shortcode published publicly, and at least one package authored by user ID 1 using a specific template.
CVE-2026-119498 is an authentication bypass vulnerability in RelyWP Simple Cloudflare Turnstile affecting versions before 1.44.5. It allows attackers to bypass authentication using an alternate path or channel. The issue is fixed in version 1.44.5. The vulnerability has a medium severity with a CVSS score of 5.3 and does not impact confidentiality or availability but impacts integrity.
CVE-2026-121765 is a stored cross-site scripting (XSS) vulnerability in Cozmoslabs TranslatePress plugin versions up to 3.3.8. It arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The vulnerability is fixed in version 3.3.9.
RRD::CGI::Image versions up to 0.01 for Perl improperly validate the 'tz' CGI query parameter before passing it to the tzset() function. This allows an attacker to specify a FIFO or device path as the TZ environment variable, causing the process to block when tzset() attempts to open the path.
The VikBooking Hotel Booking Engine & PMS WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the 'guests[][][documents]' parameter. This flaw exists in all versions up to and including 1.8.17 due to insufficient input sanitization and output escaping. An unauthenticated attacker who can obtain a valid booking session token can inject malicious scripts that execute when users access the affected pages.
JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress versions up to 3.6.8 is vulnerable to stored Cross-Site Scripting (XSS) via the 'note' form field. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires a privileged user with edit_others_posts capability to visit a crafted URL containing the attacker-controlled post ID, potentially leading to script execution in the user's browser.
The Real Testimonials WordPress plugin up to version 4.1.0 contains a stored cross-site scripting (XSS) vulnerability via the 'tpro_client_name' parameter. This flaw allows unauthenticated attackers to inject malicious scripts that execute when users view the injected testimonial. Exploitation requires an administrator to publish, preview, and update the testimonial, as the attack payload is stored through the plugin's moderation workflow.
The Quttera ThreatSign – Web Malware Scanner for WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability via the HTTP_USER_AGENT parameter in all versions up to and including 4.1.0.48. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrator views the affected page. The flaw arises from insufficient input sanitization and output escaping.
JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress versions up to 3.6.7 is vulnerable to stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject malicious scripts via any form field when the Save Form Record action and a form-level Form Record preset are enabled. The payload executes when a privileged user visits the affected form page with the attacker's record ID set in the query variable.
A stored Cross-Site Scripting (XSS) vulnerability exists in the wedevs User Frontend plugin for WordPress up to version 4.3.13. The flaw arises from insufficient input sanitization and output escaping of the taxonomy_field_name parameter when configured as a text-input field with guest post submission enabled. This allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.
The WP Visitor Statistics (Real Time Traffic) WordPress plugin up to version 8.9.0 contains a stored cross-site scripting (XSS) vulnerability via the 'os' parameter and related parameters. This flaw allows unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.
The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress contains an authorization bypass vulnerability (CWE-639) in all versions up to 1.15.0.2. This flaw allows unauthenticated attackers to access full billing personally identifiable information (PII) of any store order by manipulating the 'order-pay' query parameter. The vulnerability arises from missing validation on a user-controlled key, enabling attackers to enumerate sequential order IDs and retrieve sensitive customer data embedded in JavaScript objects on the page. Exploitation is possible even when WooCommerce itself rejects the order-pay request, due to independent script localization calls in the plugin.
Naimur Email OTP Verification for WooCommerce plugin versions up to 2.1.0 contains an authentication bypass vulnerability. The flaw arises from the password-reset finalization endpoint authorizing resets solely based on an email marked as 'VERIFIED' in the database, without timestamp checks, session binding, or per-reset tokens. This allows unauthenticated attackers who know a victim's email and a publicly available nonce to reset the victim's password and obtain a valid session cookie, potentially leading to full site takeover if the victim is an administrator.
The Football Pool plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'shouttext' parameter affecting all versions up to and including 2.13.5. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute in the admin Edit view for a shout. Other views such as the public Shoutbox widget and admin list view properly escape output, limiting the impact to the admin Edit interface.
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps WordPress plugin up to version 5.5.89 contains an incorrect authorization vulnerability. Authenticated users with Subscriber-level access or higher can exploit this flaw to write to arbitrary database rows and columns, bypassing configured restrictions. This includes the ability to overwrite the administrator's password hash, enabling full site takeover. Exploitation requires that an administrator has published a Data App allowing write transactions for Subscriber-level or anonymous users. Unauthenticated exploitation is possible only if the Data App is configured with anonymous REST API authorization and write permissions. The vulnerability arises because write endpoints do not enforce the same row-filter and column allow-list restrictions as read endpoints.
The Church Admin WordPress plugin up to version 5.1.7 is vulnerable to a stored cross-site scripting (XSS) flaw via the 'lat' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires that a Google Maps API key be configured in the plugin settings, as the vulnerable code path is only triggered in this scenario.
The Modula Image Gallery plugin for WordPress versions up to and including 3.0.17 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient sanitization of the 'link' field in the 'items' parameter handled by specific REST API functions, allowing authenticated users with Author-level access or higher to inject malicious scripts. These scripts execute when users view and interact with the affected gallery tiles, potentially compromising user sessions and data.
WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress versions up to 1.12.18 is vulnerable to stored cross-site scripting (XSS) via the 'field_<id>[0][0]' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user accesses the affected page. The issue stems from the client-side esc_html() helper improperly handling non-string values, enabling malicious payloads to reach jQuery .append() unescaped.