WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress versions up to 1.12.18 is vulnerable to stored cross-site scripting (XSS) via the 'field_<id>[0][0]' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user accesses the affected page. The issue stems from the client-side esc_html() helper improperly handling non-string values, enabling malicious payloads to reach jQuery .append() unescaped.
The Real Testimonials plugin for WordPress up to version 4.1.0 is vulnerable to stored cross-site scripting (XSS) via the 'tpro_client_image' and 'tpro_client_testimonial' parameters. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires an administrator to have a specific display block setting disabled and to approve the malicious testimonial content. The vulnerability has a medium severity with a CVSS score of 5.4.
The WP Visitor Statistics (Real Time Traffic) WordPress plugin up to version 8.7.1 is vulnerable to stored Cross-Site Scripting (XSS) via the 'browser' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute in the context of authenticated administrators when viewing affected pages. The issue arises from insufficient input sanitization and output escaping, specifically in how the jqPlot PieRenderer handles HTML-decoded series labels.
Happyforms Pro plugin for WordPress versions up to and including 1.38.9 is vulnerable to a stored cross-site scripting (XSS) flaw via the 'happyforms_client_referer' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.
The Registration Form for WooCommerce plugin for WordPress contains a critical privilege escalation vulnerability in versions up to and including 1.1.4. The flaw arises from improper privilege management in the checkout registration path, where user role input is not properly validated, allowing unauthenticated attackers to assign themselves the Administrator role during account creation. This can lead to full site takeover.
The Motors – Car Dealership & Classified Listings Plugin for WordPress has a path traversal vulnerability allowing authenticated users with subscriber-level access or higher to delete arbitrary files within the wp-content/uploads directory. This occurs due to insufficient file path validation in the stm_listings_ajax_save_user_data function in versions up to and including 1.4.125. Although deletion is restricted to the uploads directory, the vulnerability can lead to remote code execution by deleting critical files within that scope. The AJAX nonce required for the attack is exposed on all front-end pages, and the handler's stm_user_avatar_path meta is writable by any logged-in user for their own account, making exploitation trivial for authenticated users.
AutomatorWP – No-Code Workflow Automation plugin for WordPress versions up to 6.0.4 contains a privilege escalation vulnerability. The flaw arises from improper privilege validation in the create_user() function, allowing unauthenticated attackers to create administrator accounts via crafted trigger tag data. Exploitation requires a specific anonymous automation configuration and is triggered by an administrator approving a comment, which silently creates a new admin user linked to the comment author. This grants full administrative control to the attacker.
The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials WordPress plugin up to version 4.1.0 is vulnerable to stored cross-site scripting (XSS) via the 'tpro_client_testimonial' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Exploitation requires an administrator to approve the testimonial and the presence of the WordPress Interactivity runtime on the page.
A stored cross-site scripting (XSS) vulnerability exists in the weDocs WordPress plugin up to version 2.6.1. Authenticated users with contributor-level access or higher can inject malicious scripts via the 'modalPlaceholder' block attribute. These scripts execute in the browsers of admins or editors who preview or view the affected posts, potentially leading to session hijacking or other script-based attacks.
The Dynific Addons for Elementor WordPress plugin (formerly Anywhere Elementor) contains a SQL Injection vulnerability in versions up to and including 1.3. The flaw arises from improper escaping of the 'q' parameter in the ae_preview_post() AJAX handler, allowing authenticated users with Subscriber-level access or higher to inject arbitrary SQL code. This can lead to unauthorized extraction of sensitive database information. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin up to version 3.6.8 is vulnerable to stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject malicious scripts via a form field mapped to a post meta key, which execute when users access the affected pages. Exploitation requires a public Insert Post form configured to write to a post meta key and a Calculated Field referencing that key. This vulnerability has a high severity rating with a CVSS score of 7.2.
The WP-Members Membership Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to and including 3.5.7. This flaw arises from insufficient input sanitization and output escaping in the WooCommerce Checkout Multicheckbox/Multiselect Field, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. The vulnerability is exploitable only via the WooCommerce classic checkout path, as other handlers trigger a PHP 8 TypeError and fail closed.
The Amelia Pro WordPress plugin for booking appointments and events is vulnerable to a time-based SQL Injection via the 'tag[]' array keys parameter in versions up to and including 9.9.1. This vulnerability arises from insufficient escaping of user-supplied array keys, allowing unauthenticated attackers to inject additional SQL queries. Exploitation could lead to extraction of sensitive database information without authentication.
The Appointment Booking Plugin – LatePoint for WordPress versions up to 5.7.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to take over user accounts. The flaw arises from improper handling of SQL query parameters in the password reset functionality, enabling attackers to reset passwords of other users and gain full access to their bookings, orders, and personal information. When the wp_users_as_customers option is enabled, attackers can also take over linked WordPress user accounts.
The WP ImageViewer WordPress plugin up to version 3.0.2 contains a stored DOM-based cross-site scripting (XSS) vulnerability via the 'img.alt' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. Exploitation requires a front-end content plugin like bbPress to grant the necessary capabilities or contributor-level access with permission to submit image HTML in posts. The vulnerability arises from insufficient input sanitization and output escaping.
The Image Hover Effects Ultimate WordPress plugin (up to version 9.12.2) contains a stored cross-site scripting (XSS) vulnerability via the 'rawdata.oxi_image_comparison_before_text' parameter. This flaw allows authenticated users with subscriber-level access or higher to inject arbitrary scripts if the plugin's "Who can edit" setting is configured to allow subscribers to edit styles. The vulnerability arises from insufficient input sanitization and missing ownership checks on style IDs, enabling script execution when affected pages are viewed.
The Falang multilanguage for WordPress plugin (versions up to 1.4.6) contains a stored cross-site scripting (XSS) vulnerability. Authenticated users with subscriber-level access or higher can exploit insufficient input sanitization and output escaping in a parameter used during term updates. The vulnerability allows injection of arbitrary scripts that execute when other users view the affected pages. The exploit is facilitated by a nonce exposed to any logged-in user via an unprotected AJAX handler, requiring no elevated privileges to obtain.
The Link Library plugin for WordPress has a stored cross-site scripting (XSS) vulnerability in the 'link_description' parameter affecting all versions up to and including 7.10.0. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the site administrator to enable the non-default 'Convert [] to <> in Link Description and Notes' setting, which reconstructs the payload into executable HTML. The vulnerability has a high severity score of 7.2 and can lead to partial confidentiality and integrity impacts without requiring user interaction.
Happyforms Pro WordPress plugin versions up to 1.38.9 are vulnerable to stored cross-site scripting (XSS) via spoofable client IP headers. The vulnerability arises because the plugin reads raw HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without validation, stores them as post meta, and later outputs them in the admin interface without escaping. This allows unauthenticated attackers to inject malicious scripts that execute when an administrator views the submission details.
The Dynific Addons for Elementor WordPress plugin (formerly Anywhere Elementor) up to version 1.3.0 is vulnerable to arbitrary shortcode execution due to improper validation before calling do_shortcode. This allows unauthenticated attackers to execute arbitrary shortcodes if a public post rendered with an AE template includes the AE Post Comments widget and the attacker's comment is visible. Exploitation requires either a previously approved comment or relaxed comment moderation.