The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps WordPress plugin versions up to 5.5.90 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient sanitization and escaping of text-based database column values rendered in a textarea element, allowing authenticated users with Subscriber-level access or higher to inject malicious scripts. These scripts execute when any user views the affected page.
The Vanquish Upload Files for WooCommerce WordPress plugin is vulnerable to a directory traversal flaw in all versions up to and including 2.7.13. Authenticated users with subscriber-level access or higher can exploit this vulnerability via the 'vanupfi_file_name' parameter to read arbitrary files on the server. The flaw arises from an authorization bypass triggered by supplying a non-existent order ID, which causes a key permission check to be skipped. Additionally, a loose substring match allows traversal payloads to be streamed directly, potentially exposing sensitive files such as wp-config.php.
A stored cross-site scripting (XSS) vulnerability exists in the AgenWebsite Shipping – Plugin Ongkos Kirim & Generate Resi Otomatis Semua Kurir Indonesia WordPress plugin. The flaw is due to insufficient input sanitization and output escaping of the 'zipcode' parameter in all versions up to and including 9.2.41. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages.
The QA Assistants – Driven by data WordPress plugin up to version 5.3.0 is vulnerable to PHP Object Injection via the 'dlevent_ver' parameter. This vulnerability arises from unsafe deserialization without class restrictions and insufficient sanitization of input parameters, enabling unauthenticated attackers to inject malicious PHP objects. Exploitation involves triggering a scheduled event that automatically runs every two minutes without authentication, potentially leading to arbitrary file writes and remote code execution.
A stored cross-site scripting (XSS) vulnerability exists in the WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps WordPress plugin up to version 5.5.89. The flaw arises from insufficient input sanitization and output escaping of the 'ImageURL column value' parameter, which can be exploited by authenticated users with subscriber-level access or higher. Exploitation requires an administrator to publish a DataTables shortcode over a database column controlled by the attacker with the Image URL media type assigned, a feature not enabled by default.
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps WordPress plugin is vulnerable to SQL Injection via the 'engine' parameter in versions up to and including 5.5.90. Authenticated users with subscriber-level access or higher can exploit this vulnerability if an administrator has configured a Data Project page to allow lower-privileged roles. The flaw arises from insufficient escaping and lack of proper preparation of the SQL query, enabling attackers to append additional SQL commands to extract sensitive database information.
The Paystack WooCommerce Payment Gateway plugin for WordPress versions up to 5.8.5 contains a vulnerability that allows unauthenticated attackers to access sensitive customer information. This occurs via the 'key' parameter when the optional custom metadata feature is enabled, enabling enumeration of sequential order IDs to extract personally identifiable information (PII) embedded in page HTML.
A stored cross-site scripting (XSS) vulnerability exists in the Ultimate Member WordPress plugin up to version 2.14.1. The flaw is due to insufficient input sanitization and output escaping of the 'pm_note' parameter, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. These scripts execute when a privileged user views the injected profile page and interacts with a crafted element. The vulnerability has a CVSS score of 6.4, indicating a medium severity risk.
The WP Data Access plugin for WordPress versions up to and including 5.5.89 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient output escaping in the autocomplete lookup label of the Simple Form feature. Authenticated users with Subscriber-level access or higher who can edit lookup rows via legacy forms can inject malicious scripts. These scripts execute when any user, including higher-privileged users, accesses the affected page, potentially compromising user sessions or data.
SEOPress – AI SEO Plugin & On-site SEO for WordPress versions up to 10.3 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper sanitization and escaping of the 'seopress_google_analytics_affiliate_tracking' and 'seopress_google_analytics_download_tracking' settings, allowing injection of arbitrary scripts. Authenticated users with Subscriber-level access or higher, given delegated analytics capability, can exploit this to execute malicious scripts in pages viewed by other users.
Unlimited Elements for Elementor WordPress plugin versions up to 2.0.26 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious scripts via the title or description fields inside an attacker-controlled RSS feed body. The vulnerability arises from insufficient input sanitization and output escaping, particularly due to the plugin's escaping pre-processor excluding certain raw content positions. Exploitation requires the site administrator to have placed the RSS Feed catalog widget pointing to a feed URL controlled by the attacker.
The Quiz and Survey Master (QSM) plugin for WordPress up to version 11.2.7 contains a code injection vulnerability that allows unauthenticated attackers to execute arbitrary shortcodes. This occurs because the plugin improperly validates input before calling do_shortcode, and the nonce used for submission is accessible without authentication, providing no effective protection against exploitation.
The Komfortkasse for WooCommerce WordPress plugin versions prior to 1.4.9 improperly validate REST API request authenticity by overriding WordPress's nonce verification. This flaw allows a request forged in a logged-in administrator's browser to be accepted, enabling an attacker to create a new administrator account and fully take over the site.
The Advanced Custom Fields (ACF®) WordPress plugin versions before 6.8.11 contain a vulnerability where the plugin does not verify user permissions before modifying bidirectional relationship fields. This allows users with contributor-level access or higher to add or remove references to their own objects on posts, users, or terms they cannot normally edit.
The iLeads SMS Gateway WordPress plugin before version 2.0.0 contains a vulnerability where several AJAX actions do not verify user capabilities or nonces. This flaw allows any authenticated user, including low-privileged roles such as subscribers, to modify arbitrary WordPress site options. An attacker can exploit this to escalate privileges to administrator, for example by enabling user registration with the administrator role as default.
The Add From Server Lite WordPress plugin versions prior to 6.0.0 allow users with the Author role and above to upload SVG files containing JavaScript. This occurs because the plugin does not restrict SVG uploads to users permitted to post unfiltered HTML, enabling stored cross-site scripting (XSS) attacks.
The Fiber Admin WordPress plugin versions before 4.0.1 contains a vulnerability where it does not validate or escape a request header before writing it into a PHP file during an unprotected admin hook. This flaw allows unauthenticated attackers to execute arbitrary code if the plugin's custom database error page is enabled and the attacker can win a race condition against an administrator saving settings.
The Live Composer WordPress plugin versions before 2.1.23 contain a vulnerability where a pagination setting supplied through post-listing module shortcodes is not properly escaped before being output in an HTML attribute. This flaw allows users with Contributor role or higher to execute Stored Cross-Site Scripting (XSS) attacks.
The Fiber Admin WordPress plugin versions before 4.0.1 lack authorization checks in certain AJAX actions. This vulnerability allows unauthenticated users to reorder arbitrary posts, including drafts, private posts, and navigation menu items, as well as reorder taxonomy terms when term ordering is enabled.
The Magic Link WordPress plugin versions before 2.2.6 contains a vulnerability where it does not verify if a user requesting a login link is authorized to generate one for the targeted account. This flaw allows any authenticated user, including low-privilege roles such as subscribers, to generate a valid login link for an administrator account and gain unauthorized access.