The Stop Spammers Classic WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in the 'author' POST parameter in versions up to and including 2026.6. An unauthenticated attacker can inject JavaScript code that is stored and later executed when an administrator with manage_options capability clicks a specific 'Report to SFS' link in the admin interface. Exploitation requires the StopForumSpam API key to be configured and an administrator action to trigger the payload execution.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability requires authentication and has a medium severity rating with a CVSS score of 5.8. No public exploit or known exploitation in the wild has been reported. No patch or remediation details are currently provided.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an authorization vulnerability that allows a remote authenticated attacker to access sensitive information belonging to other tenants. The flaw arises from insufficient permission checks on identifiers supplied in requests, leading to potential cross-tenant data exposure.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a cross-site scripting (XSS) vulnerability. This flaw allows a remote authenticated attacker to execute arbitrary JavaScript in another user's browser session due to improper neutralization of user-supplied input when web pages are updated.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that could allow a remote attacker with limited privileges to view arbitrary files on the system by sending a specially crafted URL request. This vulnerability does not allow modification or denial of service but exposes potentially sensitive file contents.
The SliceWP Affiliates plugin for WordPress, versions up to and including 1.2.14, contains a SQL Injection vulnerability via the 'email' parameter. This flaw allows unauthenticated attackers to inject arbitrary SQL queries due to insufficient escaping and preparation of user input. The vulnerability is triggered during WooCommerce My Account registration via the user_register hook, which can be accessed without an account using a guest-obtainable nonce.
The TranslatePress plugin for WordPress versions up to and including 3.3.8 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires that the attacker's comment is previously approved under WordPress's default moderation and that a secondary language is configured in TranslatePress.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where improper input validation could allow a remote attacker to inject platform credentials into outbound requests. This occurs because the validation check is not sufficiently strict, potentially exposing sensitive credentials.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow arbitrary code execution by the management service in certain non-default configurations. This occurs due to improper control over code generation where customization content may be evaluated as code if the related feature is enabled and not properly restricted. The vulnerability has a high severity rating with a CVSS score of 7.5.
The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress contains an arbitrary file upload vulnerability in all versions up to and including 2.13.2. This flaw allows unauthenticated attackers to upload and write PHP files to arbitrary locations outside the uploads directory, resulting in remote code execution. Exploitation requires the site option 'nbdesigner_upload_popup_style' to be set to 'a' (Advanced Upload Popup), which enables unauthenticated access to the vulnerable AJAX handler. The required nonce for the attack is publicly accessible on the frontend, making exploitation trivial once the configuration is active.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where token validation is improperly implemented. This flaw allows tokens to be accepted for purposes they were not intended for due to incomplete security checks.
The Optimole WordPress plugin up to version 4.2.18 is vulnerable to stored cross-site scripting (XSS) via the 's (missing_srcsets[*][*].s)' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access affected pages. Additionally, the REST endpoint's HMAC signature, which should protect authorization, is exposed in plaintext to unauthenticated visitors, effectively removing the authentication barrier.
The Redux Framework plugin for WordPress versions up to and including 4.5.16 contains a stored cross-site scripting (XSS) vulnerability via the 'content' parameter. This flaw allows authenticated users with subscriber-level access or higher to inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, and requires the site's theme to register a color_scheme field on user profiles, exposing a nonce on the profile page for all logged-in users.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization vulnerability that could allow a remote attacker to create, modify, or delete tenants without proper permissions. This flaw arises from missing authorization checks.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where improper verification of a cryptographic signature allows an attacker to gain unauthorized access to an organization. Specifically, a token can be accepted without its signature being fully verified, enabling an attacker to join an organization without a valid invitation.
IBM Aspera Faspex versions 5.0.0 through 5.0.19 contain a vulnerability that allows an authorized user to bypass user authorization by crafting a specific message, resulting in full administrative privilege escalation.
The QODE Wishlist for WooCommerce plugin for WordPress versions up to and including 1.2.9 is vulnerable to stored cross-site scripting (XSS) via the 'qode_wishlist_for_woocommerce_guests_items' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages. Exploitation requires an attacker to craft a share URL with malicious content and an administrator to take an action to trigger the vulnerability. The vulnerability is rated medium severity with a CVSS score of 6.1.
The Active Woot Products Tables for WooCommerce WordPress plugin (up to version 2.1.5) contains a vulnerability allowing unauthenticated attackers to delete media library attachments and their files. This occurs due to an AJAX handler lacking nonce verification and capability checks, enabling deletion of files in the uploads directory by supplying a numeric attachment ID. Files outside the uploads directory cannot be deleted via this flaw.
The Optimole WordPress plugin up to version 4.2.18 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the injected comment to be approved by an administrator and the affected post to include at least one iframe or video element, conditions met under default plugin settings with video lazy loading enabled.
The Pie Register WordPress plugin up to version 3.8.4.16 is vulnerable to stored cross-site scripting (XSS) via the 'first_name' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires public registration to be enabled and the registration form to include a Profile Picture field. An attacker can register with a crafted payload and then post a comment that triggers the script execution for all visitors of the affected page.