The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'post_content' parameter. This affects all versions up to and including 2.8.200. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The attack bypasses the plugin's shortcode filtering due to a nested shortcode payload and limitations in WordPress's strip_shortcodes() function and kses HTML filtering.
The Flying Images WordPress plugin up to version 2.4.15 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Initial comments require administrator approval, but subsequent comments from the same user bypass moderation, causing persistent script execution for all visitors, including administrators.
The Jupiter X Core plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 4.62.0. This vulnerability arises from insufficient input sanitization and output escaping of the 'fields[<custom_meta_field_id>]' parameter. An unauthenticated attacker can exploit this by injecting malicious scripts into pages where the attacker is assigned as the post author and the page template includes the Raven Author Box widget. The vulnerability allows script execution when users access the affected pages.
The Noptin WordPress plugin up to version 4.4.3 is vulnerable to a Local File Inclusion (LFI) flaw via the 'noptin_fields[first_name]' parameter. This vulnerability allows unauthenticated attackers to include and execute arbitrary PHP files on the server. Exploitation requires an administrator to trigger the sending of a newsletter containing the malicious payload, as unauthenticated users can store PHP code in the first_name field but cannot directly execute it. The vulnerability can lead to code execution, bypassing access controls and potential data exposure.
The Greenshift WordPress plugin, used for animation and page builder blocks, suffers from a Stored DOM-Based Cross-Site Scripting (XSS) vulnerability via the 'url (comment_author_url)' parameter in all versions up to and including 13.2.2. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires a specific plugin configuration involving the GreenShift Interaction Layer and Counter block attributes, causing the payload to execute for every visitor who loads the affected page once the malicious comment is published.
The Appointment Booking Plugin – LatePoint for WordPress versions up to and including 5.7.6 is vulnerable to stored cross-site scripting (XSS) via the 'customer[email]' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Attackers can exploit this by registering as a customer through the public booking form using a crafted email address that passes validation but contains an HTML payload. The injected scripts execute whenever a user accesses the affected page, potentially compromising user interactions.
The WPBakery Page Builder plugin for WordPress up to version 9.0.1 is vulnerable to stored cross-site scripting (XSS) via the 'display_name' or 'nickname' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view pages containing the injected content. Successful exploitation requires that a public post by the attacker is displayed through a Basic Grid with a Grid Builder template configured to link to the post author. Author-level users can exploit this without assistance, while subscribers need an administrator to publish a post under their account.
The Interactive Real Estate – Floor Plan & Building Visualizer plugin for WordPress contains an arbitrary file upload vulnerability in all versions up to and including 2.6.0. The flaw arises from missing capability checks, nonce verification, and file extension or MIME type validation in the extract_zip_data function. Authenticated users with subscriber-level access or higher can exploit this vulnerability to upload potentially executable files, enabling remote code execution. Exploitation requires the plugin's Freemius Premium license or trial to be active, as the vulnerability is gated by a site-level license check rather than per-user capability checks.
The Optimole WordPress plugin up to version 4.2.17 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access affected pages. Exploitation requires the plugin to be connected with configured CDN keys and the image replacer enabled, which is the default setup. The injected payload bypasses WordPress comment sanitization by using a decoding mechanism unique to Optimole at render time.
The LifterLMS WordPress plugin up to version 10.3.2 is vulnerable to stored cross-site scripting (XSS) via the 'answer[]' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute in the administrator's browser during quiz grading. Exploitation requires the attacker to be enrolled in a course with a Content-type quiz question and occurs when the administrator clicks 'Start a Review' on the affected attempt.
The Motors – Car Dealership & Classified Listings Plugin for WordPress has a stored cross-site scripting (XSS) vulnerability in the 'stm_f_s[make]' parameter. This affects all versions up to and including 1.4.128. The flaw allows authenticated users with subscriber-level access or higher to inject malicious scripts that execute when other users view the affected pages. Exploitation requires the Free Listing Submission feature to be enabled, which is on by default in the demo setup wizard configuration.
The JS Help Desk plugin for WordPress up to version 5.0.2 contains a stored DOM-based cross-site scripting (XSS) vulnerability via the 'jsticket_message' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when an administrator or agent views the affected ticket. The vulnerability arises from insufficient input sanitization and output escaping, specifically when the page initializes VenoBox and processes the data-title attribute with jQuery .html().
The Kubio AI Page Builder plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment (review body)' parameter in all versions up to and including 2.9.4. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. Exploitation requires the attacker's review containing the payload to be approved, either automatically or manually, and the active single-product template must use a Kubio-rendered wp:post-content block.
The Form Maker by 10Web WordPress plugin up to version 1.15.50 is vulnerable to stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping. The vulnerability involves crafted parameters that allow unauthenticated attackers to inject malicious scripts that execute when an administrator views form submissions. Exploitation requires the targeted form to have a File Upload field and manipulation of the disabled_fields parameter to bypass escaping.
The LearnPress – Course Review plugin for WordPress contains a stored DOM-based cross-site scripting (XSS) vulnerability in the 'review_title' parameter. This affects all versions up to and including 4.2.2. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when an administrator or users access the injected review page. The vulnerability is triggered after an administrator approves the review, although auto-approval configurations may allow earlier execution.
The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qode_wishlist_for_woocommerce_guests_items' parameter in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by guests because the required wp_rest nonce is publicly emitted to unauthenticated visitors on the /wishlist/ page, and the attacker controls the transient key, meaning the payload is stored site-wide and only requires a victim to open a crafted share URL and click the injected title link. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.2.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the comment to be approved by an administrator and for the affected post to contain at least one iframe or video element (e.g., a core Video block), which is sufficient under default plugin settings where video lazy loading is enabled.
The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 3.8.4.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable when public registration is enabled and the registration form includes a Profile Picture field; the attacker registers via the publicly accessible form (nonce is emitted to unauthenticated visitors) to store the payload, then logs in as the newly created Subscriber to post a comment that triggers delivery to all page visitors.
The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin up to version 2.1.5 contains a path traversal vulnerability that allows unauthenticated attackers to delete media library attachments and their files. This occurs because the AJAX handler 'get_table_data()' lacks nonce verification and capability checks, enabling attackers to supply crafted parameters to trigger deletion of media files by numeric attachment ID. Files outside the uploads directory cannot be deleted via this vulnerability.
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's (missing_srcsets[*][*].s)' parameter in all versions up to, and including, 4.2.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The HMAC signature required to pass the REST endpoint's authorization check is published in plaintext to unauthenticated visitors inside the inline optimoleDataOptimizer JavaScript object on any page with an incomplete profile, making the effective authentication barrier nonexistent.