The WP Data Access – App Builder plugin for WordPress contains an Incorrect Authorization vulnerability in all versions up to and including 5.5.89. This flaw allows authenticated users with Subscriber-level access or higher to bypass write restrictions and modify arbitrary database rows and columns, including the administrator's password. Exploitation requires that an administrator has published a Data App enabling write transactions for Subscriber-level or anonymous users. Unauthenticated exploitation is possible only if the Data App is configured with anonymous REST API authorization and enabled write transactions. This vulnerability can lead to full site takeover by escalating privileges to administrator.
The User Frontend WordPress plugin versions up to and including 4.3.13 are vulnerable to stored Cross-Site Scripting (XSS) via the taxonomy_field_name parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. Exploitation requires the plugin to have a taxonomy field configured in text-input mode with guest post submission enabled on at least one frontend form.
The WP Visitor Statistics (Real Time Traffic) plugin for WordPress up to version 8.9.0 is vulnerable to a stored cross-site scripting (XSS) flaw. This vulnerability arises from insufficient input sanitization and output escaping of the 'os' parameter (and related parameters 'browser' and 'res'). An unauthenticated attacker can inject malicious scripts that execute when a user views the affected page.
The WP Visitor Statistics (Real Time Traffic) plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 8.7.1. This vulnerability arises from insufficient input sanitization and output escaping of the 'browser' parameter. An unauthenticated attacker can inject malicious scripts via an HTTP request to the public visitor tracking endpoint, which execute in the context of an authenticated administrator's browser when viewing affected pages.
The JetFormBuilder plugin for WordPress versions up to and including 3.6.7 is vulnerable to stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject malicious scripts via any form field name parameter. Exploitation requires the targeted form to have the Save Form Record action enabled and a form-level Form Record preset configured. The injected script executes only when a privileged user visits the front-end form page with the attacker's submitted record ID in the preset's record query variable.
The Dynific Addons for Elementor WordPress plugin (formerly Anywhere Elementor) contains a vulnerability allowing unauthenticated attackers to execute arbitrary shortcodes. This affects all versions up to and including 1.3.0. Exploitation requires that the target site has a public post rendered through an AE template including the AE Post Comments widget, and that the attacker's comment is visible on that page, which typically requires a previously approved comment or relaxed comment moderation.
The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in all versions up to and including 1.15.0.2. This flaw allows unauthenticated attackers to access full billing personally identifiable information (PII) of any store order by enumerating sequential order IDs via the 'order-pay' query parameter. The vulnerability arises from missing validation on this user-controlled parameter, causing sensitive data to be exposed in a JavaScript object on the order-pay page regardless of WooCommerce's own order-key validation.
The Falang multilanguage plugin for WordPress versions up to and including 1.4.6 is vulnerable to a stored cross-site scripting (XSS) flaw. Authenticated users with subscriber-level access or higher can exploit this vulnerability by injecting malicious scripts via a specific parameter. The vulnerability arises from insufficient input sanitization and output escaping. The exploit is facilitated by the exposure of a required nonce to any logged-in user through an unprotected AJAX handler.
A critical buffer overflow vulnerability exists in TOTOLINK CA300-PoE firmware version 6.2c.884, specifically in the setWiFiBasicConfig function of /cgi-bin/cstecgi.cgi. The flaw is triggered by manipulating the KeyStr argument remotely, potentially allowing complete compromise of confidentiality, integrity, and availability. Public exploit code has been disclosed. No patch or remediation information is currently available.
The Image Hover Effects Ultimate WordPress plugin (up to version 9.12.2) contains a stored cross-site scripting (XSS) vulnerability via the 'rawdata.oxi_image_comparison_before_text' parameter. Authenticated users with subscriber-level access or higher can exploit this when the plugin's "Who can edit" setting is configured to allow subscribers to edit styles. This lack of ownership checks enables injection of arbitrary scripts that execute when a user views the affected page.
The Football Pool WordPress plugin up to version 2.13.5 is vulnerable to stored cross-site scripting (XSS) via the 'shouttext' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute in the admin Edit view for a shout. Other views such as the public Shoutbox widget and admin list view properly escape output, limiting the impact to the admin Edit view.
The Naimur Email OTP Verification for WooCommerce plugin for WordPress versions up to 2.1.0 contains an authentication bypass vulnerability. This flaw allows unauthenticated attackers to take over user accounts if the account owner previously requested and verified a password-reset code but did not complete the reset process. The vulnerability arises because the plugin authorizes password resets solely based on a database row marked as 'VERIFIED' without timestamp checks, session binding, or per-reset tokens. Additionally, a scheduled cleanup event intended to clear expired OTPs is never executed, leaving verified states lingering. Exploitation requires only the victim's email and a publicly localized nonce, enabling attackers to overwrite passwords and gain authenticated sessions, potentially leading to full site takeover for administrator accounts.
SQL::Abstract versions before 2.000003 for Perl contain a vulnerability that allows SQL injection via an array reference used as a column value in insert and update operations. By default, the array_datatypes option is off, causing arrayref values to be treated as literal SQL, which leads to injection if untrusted input is passed. This affects insert(), update(), values(), and generate() methods, including when AUTOLOAD is enabled with allow_autoload on. This vulnerability can be exploited by passing specially crafted arrayref data, such as JSON arrays or repeated form fields decoded as arrays, resulting in unescaped SQL fragments.
The Link Library plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'link_description' parameter in all versions up to and including 7.10.0. This vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires the site administrator to enable the non-default 'Convert [] to <> in Link Description and Notes' setting, which reconstructs payloads into executable HTML. An unauthenticated attacker can inject arbitrary scripts that execute when users access the affected pages.
The Motors WordPress plugin (up to version 1.4.125) has an arbitrary file deletion vulnerability due to insufficient file path validation in a specific AJAX function. Authenticated users with subscriber-level access or higher can delete files within the wp-content/uploads directory. This can lead to remote code execution if critical files are deleted. The vulnerability is exploitable because the required AJAX nonce is exposed on all front-end pages and user metadata controlling the deletion path is writable by any logged-in user for their own account.
The weDocs WordPress plugin up to version 2.6.1 contains a stored cross-site scripting (XSS) vulnerability via the 'modalPlaceholder' block attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when admins or editors preview or view the affected posts. This vulnerability arises from insufficient input sanitization and output escaping.
The Booking for Appointments and Events Calendar – Amelia Pro plugin for WordPress contains a time-based SQL Injection vulnerability in the 'tag[] (array KEYS)' parameter. This affects all versions up to and including 9.9.1. The flaw arises from insufficient escaping of user-supplied array keys, allowing unauthenticated attackers to inject additional SQL queries and potentially extract sensitive database information.
The Dynific Addons for Elementor WordPress plugin up to version 1.3 is vulnerable to an SQL Injection via the 'q' parameter. This flaw arises from improper escaping of user input in the ae_preview_post() AJAX handler and its preview_post_filter() callback, allowing authenticated users with Subscriber-level access or higher to inject SQL code. The vulnerability enables attackers to extract sensitive database information. The CVSS score is 6.5, indicating a medium severity risk.
The Quttera ThreatSign – Web Malware Scanner for WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability via the HTTP_USER_AGENT parameter in all versions up to and including 4.1.0.48. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrator views the infected page.
A missing authorization vulnerability exists in HivePress up to version 1.8.1, allowing exploitation due to incorrectly configured access control security levels. This flaw permits unauthorized access to certain functionality or data without proper permission checks.