The AskAny WordPress plugin versions before 2.2.0 have a vulnerability where the plugin does not properly validate the extension or content of files attached to chat messages. It relies on the browser-supplied file type, allowing unauthenticated users to upload PHP files and potentially execute arbitrary code if visitor attachments are enabled.
The AutomatorWP WordPress plugin versions before 6.0.8 contain a vulnerability where requests completing Zoom and AWeber integration connections are not bound to the initiating administrator. This allows a logged-in administrator to be tricked via a CSRF attack into replacing stored integration credentials with those controlled by an attacker, redirecting data sent to these services. Exploitation requires the integration to be already connected and knowledge of the site's OAuth client identifier.
The Security For WooCommerce WordPress plugin versions through 1.0.16 have a vulnerability where unauthenticated users can reset two-factor authentication enrollment without authorization. This flaw allows attackers to remove the second factor from any user account or all accounts at once.
The Smoove abandoned cart trigger for WooCommerce WordPress plugin versions before 4.3.6 does not properly sanitise and escape abandoned-cart data submitted by visitors. This flaw allows unauthenticated users to perform stored cross-site scripting (XSS) attacks against administrators by injecting malicious scripts that are executed in the admin dashboard.
The Security For WooCommerce WordPress plugin up to version 1.0.16 has a vulnerability that allows unauthenticated users to request and obtain a user's current two-factor authentication (2FA) code or secret. This flaw enables attackers to bypass the second factor of authentication on sites using this plugin's one-time password library.
The Security For WooCommerce WordPress plugin up to version 1.0.16 has a vulnerability where one of its REST API routes is accessible without authentication. This flaw allows unauthenticated users to retrieve the plugin's full settings, including secret keys and the hidden login URL.
The Photo Engine WordPress plugin versions before 6.6.2 allow users with the Author role and above to delete media synced by other users, including administrators, without proper permission checks. This vulnerability enables unauthorized permanent deletion of media within collections.
The Schema & Structured Data for WP & AMP WordPress plugin versions prior to 1.70 contain a vulnerability where the plugin does not verify if the importing user has permission to edit posts referenced in a settings backup. This flaw allows users with access to the plugin's settings to modify, re-author, unpublish, trash any post or page, and write arbitrary post metadata on the site.
The Live Composer WordPress plugin versions before 2.1.24 contain a vulnerability where several attributes of a page-builder shortcode are not properly escaped before being output inside HTML tag attributes. This flaw allows users with Contributor role or higher to store malicious payloads that execute in the browsers of anyone viewing the affected post, including administrators reviewing submissions.
The Security For WooCommerce WordPress plugin up to version 1.0.16 has a vulnerability where several REST API routes are not properly restricted. This flaw allows unauthenticated users to generate login tokens for any user and retrieve them, enabling unauthorized login as any user, including administrators.
The Redirection for Contact Form 7 WordPress plugin versions before 3.2.16 does not verify ownership of email addresses submitted via its data request form action. This flaw allows unauthenticated users to create verified personal data erasure or export requests for email addresses they do not control.
The Knowledge Building WordPress plugin versions before 0.7.3 contain a reflected cross-site scripting (XSS) vulnerability. This occurs because several user-supplied values are not properly escaped before being echoed back in the response of an AJAX action accessible to unauthenticated users. The response is served as HTML, enabling potential injection of malicious scripts.
A vulnerability in the Event Tickets and Registration WordPress plugin before version 5.30.3.1 allows unauthenticated users to access attendee data for private and non-public events. This occurs because the plugin does not properly restrict access to attendee information based on event visibility permissions.
The ProfilePress WordPress plugin versions before 4.17.6 contain a vulnerability where negative membership plan identifiers are not properly rejected before checking plan activation status. This flaw allows unauthenticated visitors to sign up for membership plans that administrators have deactivated and gain the associated roles.
The ProfilePress WordPress plugin versions prior to 4.17.4 have a vulnerability where the plugin does not verify if a membership plan is still active during checkout when changing an existing subscription. This allows subscribers to subscribe to membership plans that the site owner has deactivated, including free plans that assign user roles.
The Schema & Structured Data for WP & AMP WordPress plugin versions before 1.70 contain a vulnerability where structured data output is not safely encoded when the Pretty Print option is enabled. This flaw allows users with Contributor-level roles to perform stored cross-site scripting (XSS) attacks by mapping a schema property to a custom field.
The NotificationX WordPress plugin versions before 3.3.7 lack capability and nonce checks on a REST route, allowing unauthenticated users to update plugin options and trigger repeated emails via the site's mail server.
The Schema & Structured Data for WP & AMP WordPress plugin versions prior to 1.70 contain an authorization flaw that allows users with the Contributor role or higher, if granted access to the plugin, to modify structured data settings of posts they do not own. This occurs because the plugin does not verify whether the user has permission to edit the post before allowing changes to its structured data.
The Dynific Addons for Elementor WordPress plugin before version 1.3.1 has a vulnerability where it does not properly check user status or capabilities when resolving post identifiers in a shortcode. This allows authenticated users with at least the Contributor role to access draft, private, and password-protected posts of other users. Additionally, users with the Author role can republish this content to anonymous visitors.
The Data Tables Generator by Supsystic WordPress plugin versions before 1.15.8 lacks proper authorization or ownership checks when returning stored table contents. Instead, it relies solely on a nonce that is accessible to all anonymous visitors. This flaw allows unauthenticated users to access the full contents of any table by its identifier, including tables that are unpublished and not visible on the site.