The NotificationX WordPress plugin versions before 3.3.7 lack capability and nonce checks on a REST route, allowing unauthenticated users to update plugin options and trigger repeated emails via the site's mail server.
The Schema & Structured Data for WP & AMP WordPress plugin versions prior to 1.70 contain an authorization flaw that allows users with the Contributor role or higher, if granted access to the plugin, to modify structured data settings of posts they do not own. This occurs because the plugin does not verify whether the user has permission to edit the post before allowing changes to its structured data.
The Dynific Addons for Elementor WordPress plugin before version 1.3.1 has a vulnerability where it does not properly check user status or capabilities when resolving post identifiers in a shortcode. This allows authenticated users with at least the Contributor role to access draft, private, and password-protected posts of other users. Additionally, users with the Author role can republish this content to anonymous visitors.
The Data Tables Generator by Supsystic WordPress plugin versions before 1.15.8 lacks proper authorization or ownership checks when returning stored table contents. Instead, it relies solely on a nonce that is accessible to all anonymous visitors. This flaw allows unauthenticated users to access the full contents of any table by its identifier, including tables that are unpublished and not visible on the site.
Sleipnir Mobile for iPhone / iPad and its Black Edition by Fenrir Inc. have a vulnerability involving improper certificate verification. This flaw could allow a man-in-the-middle attacker to intercept encrypted communications. The vulnerability has a medium severity rating with a CVSS score of 4.2. No specific affected versions or patches are currently identified.
The Download Manager WordPress plugin versions before 3.3.73 and before 7.6.2 contain a vulnerability where the plugin does not verify a package's configured role restriction when validating a package password. This flaw allows an unauthenticated user who knows the password of a role-restricted package to obtain a download key and download the protected file.
The Pay with a tweet WordPress plugin versions through 1.0.5 contains a vulnerability where it does not validate file paths before deleting files and lacks access restrictions on administration screens. This flaw allows users with the Subscriber role to delete arbitrary files on the server, potentially leading to full site compromise.
The WP Directory Kit WordPress plugin versions before 1.6.3 contain a vulnerability where a parameter is not properly sanitized and escaped before being used in a SQL statement. This flaw allows users with the custom Listing Admin role or higher to perform SQL injection attacks.
The Dynific Addons for Elementor WordPress plugin versions before 1.3.1 lack proper capability and nonce checks on an AJAX action that saves module configuration. This flaw allows any authenticated user, including those with Subscriber roles, to enable or disable plugin modules site-wide.
A stored cross-site scripting (XSS) vulnerability exists in the Dynific Addons for Elementor WordPress plugin versions before 1.3.1. The plugin fails to properly escape post titles before outputting them in a quoted HTML attribute within an Elementor widget. This allows authenticated users with the Author role to publish posts with titles that execute arbitrary scripts in the browsers of users who view them, including administrators.
The Forminator Forms WordPress plugin versions before 1.58.4 have a vulnerability where the plugin does not verify that a Stripe Checkout payment has completed before returning the post-payment redirect URL and thank-you message. This allows unauthenticated visitors to access payment-gated form responses without actually paying.
The Contest Gallery WordPress plugin versions before 34.0.3 contain a vulnerability in the e-commerce sale file-replacement feature where file names are not properly sanitized. Authenticated users with Author-level access or higher can upload files with arbitrary names and extensions to a web-accessible directory. By overwriting the directory's protection file, these users can achieve remote code execution on the server.
The WP Directory Kit WordPress plugin versions before 1.6.3 have a vulnerability where the public directory-search action does not restrict access to database models and columns, nor verify authorization. This allows unauthenticated attackers to access personal user data such as email addresses, logins, and private contact-form submissions.
The Somatic Framework WordPress plugin versions up to 1.8.14 contain a vulnerability where no authorization check or validation of user-supplied file paths is performed before deleting files. This flaw allows any authenticated user, including low-privileged roles such as subscribers, to delete arbitrary files on the server. Exploitation of this vulnerability can lead to a full site takeover.
The Limit Login Attempts Security WordPress plugin versions before 3.4.2 contains a server-side request forgery (SSRF) vulnerability. This flaw allows users with administrator privileges to cause the site to send requests to arbitrary hosts, including internal network addresses, due to lack of validation on a user-supplied setup value.
The Dynific Addons for Elementor WordPress plugin versions before 1.3.1 contains a stored cross-site scripting (XSS) vulnerability. This flaw allows authenticated users with the Author role to inject malicious scripts via a user-controlled profile value that is not properly escaped in a quoted attribute within an Elementor widget. When an administrator or any user views a post authored by the attacker, the stored payload executes in their session.
The Forminator Forms WordPress plugin versions prior to 1.58.4 contain a vulnerability where payment enforcement is not performed on the server side if the configured payment gateway is unavailable. This allows unauthenticated users to bypass payment requirements on payment-gated User Registration forms and gain assigned roles, including administrator, once the gateway is reconnected and then disconnected.
The Smush WordPress plugin versions before 4.3.6 have an authorization flaw where users with the Author role or higher can optimize and restore media attachments owned by other users. This occurs because the plugin only checks a broad upload-files capability rather than verifying specific ownership or authorization for the targeted media. This allows unauthorized modification of other users' media files and consumption of stored backups.
The Schema & Structured Data for WP & AMP WordPress plugin versions before 1.70 has a vulnerability where it does not verify if a post is publicly viewable before returning approved comments. This flaw allows unauthenticated attackers to access approved comments on private, draft, and password-protected posts, as well as retrieve approved comments across the site.
The Printaura-Woocommerce WordPress plugin versions through 4.0.2 improperly restrict access to the WooCommerce REST API. This vulnerability allows unauthenticated attackers to access all WooCommerce REST routes, enabling them to read and modify sensitive store data such as customer orders, personal information, store and payment settings, and webhooks.