The Newsletters plugin for WordPress up to version 4.18.1 is vulnerable to a time-based SQL Injection via the 'id' parameter. This vulnerability arises from insufficient escaping and lack of proper preparation of the SQL query involving user-supplied input. Authenticated attackers with subscriber-level access or higher can exploit this flaw to append additional SQL queries and extract sensitive database information. Attackers can obtain necessary authentication tokens without a WordPress account by subscribing through the public newsletter form and using the management link sent via email. The ownership check only verifies the subscriber_id field and does not confirm that the injected 'id' parameter belongs to the authenticated subscriber.
The Shield Security WordPress plugin up to version 22.3.2 is vulnerable to stored cross-site scripting (XSS) via the 'REQUEST_URI' parameter due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when a user accesses the affected page. The issue stems from the hidden 'path' column in ForTraffic.php, which is rendered using innerHTML without proper escaping, making it exploitable despite a partial fix applied only to the visible 'page' column in version 18.5.8.
CVE-2026-116964 is a high-severity vulnerability in konflux-ci that allows an attacker with repository write access to execute arbitrary code within the CI/CD workflow environment. The flaw arises from manifest synchronization scripts dynamically evaluating unvalidated script output via injected shell commands. Exploitation can compromise CI/CD pipelines, expose sensitive authentication tokens and deployment credentials, and lead to unauthorized access to production systems. Mitigation currently relies solely on user review of pull requests or merge requests to prevent malicious commits from being approved.
CVE-2026-117681 is a vulnerability in konflux-ci where the user interface proxy disables TLS certificate verification for internal backend service connections in environments without a default service certificate authority. This allows an adjacent network attacker who can intercept traffic to capture a cluster-scoped authentication token with user impersonation rights, potentially leading to full administrative control of the cluster. The issue primarily affects non-OpenShift Kubernetes clusters lacking the platform's automatic service CA. Red Hat classifies this vulnerability as important but notes that standard OpenShift environments are not impacted due to enforced TLS verification.
The User Frontend WordPress plugin up to version 4.3.13 contains a privilege escalation vulnerability via the post_content parameter in the submit_post() function. An attacker with Subscriber-level access can inject a specially crafted shortcode that bypasses shortcode filtering, enabling the creation of an Editor-level account with active session privileges on the frontend. This occurs due to inconsistent sanitization methods and conditional shortcode registration tied to is_admin() checks.
The WP Activity Log plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 5.6.1. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.
The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'Subject' parameter used in mail-sending features. This vulnerability affects all versions up to and including 6.2 and allows unauthenticated attackers to inject malicious scripts that execute when a user views the affected page. The issue arises due to insufficient input sanitization and output escaping, particularly when OAuth authorization is not completed immediately after plugin activation.
The SEOPress AI SEO Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'display_name' parameter affecting all versions up to and including 10.3. Authenticated users with subscriber-level access or higher can inject malicious scripts via their display name, which are then executed when other users view the affected pages. This occurs due to insufficient input sanitization and output escaping in the plugin's handling of the %%archive_title%% token combined with WordPress's storage of display names without HTML filtering.
The Content Pilot plugin for WordPress versions up to and including 2.2.4 is vulnerable to stored cross-site scripting (XSS). The vulnerability arises because the plugin processes HTML meta descriptions from remotely fetched articles without proper sanitization before storing them as post content. This allows unauthenticated attackers who control RSS feed content configured in the plugin to inject malicious scripts that execute when users view the affected pages.
The WP Data Access – App Builder plugin for WordPress has a vulnerability in all versions up to 5.5.88 that allows unauthenticated attackers to extract sensitive information via the 'rel_tab' parameter. This includes database rows such as WordPress user password hashes, email addresses, and password-reset keys. Exploitation requires that an administrator has published at least one app with REST API authorization set to 'anonymous', which is the default for publicly embedded apps.
The Product Filter for WooCommerce by WBW plugin for WordPress up to version 3.4.6 has a missing authorization vulnerability in its 'filtersFrontend' AJAX action. This flaw allows unauthenticated attackers to manipulate query parameters and enumerate non-public WooCommerce products, including drafts and pending items, and to perform unbounded queries that retrieve all products in a single request.
The Redux Framework plugin for WordPress up to version 4.5.15 suffers from an authorization bypass vulnerability. This flaw allows authenticated users with subscriber-level access or higher to view sensitive configuration data, including plaintext passwords, API keys, license keys, and SMTP credentials, exposed in the inline JavaScript on the wp-admin/profile.php page. The vulnerability arises because the plugin does not properly verify user authorization for certain actions. The Users extension, which is automatically loaded for every Redux instance, causes all sites using Redux Framework to be affected regardless of explicit configuration.
The WP2LEADS WordPress plugin versions up to and including 3.5.6 contain a time-based SQL Injection vulnerability via the 'order' parameter. This flaw allows authenticated users with Subscriber-level access or higher to inject additional SQL queries due to insufficient escaping and lack of proper query preparation. Exploitation can lead to unauthorized extraction of sensitive database information.
The Product Filter for WooCommerce by WBW plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability via the 'wpf_fid' JSON parameter in all versions up to and including 3.4.6. The flaw is due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with crafted content. The vulnerability remains in versions patched at 3.4.3 because the sanitization was incomplete, leaving the JSON-decoded filterSettings payload unsanitized.
The Wp Social Login and Register Social Counter plugin for WordPress contains an authentication bypass vulnerability in all versions up to and including 3.2.2. The flaw arises because the plugin's social login REST callback endpoint allows unauthenticated attackers to log in as any existing WordPress user by presenting an OAuth provider email that matches the target user's registered email. The verification intended to confirm email authenticity is ineffective for Facebook and Twitter adapters, enabling attackers to bypass password checks and gain full authenticated sessions without local credentials or prior access.
The User Frontend WordPress plugin up to version 4.3.13 is vulnerable to reflected cross-site scripting (XSS) via the 'field_attr[required]' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. The nonce check intended to protect the AJAX action is ineffective because the nonce value is publicly accessible to anonymous visitors, enabling attackers to harvest it and bypass protections.
The Seraphinite Accelerator WordPress plugin versions up to and including 2.29.24 contain a vulnerability that allows unauthenticated attackers to access sensitive user information. This occurs through predictable gzip-serialized cache files when the plugin's Object Cache feature is enabled. Attackers can extract user data such as usernames, emails, hashed passwords, and activation keys by triggering caching of the target user record and then retrieving the cache file.
The Popup Builder WordPress plugin up to version 4.4.5 contains an authorization bypass vulnerability that allows unauthenticated attackers to trash all published popups with a single GET request. This is caused by improper authorization checks and is worsened by a logic flaw in the SGPopup::find() function, which triggers the trashing action on all popups when a specific parameter is present.
The UsersWP WordPress plugin versions up to 1.2.78 contain a vulnerability that allows unauthorized account access via predictable passwords. The plugin uses a shared password for 25 built-in dummy user accounts derived from a hash that is also exposed in a hidden form field on the public registration page and AJAX handler, even when registration is disabled. This exposure enables unauthenticated attackers to retrieve the dummy user password and log in as any dummy account, potentially escalating privileges if those accounts have elevated roles. Exploitation requires that an administrator has previously created dummy users via the plugin's Tools page.
The Rox Appointment Booking plugin for WordPress up to version 1.3.1 contains a privilege escalation vulnerability via mass assignment. An unauthenticated attacker can exploit a public REST endpoint to inject an arbitrary WordPress user ID into a customer record. When an administrator later edits and saves this record, the attacker's supplied user ID and email are used to update the administrator's account, enabling account takeover through password reset. Exploitation requires the attacker to know or guess a valid administrator user ID and for an administrator to interact with the poisoned record.