The Mail logging & Catcher plugin for WordPress versions up to and including 2.2.0 is vulnerable to sensitive information exposure via the 'message' parameter. Authenticated users with subscriber-level access or higher can extract administrator password-reset keys from stored email logs if the plugin's default_view_role setting is configured to allow low-privileged users to access logs. This vulnerability enables privilege escalation to administrator by completing the password-reset flow. By default, the plugin restricts log access to administrators only, which mitigates exploitation on untouched installs.
A stored cross-site scripting (XSS) vulnerability exists in the PublishPress Authors plugin for WordPress affecting all versions up to and including 4.17.0. The flaw is due to insufficient input sanitization and output escaping of the 'name' parameter mapped to display_name. Authenticated users with subscriber-level access or higher can exploit this by injecting malicious scripts that execute when other users view the affected pages. Exploitation requires the attacker to have a mapped author term, which occurs when assigned as a co-author or if automatic author term creation is enabled for their role. This mapping is not present by default on a stock installation.
The W3 Total Cache plugin for WordPress up to and including version 2.10.7 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping when HTML Minify is enabled with the default 'mfunc' entry in the ignored-comment stems list. Exploitation requires an attacker to predict a time-based placeholder namespace by reading the server clock from the HTTP Date header. Successful exploitation allows injection of arbitrary scripts that execute when users access the affected pages.
The Perfect Images WordPress plugin up to version 7.2.0 has a vulnerability due to a missing capability check on a REST API endpoint. This flaw allows authenticated users with Author-level access or higher to modify files they do not own via the /wp-json/wp-retina-2x/v1/replace API.
The Welcart e-Commerce plugin for WordPress up to version 2.12.5 suffers from an Insecure Direct Object Reference (IDOR) vulnerability via the 'member[ID]' parameter. This flaw allows unauthenticated attackers to overwrite any shop-member account's email and password by specifying the member's numeric ID. Exploitation requires bypassing a wp_verify_nonce() check, but the nonce is publicly available on the New Enrollment Form, enabling full account takeover without any prior authentication or special configuration.
The User Submitted Posts WordPress plugin is vulnerable to stored DOM-based cross-site scripting (XSS) via the 'user-submitted-content' parameter in all versions up to and including 20260916. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. By default, submitted posts require admin approval before becoming visible, limiting exposure. However, if the plugin's 'publish immediately' option is enabled, injected scripts become live without moderation.
The Project Manager plugin for WordPress versions up to 4.1.1 contains a critical remote code execution vulnerability via the 'id' parameter. This flaw arises because the 'id' parameter is unsanitized and directly concatenated into a validation rule string, which is then split and each token executed as a dynamic PHP function without an allowlist. Due to the way WordPress processes REST API routes, the authorization check is bypassed, allowing unauthenticated attackers to execute arbitrary code on the server.
The FunnelKit Automations plugin for WordPress and WooCommerce is vulnerable to a time-based SQL Injection via the 'bwfan_cart_id' parameter in all versions up to and including 3.8.5.2. This vulnerability allows unauthenticated attackers to inject SQL queries during a guest checkout process, potentially extracting sensitive database information. The attack requires only a publicly obtainable WooCommerce cart nonce and is executed in two steps involving a scheduled Action Scheduler job.
The WP Booking System - Booking Calendar plugin for WordPress versions up to and including 2.1.0.5 contains a vulnerability that allows authenticated users with Subscriber-level access or higher to delete arbitrary calendar notes. This is due to a missing capability check in the wpbs_action_ajax_calendar_remove_note() function, enabling unauthorized modification of data.
The ThirstyAffiliates WordPress plugin up to version 3.12.1 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the site to use block themes like Twenty Twenty-Five and that the attacker has a previously approved comment, enabling subsequent crafted comments to be auto-approved and publicly rendered.
The Relevanssi – A Better Search plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 4.28.5. This vulnerability arises from insufficient input sanitization and output escaping of the 'comment' parameter. Exploitation requires that the site has both comment indexing and comment highlighting enabled. An unauthenticated attacker can inject malicious scripts that execute when a user visits a singular page via a Relevanssi search-result permalink with the highlight query parameter.
The VikRentCar Car Rental Management System plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'poplink' parameter affecting all versions up to and including 1.4.9. This flaw allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. The vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires a WordPress nonce token (vikwp_nonce), which the plugin exposes to unauthenticated visitors on the public booking-confirmation page, enabling attackers to obtain a valid token without authentication.
The Welcart e-Commerce plugin for WordPress versions up to and including 2.12.5 is vulnerable to stored cross-site scripting (XSS) via the 'gid' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. The attack involves forging a ROBOT PAYMENT browser-return request to store a malicious 'gid' value in order metadata, which executes when an administrator views the order in the WordPress admin panel.
The WP Job Portal WordPress plugin up to version 2.7.0 is vulnerable to stored cross-site scripting (XSS) via the 'degreetitle' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The plugin allows self-registration, enabling any visitor to create an account capable of exploiting this vulnerability.
The Photo Reviews for WooCommerce WordPress plugin up to version 1.2.31 contains a vulnerability that allows unauthenticated attackers to delete any media library attachment file. This occurs because the plugin's delete_reviews_image() function trusts attachment IDs from a public POST parameter without verifying ownership or user capabilities. Attackers can embed malicious attachment IDs in review comments and trigger deletion when a moderator removes the review or when WordPress's scheduled trash cleanup runs. The nonce used does not prevent exploitation as it is publicly available on product pages.
The Hustle WordPress plugin (up to version 7.8.14.3) has an authorization bypass vulnerability that allows authenticated users with the hustle_create capability to overwrite the site's active email service provider (ESP) integration credentials. This can redirect lead submissions to an attacker-controlled ESP account and, in the case of HubSpot, delete critical OAuth tokens irreversibly.
The VikRentCar Car Rental Management System plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'optionals' parameter. This vulnerability affects all versions up to and including 1.4.10. It allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.
The Shipping Zones by Drawing for WooCommerce plugin for WordPress versions up to and including 3.3.0 is vulnerable to stored cross-site scripting (XSS) via the 'szbd-picked' checkout parameter. An unauthenticated attacker can submit a crafted JSON payload during guest checkout that injects malicious attributes into a Google Maps link in the WooCommerce admin order view. This malicious code executes when an administrator views the injected order, potentially compromising the admin interface.
The Discussion Board WordPress Forum Plugin is vulnerable to stored cross-site scripting (XSS) in versions up to and including 2.6.0. The vulnerability arises from insufficient output escaping of the user profile Website (user_url) field, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. These scripts execute when any user views a Discussion Board topic containing the attacker's reply.
The W3 Total Cache plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter affecting all versions up to and including 2.10.7. This vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires that a Pro license was previously active with REST caching enabled but is now inactive while Disk Enhanced page caching remains configured, and that the attacker has a previously approved commenter identity.