The WPO365 | MICROSOFT 365 GRAPH MAILER WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'Subject' parameter used in mail sending features. This vulnerability affects all versions up to and including 6.2 and allows unauthenticated attackers to inject malicious scripts that execute when a user views the affected page. The issue arises from insufficient input sanitization and output escaping, particularly when OAuth authorization has not been completed after plugin activation.
A reflected cross-site scripting (XSS) vulnerability exists in the User Frontend plugin by wedevs for WordPress, affecting all versions up to and including 4.3.13. The flaw arises from insufficient input sanitization and output escaping of the 'field_attr[required]' parameter. An unauthenticated attacker can exploit this by tricking a user into clicking a crafted link, leading to arbitrary script execution. The nonce check intended to protect the AJAX action wpuf_get_child_cat is ineffective because the nonce value is publicly accessible to anonymous visitors, allowing attackers to harvest it freely.
SEOPress – AI SEO Plugin & On-site SEO for WordPress versions up to 10.3 is vulnerable to a stored cross-site scripting (XSS) flaw via the 'display_name' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view affected pages. The vulnerability arises from insufficient sanitization and output escaping related to the substitution of the %%archive_title%% token after escaping has occurred.
The Shield Security plugin for WordPress, used for bot blocking, brute-force login protection, and file scanning, contains a stored cross-site scripting (XSS) vulnerability in the 'REQUEST_URI' parameter. This affects all versions up to and including 22.3.2. The vulnerability arises because the hidden 'path' column in ForTraffic.php is rendered using innerHTML without proper escaping, allowing injection of arbitrary scripts that execute when a user accesses the affected page. A partial fix was applied in version 18.5.8 but did not address the hidden 'path' field, leaving the issue exploitable through version 22.2.6. The CVSS 3.1 score is 7.2, indicating high severity.
A stored cross-site scripting (XSS) vulnerability exists in the PublishPress Authors plugin for WordPress, affecting the Co-Authors, Multiple Authors and Guest Authors in an Author Box component. The flaw is due to insufficient input sanitization and output escaping of the 'name' parameter mapped to display_name. Authenticated users with subscriber-level access or higher who have a mapped author term can inject malicious scripts that execute when other users view the affected pages. This vulnerability affects all versions up to and including 4.17.0.
The Shipping Zones by Drawing for WooCommerce WordPress plugin up to version 3.3.0 is vulnerable to a stored cross-site scripting (XSS) flaw via the 'szbd-picked' checkout parameter. This vulnerability allows unauthenticated attackers to inject malicious attributes into the Google Maps link shown in the WooCommerce admin order view, potentially executing arbitrary code when an administrator views the order.
The VikRentCar Car Rental Management System WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the 'optionals' parameter. This vulnerability exists in all versions up to and including 1.4.10 due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject malicious scripts that execute when users access the affected pages. The vulnerability has a high severity rating with a CVSS score of 7.2.
Welcart e-Commerce plugin for WordPress versions up to 2.12.5 is vulnerable to stored Cross-Site Scripting (XSS) via the 'gid' parameter. An unauthenticated attacker can inject malicious scripts by forging a browser-return request, which stores the payload in order metadata. The script executes when an administrator views the infected order in the WordPress admin panel.
The VikRentCar Car Rental Management System WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'poplink' parameter in versions up to and including 1.4.9. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access affected pages. The exploit requires only a WordPress nonce token that the plugin exposes publicly, enabling attackers to obtain a valid token without authentication.
The PDF Invoices & Packing Slips for WooCommerce WordPress plugin is affected by a stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 5.16.4. The flaw arises from insufficient input sanitization and output escaping in parameters such as billing_address.first_name, last_name, company, and customer_note. An incomplete fix introduced in version 5.16.2 fails to block entity-encoded payloads, allowing attackers to inject arbitrary scripts that execute when a user views the affected page.
The Product Filter for WooCommerce by WBW plugin for WordPress suffers from a reflected cross-site scripting (XSS) vulnerability via the 'wpf_fid' JSON parameter in all versions up to and including 3.4.6. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link. The issue persists despite a patch in version 3.4.3 because the sanitization was only applied to one data path, leaving the JSON-decoded payload unsanitized.
The User Submitted Posts – Enable Users to Submit Posts from the Front End WordPress plugin contains a stored DOM-based cross-site scripting (XSS) vulnerability in the 'user-submitted-content' parameter. This affects all versions up to and including 20260916. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users view the injected content. By default, submitted posts are held pending admin approval, limiting exposure. However, if the plugin's 'publish immediately' option is enabled, the malicious payload becomes live without moderation.
The Discussion Board – WordPress Forum Plugin up to version 2.6.0 contains a stored cross-site scripting (XSS) vulnerability in the user profile Website (user_url) field. This vulnerability arises from improper output escaping in the function that formats comment author links, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. These scripts execute when any user views a topic containing the attacker's reply.
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website plugin for WordPress versions up to 2.7.0 is vulnerable to stored Cross-Site Scripting (XSS) via the 'degreetitle' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The plugin's self-registration feature allows any visitor to create a subscriber-backed employer account, enabling exploitation by any site visitor.
The Relevanssi – A Better Search WordPress plugin up to version 4.28.5 contains a stored cross-site scripting (XSS) vulnerability via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires that both comment indexing and comment highlighting options are enabled, and the malicious payload activates when a visitor accesses a singular page through a Relevanssi search-result permalink with the highlight query parameter.
The ThirstyAffiliates WordPress plugin up to version 3.12.1 is vulnerable to a stored cross-site scripting (XSS) flaw via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the site to use block themes where the Comment Content block triggers the plugin's transformer, and the attacker must have one previously approved comment to enable auto-approval of crafted comments. The vulnerability can lead to script execution in users' browsers when they view the injected pages.
W3 Total Cache plugin for WordPress versions up to 2.10.7 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability requires HTML Minify to be enabled with the default 'mfunc' entry in the ignored-comment stems list. Exploitation depends on predicting a placeholder namespace derived from the server time. The flaw allows unauthenticated attackers to inject scripts that execute when users access the affected pages.
SureCart, a WordPress plugin for ecommerce, is affected by a stored cross-site scripting (XSS) vulnerability in versions up to and including 4.9.4. The flaw exists due to insufficient sanitization and escaping of the 'comment' parameter, allowing unauthenticated attackers to inject malicious scripts. These scripts execute when users visit pages that load SureCart's web-component bundle and display the injected comment, which must be auto-approved or moderator-approved.
The Webmention plugin for WordPress up to version 5.10.1 is vulnerable to stored cross-site scripting (XSS) via the Open Graph og:title meta tag in a webmention source URL. This vulnerability arises from insufficient input sanitization, allowing unauthenticated attackers to inject arbitrary scripts that persist in comments and execute when viewed by users. Exploitation requires an administrator to approve the malicious webmention comment before the payload executes.
The W3 Total Cache WordPress plugin is affected by a stored Cross-Site Scripting (XSS) vulnerability in the 'comment' parameter in all versions up to and including 2.10.7. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires that a Pro license was previously active with REST caching enabled but is now inactive while Disk Enhanced page caching remains configured, and that the attacker has a previously approved commenter identity.