The Booking for Appointments and Events Calendar – Amelia WordPress plugin up to version 2.4.12 has a vulnerability that allows unauthenticated attackers to access sensitive personal information. This includes staff full names, email addresses, phone numbers, gender, timezones, and internal administrator notes for published events. The exposure occurs because the plugin fails to remove the raw providers array from JSON responses when processing the 'page' parameter.
The local-commander-agent npm package version 0.3.52 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted computer. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
A privilege escalation vulnerability exists in the User Frontend plugin for WordPress versions up to and including 4.3.13. Authenticated users with Subscriber-level access or higher can exploit this flaw by injecting a specially crafted shortcode into a published post, which renders a registration form that allows creation of Editor-level accounts with active sessions. This occurs due to inconsistent sanitization of the post_content parameter and bypass of shortcode blocklist checks.
The Wp Social Login and Register Social Counter WordPress plugin up to version 3.2.2 contains an authentication bypass vulnerability. This flaw allows unauthenticated attackers to gain authenticated sessions as any existing WordPress user, including administrators, by exploiting improper verification of OAuth provider email addresses. The vulnerability arises because the plugin's REST callback accepts any email returned by Facebook or Twitter OAuth providers without proper verification, enabling attackers controlling an OAuth account with a matching email to bypass password checks.
Content Pilot – Autoblogging & Affiliate Marketing Suite plugin for WordPress versions up to 2.2.4 is vulnerable to a stored cross-site scripting (XSS) flaw. The vulnerability arises from improper sanitization of HTML meta descriptions extracted from remotely fetched articles, which are then stored and rendered without filtering. This allows unauthenticated attackers controlling RSS feed content to inject malicious scripts that execute when users view the affected pages.
The WPO365 | MICROSOFT 365 GRAPH MAILER WordPress plugin is affected by a stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 6.2. This vulnerability arises from insufficient input sanitization and output escaping of the 'Subject' parameter used in mail-sending features. An unauthenticated attacker can inject malicious scripts that execute when users access the affected pages. The issue is present immediately after plugin activation if OAuth authorization is not completed, which is the default state. A fix is available for this vulnerability.
The Project Manager plugin for WordPress (versions up to 4.1.1) contains a critical vulnerability allowing unauthenticated remote code execution via the 'id' parameter. This occurs because the 'id' parameter is unsanitized and used directly in a dynamic PHP function call without allowlist validation. The vulnerability bypasses authorization checks due to WordPress core executing the validation callback before permission checks. This flaw has a CVSS score of 9.8, indicating a critical severity level.
The Redux Framework WordPress plugin up to version 4.5.15 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can view sensitive configuration data, including plaintext passwords, API keys, license keys, and SMTP credentials, exposed in the admin profile page. This occurs because the plugin does not properly verify user authorization for certain actions. The vulnerability affects all sites running Redux Framework due to the automatic loading of the Users extension by any registered Redux instance.
The Perfect Images WordPress plugin (versions up to and including 7.2.0) has a missing authorization check in its /wp-json/wp-retina-2x/v1/replace REST API endpoint. This vulnerability allows authenticated users with Author-level or higher privileges to replace files they do not own within the plugin's functionality.
The WP2LEADS WordPress plugin up to version 3.5.6 contains a time-based SQL Injection vulnerability in the 'order' parameter. This flaw allows authenticated users with Subscriber-level access or higher to inject additional SQL queries due to insufficient input escaping and query preparation. Exploitation can lead to unauthorized extraction of sensitive database information. The vulnerability has a CVSS score of 6.5, indicating a medium severity risk.
The User Frontend plugin for WordPress by wedevs, versions up to 4.3.13, is vulnerable to reflected cross-site scripting (XSS) via the 'field_attr[required]' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. The nonce check intended to protect the AJAX action is ineffective because the nonce value is publicly accessible to anonymous visitors, enabling attackers to harvest it and bypass protections.
SEOPress – AI SEO Plugin & On-site SEO for WordPress versions up to 10.3 is vulnerable to stored Cross-Site Scripting (XSS) via the 'display_name' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view affected pages. The vulnerability arises because the plugin substitutes a token in display names after escaping, allowing script injection through crafted display names containing the %%archive_title%% token and HTML event handlers.
The Uncanny Toolkit for LearnDash WordPress plugin versions up to 3.8.2 contains an authentication bypass vulnerability via the email parameter in the uo_login_action() function. This flaw allows unauthenticated attackers to bypass account verification and suspension controls by exploiting a discrepancy in how the plugin and WordPress core sanitize the email input. Attackers with valid credentials for a target account can obtain a valid session cookie without proper approval, enabling unauthorized access. The required nonce for exploitation is publicly accessible, making the attack trivial for anyone with network access and knowledge of the credentials.
The Shield Security plugin for WordPress, up to version 22.3.2, contains a stored cross-site scripting (XSS) vulnerability via the 'REQUEST_URI' parameter. This vulnerability arises from insufficient input sanitization and output escaping in a hidden 'path' column rendered by DataTables using innerHTML, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. A partial fix in version 18.5.8 addressed escaping in a visible column but left the hidden 'path' field vulnerable through version 22.2.6.
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps WordPress plugin versions up to 5.5.88 contains a missing authorization vulnerability. This flaw allows unauthenticated attackers to access sensitive information via the 'rel_tab' parameter if an administrator has published an app with REST API authorization set to 'anonymous'. Exploitation can expose all rows and columns of the underlying database tables, including sensitive user data such as password hashes, email addresses, and password-reset keys from the wp_users table.
A stored cross-site scripting (XSS) vulnerability exists in the PublishPress Authors plugin for WordPress, specifically in the Co-Authors, Multiple Authors and Guest Authors in an Author Box component. The flaw affects all versions up to and including 4.17.0 and allows authenticated users with subscriber-level access or higher to inject malicious scripts via the 'name' parameter. Exploitation requires the attacker to have a mapped author term, which is assigned by an administrator or created automatically for their role. This vulnerability can lead to script execution in the context of users visiting the affected pages.
The Rox Appointment Booking plugin for WordPress up to version 1.3.1 contains a privilege escalation vulnerability via mass assignment. An unauthenticated attacker can inject an arbitrary WordPress user ID into a customer record through a public REST endpoint. If an administrator later opens and updates this poisoned record, the attacker's supplied user ID and email are used to update the administrator's account, enabling full account takeover via password reset. Exploitation requires the attacker to know or guess a valid administrator user ID and for an administrator to interact with the malicious record.
The Product Filter for WooCommerce by WBW plugin for WordPress versions up to 3.4.6 contains a missing authorization vulnerability. This flaw allows unauthenticated attackers to manipulate the 'filterSettings[default_query]' parameter in the 'filtersFrontend' AJAX action, bypassing capability and nonce checks. As a result, attackers can enumerate non-public WooCommerce products, including drafts and pending items, and retrieve their count and rendered listings. The vulnerability also permits unbounded queries that can load all products in a single request.
The Hustle plugin for WordPress up to version 7.8.14.3 has an authorization bypass vulnerability. Authenticated users with the hustle_create capability can overwrite the site's active email service provider (ESP) integration credentials, redirecting lead submissions to an attacker-controlled ESP account. For HubSpot integrations, attackers can also irreversibly delete critical OAuth tokens and options. This flaw arises from improper authorization checks in the plugin's handlers.
The Welcart e-Commerce WordPress plugin up to version 2.12.5 contains an improper authentication vulnerability via the 'member[ID]' parameter. This flaw allows unauthenticated attackers to overwrite any shop member's email and password by supplying the member's numeric ID, enabling full account takeover. Exploitation requires bypassing a wp_verify_nonce() check, but the nonce is exposed to unauthenticated visitors on the New Enrollment Form, making exploitation feasible without prior authentication or special configuration.