A vulnerability in the Event Tickets and Registration WordPress plugin before version 5.30.3.1 allows unauthenticated users to retrieve the names of attendees for events that do not display a public attendee list. This occurs because the plugin does not properly verify whether an event's attendee list is public before returning attendee information via the REST API.
The iChart WordPress plugin versions before 2.2.4 contain an authorization bypass vulnerability due to missing capability and ownership checks in several AJAX actions. The plugin relies solely on a nonce accessible to any logged-in user, allowing users with minimal privileges (Subscriber role) to read, modify, delete arbitrary posts, and overwrite a site-wide option. This flaw is fixed in version 2.2.4.
A vulnerability in the Redirection for Contact Form 7 WordPress plugin before version 3.2.16 allows unauthenticated users to create verified personal data erasure or export requests for email addresses they do not own. This occurs because the plugin does not verify ownership of the email address supplied through its data request form action and marks such requests as already confirmed by default.
The Simpler Checkout WordPress plugin versions before 1.5.4 contain an improper privilege management vulnerability. This flaw allows subscribers on stores that have not completed the plugin setup to log in as administrators due to an empty automatic login key until configuration is complete. The issue is fixed in version 1.5.4.
A reflected Cross-Site Scripting (XSS) vulnerability exists in the Knowledge Building WordPress plugin versions before 0.7.3. The flaw arises because several user-supplied values are not properly escaped before being echoed back in the response of an AJAX action accessible to unauthenticated users, with the response served as HTML. This allows an attacker to inject malicious scripts that could execute in the context of users viewing the affected content.
The Knowledge Building WordPress plugin versions before 0.7.3 contain a stored cross-site scripting (XSS) vulnerability in the reply comment feature. This flaw allows unauthenticated users to submit comments that are not sanitized or escaped and are published without moderation. As a result, attackers can execute stored XSS attacks against any visitor of the affected posts, including administrators. The vulnerability is fixed in version 0.7.3.
AskAny WordPress plugin versions before 2.2.0 allow unauthenticated users to upload files with dangerous types, such as PHP, due to lack of proper validation of file extensions or content. This vulnerability enables arbitrary code execution when visitor attachments are enabled. The issue is fixed in version 2.2.0.
AutomatorWP WordPress plugin versions before 6.0.8 contain a Cross-Site Request Forgery (CSRF) vulnerability in its Zoom and AWeber integration connections. This flaw allows an attacker to trick a logged-in administrator into replacing stored integration credentials with the attacker's own, redirecting data sent to these services to the attacker's account. Exploitation requires the integration to be connected and knowledge of the site's OAuth client identifier. The issue is fixed in version 6.0.8.
A cross-site scripting (XSS) vulnerability exists in the Live Composer WordPress plugin versions before 2.1.24. This flaw allows users with Contributor role or higher to inject malicious scripts via certain shortcode attributes, which are not properly escaped before being output inside HTML tag attributes. The payload executes in the browsers of anyone viewing the affected post, including administrators reviewing submissions.
A path traversal vulnerability (CWE-22) exists in the Gravity Forms WordPress plugin versions before 3.2.2. This flaw allows unauthenticated users to upload files without proper file type restrictions via the chunked file upload feature. On servers configured to parse Server-Side Include (SSI) documents, such as Apache with SSI enabled, attackers can read server environment variables and files within the web root.
NotificationX WordPress plugin versions before 3.3.7 contain a missing authorization vulnerability in one of its REST routes. This flaw allows unauthenticated users to update plugin options and repeatedly trigger emails sent through the site's mail server.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Schema & Structured Data for WP & AMP WordPress plugin versions before 1.70. This occurs when the Pretty Print option is enabled and the plugin does not safely encode structured data output, allowing users with Contributor role privileges to inject malicious scripts via custom fields mapped to schema properties.
The Schema & Structured Data for WP & AMP WordPress plugin before version 1.70 has a vulnerability that allows unauthenticated attackers to access approved comments on private, draft, and password-protected posts. This occurs because the plugin does not verify if a post is publicly viewable before returning its approved comments via the review feature. The issue affects all versions from 0 up to but not including 1.70.
The Schema & Structured Data for WP & AMP WordPress plugin before version 1.70 contains an authorization bypass vulnerability. This flaw allows users with the Contributor role or higher, who have been granted access to the plugin, to modify structured data settings of posts they do not own. The vulnerability arises because the plugin does not verify whether a user has permission to edit a post before allowing changes to its structured data. This issue is fixed in version 1.70.
A missing authorization vulnerability in the Schema & Structured Data for WP & AMP WordPress plugin before version 1.70 allows users with access to the plugin's settings to modify, re-author, unpublish, or trash any post or page on the site and write arbitrary post meta. This occurs because the plugin does not verify that the importing user has permission to edit the posts named in a settings backup, nor does it restrict the import to its own post types.
A Server-Side Request Forgery (SSRF) vulnerability exists in the Limit Login Attempts Security WordPress plugin versions before 3.4.2. This flaw allows users with administrator privileges to cause the site to make HTTP requests to arbitrary hosts, including internal network addresses, due to improper validation of a user-supplied setup value.
A SQL injection vulnerability exists in the WP Directory Kit WordPress plugin versions before 1.6.3. This flaw arises because the plugin does not properly sanitize and escape a parameter used in a SQL statement. Users with the custom Listing Admin role or higher can exploit this to perform SQL injection attacks. The issue is fixed in version 1.6.3.
WP Directory Kit versions before 1.6.3 contain a vulnerability that allows unauthenticated attackers to access sensitive user information. The plugin's public directory-search action does not restrict which database models and columns it returns, nor does it verify authorization. This flaw exposes personal data such as email addresses, logins, and private contact-form submissions to unauthorized actors.
CVE-2026-118241 is an authorization bypass vulnerability in the Smush WordPress plugin versions before 4.3.6. The plugin fails to verify that a user is authorized to act on a targeted media attachment, only checking a broad upload-files capability. This allows users with the Author role and above to optimize and restore media attachments owned by other users, potentially altering files on disk and consuming stored backups.
A vulnerability in the Contest Gallery WordPress plugin before version 34.0.3 allows authenticated users with Author-level access or higher to upload files with arbitrary names and extensions via the e-commerce sale file-replacement feature. This lack of sanitization enables overwriting of directory protection files, potentially leading to remote code execution.