The WP Data Access plugin for WordPress versions up to and including 5.5.89 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient output escaping in the autocomplete lookup label of the Simple Form feature. Authenticated users with Subscriber-level access or higher who can edit lookup rows via legacy forms can inject malicious scripts. These scripts execute when any user, including higher-privileged users, accesses the affected page, potentially compromising user sessions or data.
SEOPress – AI SEO Plugin & On-site SEO for WordPress versions up to 10.3 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper sanitization and escaping of the 'seopress_google_analytics_affiliate_tracking' and 'seopress_google_analytics_download_tracking' settings, allowing injection of arbitrary scripts. Authenticated users with Subscriber-level access or higher, given delegated analytics capability, can exploit this to execute malicious scripts in pages viewed by other users.
Unlimited Elements for Elementor WordPress plugin versions up to 2.0.26 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious scripts via the title or description fields inside an attacker-controlled RSS feed body. The vulnerability arises from insufficient input sanitization and output escaping, particularly due to the plugin's escaping pre-processor excluding certain raw content positions. Exploitation requires the site administrator to have placed the RSS Feed catalog widget pointing to a feed URL controlled by the attacker.
The Quiz and Survey Master (QSM) plugin for WordPress up to version 11.2.7 contains a code injection vulnerability that allows unauthenticated attackers to execute arbitrary shortcodes. This occurs because the plugin improperly validates input before calling do_shortcode, and the nonce used for submission is accessible without authentication, providing no effective protection against exploitation.
The Komfortkasse for WooCommerce WordPress plugin versions prior to 1.4.9 improperly validate REST API request authenticity by overriding WordPress's nonce verification. This flaw allows a request forged in a logged-in administrator's browser to be accepted, enabling an attacker to create a new administrator account and fully take over the site.
The Advanced Custom Fields (ACF®) WordPress plugin versions before 6.8.11 contain a vulnerability where the plugin does not verify user permissions before modifying bidirectional relationship fields. This allows users with contributor-level access or higher to add or remove references to their own objects on posts, users, or terms they cannot normally edit.
The iLeads SMS Gateway WordPress plugin before version 2.0.0 contains a vulnerability where several AJAX actions do not verify user capabilities or nonces. This flaw allows any authenticated user, including low-privileged roles such as subscribers, to modify arbitrary WordPress site options. An attacker can exploit this to escalate privileges to administrator, for example by enabling user registration with the administrator role as default.
The Add From Server Lite WordPress plugin versions prior to 6.0.0 allow users with the Author role and above to upload SVG files containing JavaScript. This occurs because the plugin does not restrict SVG uploads to users permitted to post unfiltered HTML, enabling stored cross-site scripting (XSS) attacks.
The Fiber Admin WordPress plugin versions before 4.0.1 contains a vulnerability where it does not validate or escape a request header before writing it into a PHP file during an unprotected admin hook. This flaw allows unauthenticated attackers to execute arbitrary code if the plugin's custom database error page is enabled and the attacker can win a race condition against an administrator saving settings.
The Live Composer WordPress plugin versions before 2.1.23 contain a vulnerability where a pagination setting supplied through post-listing module shortcodes is not properly escaped before being output in an HTML attribute. This flaw allows users with Contributor role or higher to execute Stored Cross-Site Scripting (XSS) attacks.
The Fiber Admin WordPress plugin versions before 4.0.1 lack authorization checks in certain AJAX actions. This vulnerability allows unauthenticated users to reorder arbitrary posts, including drafts, private posts, and navigation menu items, as well as reorder taxonomy terms when term ordering is enabled.
The Magic Link WordPress plugin versions before 2.2.6 contains a vulnerability where it does not verify if a user requesting a login link is authorized to generate one for the targeted account. This flaw allows any authenticated user, including low-privilege roles such as subscribers, to generate a valid login link for an administrator account and gain unauthorized access.
The Tournamatch WordPress plugin versions prior to 4.7.1 contain a vulnerability where the plugin does not validate or restrict the path of a previously stored profile or team image before deleting it during a new image upload. This flaw allows users with minimal privileges, such as Subscribers, to delete arbitrary files on the server, including critical files like wp-config.php, potentially leading to a full site takeover.
The Directorist WordPress plugin versions before 8.11 have a vulnerability where the checkout payment-retry REST action does not verify that the order belongs to the requesting user. This flaw allows any authenticated user, including subscribers, to create payment-attempt records on orders owned by other users.
The Event Tickets with Ticket Scanner WordPress plugin versions before 3.2.9 contain a vulnerability where search values are not properly escaped before being used in SQL queries in several admin listings. This flaw allows users with admin area access to perform SQL injection attacks. By default, only administrators have this access, but other roles may be granted it through plugin settings.
The Advanced Custom Fields (ACF®) WordPress plugin versions prior to 6.8.11 lack a read-permission check when rendering and formatting relational field values. This flaw allows users with post-editing capabilities (Contributor role and above) to view titles and non-public statuses of unpublished posts owned by other users.
The Advanced Custom Fields (ACF®) WordPress plugin versions before 6.8.11 have a vulnerability where field-group location rules are not re-applied when saving values through the post editor. This allows users with contributor-level access and above to write custom fields that are normally restricted to administrators onto their own posts.
The Event Tickets with Ticket Scanner WordPress plugin versions before 3.1.14 have an authorization flaw that allows users with access to the plugin's admin area, including roles as low as Subscriber, to view and remove ticket data from WooCommerce orders without proper permission checks.
The Tournamatch WordPress plugin versions prior to 4.7.1 have a vulnerability where the team invitation listing is not properly access-restricted. This flaw allows unauthenticated users to access and retrieve email addresses of individuals invited to join teams.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that could allow an authenticated privileged attacker to send unauthorized requests from the system. This vulnerability may enable the attacker to enumerate network resources or facilitate further attacks. The vulnerability has a low CVSS score of 3.8 and does not have known exploits in the wild.