The Payable Payment Gateway for WooCommerce plugin prior to version 1.3.1 contains a missing authorization vulnerability. This flaw allows unauthenticated attackers to alter the payment status of any WooCommerce order, marking it as paid or failed without verifying the authenticity of incoming payment notifications.
The Quick Event Manager WordPress plugin versions from 8.4.6 up to but not including 9.19 contain a vulnerability where unauthenticated users can access the content of draft and private posts via calendar export functionality. This occurs because the plugin does not verify the status or type of the requested post before returning its details. The issue is fixed in version 9.19.
A missing authorization vulnerability in the Mapster WP Maps WordPress plugin before version 2.0.6 allows unauthenticated attackers to overwrite post titles, create published posts, and modify the plugin's stored settings via a REST API route.
A vulnerability in the All-in-One Video Gallery WordPress plugin before version 5.0.0 allows unauthenticated users to access sensitive information. The plugin does not verify a video's publication status before displaying it, exposing titles and source URLs of private, draft, pending, scheduled, and trashed videos by their ID.
A cross-site scripting (XSS) vulnerability exists in the Firelight Lightbox WordPress plugin before version 2.3.24. The plugin does not properly escape image attribute values, allowing users with contributor-level access or higher to inject arbitrary scripts. These scripts execute when other users view or preview the affected content. This issue is fixed in version 2.3.24.
A vulnerability in the BuddyForms WordPress plugin before version 2.10.1 allows unauthenticated attackers to delete media files uploaded by other unauthenticated visitors. This occurs because the plugin does not properly verify ownership before deleting guest-uploaded attachments.
The Security Optimizer WordPress plugin versions before 1.6.9 contain an improper authentication vulnerability. This flaw allows unlimited submission of two-factor authentication codes during a pending login. An attacker who already knows a user's password can brute force the second factor, potentially taking over the user's account.
A vulnerability in the Premium Packages WordPress plugin before version 7.2.2 allows unauthenticated visitors to overwrite the stored price of items in their shopping cart. This flaw enables attackers to create orders for any product at an arbitrary total price of their choosing.
A path traversal vulnerability exists in the Bulk Media Register WordPress plugin before version 2.01. This flaw allows users with the Author role to move or rename arbitrary files on the server, including files outside the WordPress root directory. This can bypass directory-level access controls and potentially disclose protected files.
A privilege management vulnerability exists in the Essential Addons for Elementor WordPress plugin before version 6.8.8. Authenticated users with Author-level access or higher can manipulate the role assigned to accounts created via the plugin's registration form, potentially granting higher privileges such as Editor to new accounts, including those created by unauthenticated visitors. Versions 6.6.0 through 6.8.7 remain vulnerable due to an incomplete fix of a previous issue (CVE-2026-5193).
The Payment Forms for Paystack WordPress plugin versions before 4.0.6 improperly restrict access to a configuration page, allowing users with Contributor role or higher to view sensitive payment gateway API credentials. These credentials include both live and test secret keys, which provide full access to the site owner's payment account. This vulnerability is fixed in version 4.0.6.
The PPWP – Password Protect Pages WordPress plugin up to version 1.9.26 is vulnerable to a stored Cross-Site Scripting (XSS) flaw via the 'desc_below_form' shortcode attribute and comment parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. The issue arises from insufficient input sanitization and output escaping combined with WordPress comment filtering behavior and auto-approval of comments from previously approved users.
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress versions up to 3.15.5 is vulnerable to arbitrary shortcode execution. This vulnerability arises because the plugin does not properly validate input before executing shortcodes via do_shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes.
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress contains a missing authorization vulnerability in all versions up to and including 2.20.4. This flaw allows unauthenticated attackers to delete theme files on the server due to insufficient file path validation in the '__construct' function.
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress versions up to 3.15.5 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient input sanitization and output escaping of the 'formData.extra' parameter. Unauthenticated attackers can inject arbitrary scripts that execute when users access the affected pages. The vulnerability is exacerbated by the nf_ajax_submit endpoint issuing a valid nonce on failure, bypassing nonce protections and enabling trivial exploitation via a single unauthenticated request.
WordPress Core versions from 4.7 through 7.1.3 are affected by a time-of-check to time-of-use (TOCTOU) race condition vulnerability. This flaw arises from predictable, web-accessible staging paths used during full-package core upgrades, allowing unauthenticated attackers to execute arbitrary code on the server during the upgrade process. The vulnerability has a high severity with a CVSS score of 8.1.
The Meow Lightbox plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'post_content (bbPress reply body)' parameter in all versions up to and including 5.6.4. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary JavaScript that executes in the context of users viewing the affected pages. Exploitation requires specific conditions including enabled Output Buffering, the HtmlDomParser engine, Aggressive Resolve, and a stored-HTML submission surface with a permissive kses allow-list for img attributes.
The NextGEN Gallery WordPress plugin (Photo Gallery, Sliders, Proofing and Themes) up to version 4.5.4 is vulnerable to stored DOM-based cross-site scripting (XSS) via the 'comment' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view affected pages, but exploitation requires the site to use the Shutter or Shutter Reloaded lightbox and for the injected comment to be approved through WordPress moderation.
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress versions up to 3.15.5 contains a code injection vulnerability. Authenticated users with subscriber-level access or higher can exploit this flaw by setting their display name to a shortcode string and triggering its execution on a page configured by an administrator with a specific merge tag. This allows arbitrary shortcode execution due to improper validation before calling do_shortcode.