The Cozy Blocks plugin for WordPress versions up to 2.2.27 is vulnerable to stored cross-site scripting (XSS) via certain block attribute parameters due to insufficient input sanitization and output escaping. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because wp_kses_post does not fully neutralize quote-only attribute-breakout payloads lacking '<' characters, leaving exploitable JSON attributes intact at render time.
The Hustle plugin for WordPress versions up to 7.8.14.3 is vulnerable to stored cross-site scripting (XSS) via the 'content[cta_label]' parameter. Authenticated users with custom-level access or higher can inject malicious scripts that execute when other users view the affected pages. By default, only administrators have the capability to edit modules, but this can be delegated to lower roles such as Subscribers, potentially allowing exploitation at lower privilege levels.
The Document Embedder plugin for WordPress up to version 2.4.0 is vulnerable to stored DOM-based cross-site scripting (XSS). Authenticated users with contributor-level access or higher can inject malicious scripts via the content parameter. The exploit triggers when a user clicks the embedded document's Download button, causing execution of attacker-controlled scripts due to improper input sanitization and output escaping.
The Post Snippets – Custom WordPress Code Snippets Customizer plugin up to version 4.2.4 is vulnerable to stored cross-site scripting (XSS) via shortcode attributes. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because entity-encoded payloads bypass WordPress's wp_kses_post sanitization and are decoded by the plugin's shortcode filter at render time. This requires snippet shortcodes to be enabled for exploitation.
The Hustle plugin for WordPress versions up to 7.8.14.3 contains a stored cross-site scripting (XSS) vulnerability in the 'content[title]' parameter. This flaw allows authenticated users with custom-level access and the 'Create and Update Modules' capability granted via the plugin's permissions settings to inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires explicit permission delegation by an administrator and is not enabled by default.
The Product Addons for Woocommerce – Product Options with Custom Fields WordPress plugin up to version 3.1.8 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient input sanitization and output escaping of the 'fields[section][fields][row][col][type]' parameter. Authenticated users with shop manager-level privileges or higher can exploit this to inject malicious scripts that execute when other users view the affected pages.
CMB2, a WordPress plugin by jtsternberg, contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 2.13.4. The flaw exists in the 'cmb43ex1_grp[0][txt]' wysiwyg field inside a repeatable group, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the plugin's front-end form helper with this specific field configuration to be rendered on a publicly accessible page. The vulnerability arises from insufficient input sanitization and output escaping.
The easy.jobs WordPress plugin up to version 2.8.2 contains a stored cross-site scripting (XSS) vulnerability in the 'icon' attribute of its Gutenberg block. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping of user-supplied attributes.
The Mang Board plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'align' parameter affecting all versions up to and including 2.4.5. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when any user views the affected page. The vulnerability arises because the input is not properly sanitized or escaped, and the payload bypasses WordPress's wp_kses_post filter by avoiding angle brackets, allowing the malicious code to persist and execute in viewers' browsers.
The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter in all versions up to and including 4.7.2. This vulnerability arises from improper input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The issue is due to the plugin's fallback regex incorrectly processing allowed attribute values, enabling injection of active HTML attributes such as event handlers.
The VikRentCar Car Rental Management System WordPress plugin is vulnerable to stored Cross-Site Scripting (XSS) via the 'className' parameter in all versions up to and including 1.4.10. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, where wp_kses_post() does not effectively neutralize the payload due to the injection context within an HTML attribute. This flaw allows script injection despite some sanitization attempts.
The Webheadcoder Multi-Step Forms for Contact Form 7 WordPress plugin versions up to and including 4.7 contain a reflected cross-site scripting (XSS) vulnerability via the 'l10n_print_after' parameter. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link. Exploitation requires the targeted site to have at least one Contact Form 7 form configured with a [multistep] form-tag. The vulnerability is mitigated in non-multistep forms starting from version 4.7 due to canonicalization that blocks the attack path.
The Avada (Fusion) Builder WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in versions up to and including 3.16.2. This flaw arises from insufficient input sanitization and output escaping of the 'tab_index' and 'empty_notice' parameters. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability persists because the wp_kses_post function does not remove the payload due to its location within shortcode attribute text, which is treated as plain text rather than HTML.
The If-So Dynamic Content – Elementor & All Page Builders Personalization WordPress plugin up to version 1.10.2 is vulnerable to stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping in multiple parameters. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability has a CVSS score of 6.4, indicating a medium severity risk.
The Postie WordPress plugin up to version 1.9.87 is vulnerable to a stored cross-site scripting (XSS) flaw via the Email Body URL Autolink feature. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. The ?postie=get-mail endpoint is accessible without authentication or capability checks, and the plugin disables WordPress's usual output filters before saving content, enabling the storage of unescaped href attributes that execute when users view the affected pages.
The Waitlist Woocommerce (Back in stock notifier) WordPress plugin up to version 2.9.1 is vulnerable to stored Cross-Site Scripting (XSS) via the 'type' shortcode attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This occurs because the plugin does not properly sanitize or escape shortcode attribute input, and the wp_kses_post filter does not mitigate this due to how shortcode attributes are handled at render time.
The If-So Dynamic Content – Elementor & All Page Builders Personalization WordPress plugin up to version 1.10.2 contains a stored cross-site scripting (XSS) vulnerability via the 'conversion' shortcode attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.
Cozy Blocks – Website Builder for WordPress Block Editor plugin versions up to 2.2.27 are vulnerable to stored cross-site scripting (XSS) via the productRating.iconColor parameter. This vulnerability allows authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages. The issue occurs only when the productRating option is enabled and the associated WooCommerce product has a non-zero rating.
The s2Member WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'date_format' parameter in versions up to and including 261011. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, allowing payloads that bypass WordPress's wp_kses_post() filter by using backslash-escaped sequences which PHP's date() function converts into HTML tag characters at render time.
The DesignSetGo WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'tagName' parameter in versions up to and including 2.11.0. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when an administrator runs the plugin's block-conversion migration. Exploitation requires administrator action to activate the payload, limiting direct attacker control.