The Security For WooCommerce WordPress plugin versions through 1.0.16 contain a vulnerability that allows unauthenticated users to forcibly log out any user, including administrators, by exploiting a lack of authorization checks when ending user sessions. Attackers can repeatedly send logout requests to keep targeted users logged out.
The Knowledge Building WordPress plugin versions before 0.7.3 contain a vulnerability where comments submitted through the reply feature are not properly sanitized or escaped. This flaw allows unauthenticated users to inject stored cross-site scripting (XSS) payloads, which are then published without moderation. As a result, any visitor to the affected posts, including administrators, can be subjected to these XSS attacks.
The Security For WooCommerce WordPress plugin up to version 1.0.16 lacks authorization checks before executing bulk plugin and WordPress core updates. This flaw allows unauthenticated users to trigger the installation of all pending updates on the affected site.
The ProfilePress WordPress plugin versions before 4.17.6 have a vulnerability where some content protection rules are not properly evaluated when content is rendered outside the main query. This flaw allows unauthenticated users to access protected page content via the REST API.
The iChart WordPress plugin versions before 2.2.4 lack proper capability and ownership checks in multiple AJAX actions. Instead, they rely solely on a nonce accessible to any logged-in user, including those with the Subscriber role. This flaw allows such users to read, modify, and permanently delete arbitrary posts and overwrite a site-wide option.
A vulnerability in the Gravity Forms WordPress plugin before version 3.2.2 allows unauthenticated users to upload files without proper file type restrictions via its chunked file upload feature. This flaw can lead to unauthorized reading of server environment variables and file contents within the web root on servers configured to parse Server-Side Include (SSI) documents, such as Apache with SSI enabled.
The Security For WooCommerce WordPress plugin up to version 1.0.16 contains a vulnerability where it does not verify if the requester is authorized before executing certain comment cleanup actions. This flaw allows unauthenticated users to permanently delete all comments on the site, including approved comments and WooCommerce order notes.
A vulnerability in the Event Tickets and Registration WordPress plugin before version 5.30.3.1 allows unauthenticated users to retrieve the names of attendees for events that do not display a public attendee list. This occurs because the plugin does not properly verify whether an event's attendee list is public before returning attendee information via the REST API.
The Simpler Checkout WordPress plugin versions before 1.5.4 have a vulnerability where the plugin does not properly restrict order creation permissions and uses an automatic login link with a key that remains empty until the store owner completes plugin setup. This flaw allows subscriber-level users on stores that have not completed setup to log in as administrators.
The Security For WooCommerce WordPress plugin up to version 1.0.16 lacks proper authorization checks when resetting its settings. This flaw allows unauthenticated users to reset any section of the plugin's configuration to default values, potentially disabling critical security features such as custom login URLs, two-factor authentication, reCAPTCHA, password policies, and the firewall.
The Photo Engine WordPress plugin versions before 6.6.2 do not properly sanitize and escape keyword names before storing and displaying them on a debugging page. This flaw allows users with the Author role and above to perform stored cross-site scripting (XSS) attacks against administrators who view the debugging page.
The AskAny WordPress plugin versions before 2.2.0 have a vulnerability where the plugin does not properly validate the extension or content of files attached to chat messages. It relies on the browser-supplied file type, allowing unauthenticated users to upload PHP files and potentially execute arbitrary code if visitor attachments are enabled.
The AutomatorWP WordPress plugin versions before 6.0.8 contain a vulnerability where requests completing Zoom and AWeber integration connections are not bound to the initiating administrator. This allows a logged-in administrator to be tricked via a CSRF attack into replacing stored integration credentials with those controlled by an attacker, redirecting data sent to these services. Exploitation requires the integration to be already connected and knowledge of the site's OAuth client identifier.
The Security For WooCommerce WordPress plugin versions through 1.0.16 have a vulnerability where unauthenticated users can reset two-factor authentication enrollment without authorization. This flaw allows attackers to remove the second factor from any user account or all accounts at once.
The Smoove abandoned cart trigger for WooCommerce WordPress plugin versions before 4.3.6 does not properly sanitise and escape abandoned-cart data submitted by visitors. This flaw allows unauthenticated users to perform stored cross-site scripting (XSS) attacks against administrators by injecting malicious scripts that are executed in the admin dashboard.
The Security For WooCommerce WordPress plugin up to version 1.0.16 has a vulnerability that allows unauthenticated users to request and obtain a user's current two-factor authentication (2FA) code or secret. This flaw enables attackers to bypass the second factor of authentication on sites using this plugin's one-time password library.
The Security For WooCommerce WordPress plugin up to version 1.0.16 has a vulnerability where one of its REST API routes is accessible without authentication. This flaw allows unauthenticated users to retrieve the plugin's full settings, including secret keys and the hidden login URL.
The Photo Engine WordPress plugin versions before 6.6.2 allow users with the Author role and above to delete media synced by other users, including administrators, without proper permission checks. This vulnerability enables unauthorized permanent deletion of media within collections.
The Schema & Structured Data for WP & AMP WordPress plugin versions prior to 1.70 contain a vulnerability where the plugin does not verify if the importing user has permission to edit posts referenced in a settings backup. This flaw allows users with access to the plugin's settings to modify, re-author, unpublish, trash any post or page, and write arbitrary post metadata on the site.
The Live Composer WordPress plugin versions before 2.1.24 contain a vulnerability where several attributes of a page-builder shortcode are not properly escaped before being output inside HTML tag attributes. This flaw allows users with Contributor role or higher to store malicious payloads that execute in the browsers of anyone viewing the affected post, including administrators reviewing submissions.