The Dynific Addons for Elementor WordPress plugin before version 1.3.1 has a vulnerability that allows authenticated users with Contributor role or higher to access draft, private, and password-protected posts of other users without proper authorization. Additionally, users with Author role can republish this content to anonymous visitors. This issue arises from missing status or capability checks when resolving post identifiers in a shortcode.
A vulnerability in Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before version 1.3.1 allows any authenticated user, including those with minimal privileges such as Subscribers, to enable or disable plugin modules site-wide due to missing capability and nonce checks on an AJAX action that saves module configuration.
A stored cross-site scripting (XSS) vulnerability exists in the Dynific Addons for Elementor WordPress plugin before version 1.3.1. The flaw allows authenticated users with the Author role to publish posts with titles that execute malicious scripts in the browsers of users who view them, including administrators.
A stored cross-site scripting (XSS) vulnerability exists in the Dynific Addons for Elementor WordPress plugin versions before 1.3.1. Authenticated users with the Author role can inject malicious scripts via a user-controlled profile value that is not properly escaped before output in an Elementor widget. This payload executes in the browser session of anyone viewing the attacker's post, including administrators.
The Somatic Framework WordPress plugin versions up to 1.8.14 contain a vulnerability where it fails to perform authorization checks or validate user-supplied file paths before deleting files. This flaw allows any authenticated user, including low-privileged roles like subscribers, to delete arbitrary files on the server. Exploitation of this vulnerability can lead to a full site takeover.
The Pay with a tweet WordPress plugin versions up to 1.0.5 contains a vulnerability where it does not validate file paths before deleting files and does not restrict access to administrative functions. This allows users with the Subscriber role to delete arbitrary files on the server, potentially leading to full site compromise.
The Printaura-Woocommerce WordPress plugin versions up to 4.0.2 improperly restrict access to the WooCommerce REST API, allowing unauthenticated requests to all REST routes. This vulnerability enables attackers to read and modify sensitive store data, including customer orders, personal information, store and payment settings, and webhooks.
A vulnerability in the Forminator Forms WordPress plugin before version 1.58.4 allows unauthenticated users to access the post-payment redirect URL and thank-you message of payment-gated forms without completing a Stripe Checkout payment. This occurs because the plugin does not verify that the payment has completed before returning the after-payment response.
A vulnerability in the Forminator Forms WordPress plugin before version 1.58.4 allows unauthenticated visitors to bypass payment requirements on payment-gated User Registration forms when the configured payment gateway is unavailable. This flaw enables attackers to complete the registration without paying and be assigned the form's configured user role, potentially up to administrator, after the gateway has been connected and then disconnected.
A vulnerability in the Download Manager WordPress plugin before versions 3.3.73 and 7.6.2 allows unauthenticated users who know the password of a role-restricted package to bypass role restrictions and download protected files. This occurs because the plugin does not verify the package's configured role restriction when validating the package password.
A vulnerability in the Download Manager WordPress plugin before versions 3.3.73 and 7.6.2 allows unauthenticated visitors to download password-protected and role-restricted files. This occurs because the plugin does not verify access permissions before issuing download keys via media-preview renderers, exposing restricted content to unauthorized users.
The Data Tables Generator by Supsystic WordPress plugin versions before 1.15.8 contains an authorization bypass vulnerability. It does not verify user authorization or ownership before returning stored table contents, relying solely on a nonce that is exposed to all visitors. This allows unauthenticated users to access the full contents of any table by its identifier, including unpublished tables.
A vulnerability in the User Registration & Membership WordPress plugin before version 5.3.2 allows unauthenticated users to bypass the payment-before-login restriction by submitting a registration without selecting a membership. This flaw enables account creation and login without completing payment on payment-gated registration forms.
A vulnerability in the User Registration & Membership WordPress plugin before version 5.3.2 allows authenticated users with an active paid subscription to renew their subscription indefinitely without completing payment. This occurs because the plugin does not verify payment completion before extending the membership.
A vulnerability in the User Registration & Membership WordPress plugin before version 5.3.2 allows unauthenticated users to exploit improper privilege management by applying an invalid discount coupon to a paid membership plan. This flaw causes the system to treat fully discounted orders as paid without verifying coupon validity, enabling attackers to gain roles mapped to paid plans, potentially escalating privileges up to administrator.
The Code Snippets WordPress plugin versions before 4.1.0 contain a missing authorization vulnerability in multisite environments. This flaw allows a subsite administrator without network-management privileges to create, overwrite, or deactivate snippets that affect the entire network. The issue arises because the plugin does not verify network-level capabilities before processing a network-scope parameter on snippet import routes. The vulnerability is fixed in version 4.1.0.
Elementor Website Builder versions before 4.3.6 contain a cross-site scripting (XSS) vulnerability. This flaw allows users with the Contributor role to inject scripts via an element identifier that is improperly validated and escaped before being rendered into a client-side JavaScript context. As a result, these scripts execute in the browsers of users viewing the affected content, including administrators reviewing submissions.
A stored cross-site scripting (XSS) vulnerability exists in the Live Composer WordPress plugin versions before 2.1.24. The flaw arises because some Button module settings are not properly sanitized or escaped before being output on the front end. This allows high-privilege users, such as administrators, to inject malicious scripts even when the unfiltered_html capability is disabled, for example in multisite WordPress setups. The issue is fixed in version 2.1.24.
A cross-site scripting (XSS) vulnerability exists in the Live Composer WordPress plugin before version 2.1.24. The plugin does not properly sanitize and escape certain page-builder module settings, allowing users with builder access (typically administrators) to inject arbitrary JavaScript. This script executes when any visitor views the affected page, including administrators without unfiltered_html capability, such as in multisite environments.
A stored cross-site scripting (XSS) vulnerability exists in the Live Composer WordPress plugin versions before 2.1.24. The flaw arises because certain staff member settings are not properly sanitized or escaped before being output on pages. This allows high-privilege users, such as administrators, to inject malicious scripts even when the unfiltered_html capability is disabled, such as in multisite WordPress setups. The issue is fixed in version 2.1.24.