The Flatsome WordPress theme up to version 3.20.12 is vulnerable to stored cross-site scripting (XSS) via insufficient sanitization of certain HTML attributes ('data-text-sec', 'data-title', and 'title') in custom HTML blocks. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because WordPress's wp_kses_post function allows global data-* attributes, enabling attacker-controlled values to persist and be interpreted as executable HTML by specific JavaScript behaviors in the theme.
The Duplicate Post WordPress plugin before version 1.5.8 contains an authorization flaw where it does not verify if a user duplicating a post has permission to edit that post. When the slug takeover option is enabled, this allows users with roles granted access by an administrator, such as Contributor, to move any readable post off its original permalink and publish their duplicate at that address.
The SEOJuice WordPress plugin versions before 2.12.0 have a vulnerability where the REST API authentication filter is not properly restricted. This flaw disables WordPress's REST nonce protection site-wide, allowing unauthenticated attackers to perform any cookie-authenticated REST action. An attacker can exploit this by tricking a logged-in administrator into visiting a crafted page, enabling actions such as creating a new administrator account via CSRF.
The Duplicate Post WordPress plugin versions before 1.5.8 lack a proper capability check when saving global settings. Instead, they rely solely on their own role-access list, which can be manipulated by users with any role granted access by an administrator, including low-privilege roles such as Subscriber. This flaw allows such users to overwrite global settings, including the role-access list itself.
The Lightbox with PhotoSwipe WordPress plugin versions prior to 5.19.0 contain a vulnerability where link titles and other caption sources are not properly sanitized before being inserted as HTML into image lightbox captions. This flaw allows unauthenticated users to inject stored cross-site scripting (XSS) payloads via comments.
The Flatsome WordPress theme versions prior to 3.20.13 contain a vulnerability where the theme does not enforce user role restrictions on an AJAX save action. This flaw allows users with the Contributor role to publish their own content and change its post type, such as converting a post into a product, without having the necessary permissions.
The Flatsome WordPress theme versions prior to 3.20.13 contain a vulnerability where an AJAX action accessible to unauthenticated users lacks capability and nonce checks. This flaw allows unauthorized users to retrieve content from unpublished posts, including drafts and pending posts, by specifying post IDs.
The WP Ultimate CSV Importer and WP Ultimate CSV Importer Pro WordPress plugins before versions 9.2 and 9.0.7 respectively, expose exported post files via a publicly accessible location with predictable filenames. This allows unauthenticated attackers to download content and custom fields of any exported post, including non-public content.
The Chargely Free Subscriptions For Woocommerce WordPress plugin up to version 1.0 has a vulnerability where it does not perform authorization checks on a REST API route that exposes its stored configuration. This flaw allows unauthenticated attackers to retrieve the live WooCommerce REST API consumer key and secret, which provide full read and write access to the entire store.
The Checkout Files Upload for WooCommerce WordPress plugin versions before 2.4.1 contains a vulnerability where it does not properly verify that uploaded files at checkout are allowed image types. This flaw allows unauthenticated users to upload HTML files disguised as images, which can execute JavaScript in the browser of a shop manager or administrator viewing the order screen. This issue is a regression of a previously fixed vulnerability (CVE-2025-4212) and was reintroduced in version 2.4.0.
A SQL injection vulnerability exists in projectworlds Visitor Management System 1.0 in the Login Endpoint's /img/user page.php file. The vulnerability allows remote attackers to manipulate the Username parameter in the mysqli_query function, potentially leading to unauthorized data access and modification. Public exploit code has been disclosed. The vulnerability has a high severity rating with a CVSS score of 7.3.
The Swipe WordPress plugin versions through 1.4 contain a vulnerability where login requests are not properly authenticated before issuing WordPress session cookies. This flaw allows unauthenticated attackers to log in as any existing user, including administrators, if that user has an active app session.
The Duplicate Post WordPress plugin versions before 1.5.8 have a vulnerability where the plugin does not verify if a user has permission to publish posts when duplicating them. This flaw allows users with roles granted access to the plugin, such as Contributors, to create published posts, including posts attributed to other users.
The Quick Page/Post Redirect Plugin for WordPress versions before 5.2.4 contained a hidden update mechanism that fetched updates from the author's own server instead of the official WordPress.org repository. This mechanism was exploited to deliver a backdoored plugin build (notably version 5.2.3) that injected arbitrary content into pages and delivered arbitrary code, primarily serving SEO spam to logged-out visitors. The plugin was removed from WordPress.org, and a clean version 5.2.4 was later published to address this issue.
The WP Ultimate CSV Importer WordPress plugin versions before 9.3 contain a vulnerability where values from imported files are not escaped before use in SQL queries when importing LifterLMS content. This flaw allows high privilege users, such as administrators on single or multisite WordPress installations, to perform SQL injection attacks.
The Countdown, Coming Soon, Maintenance WordPress plugin versions through 3.0.8 have an authorization bypass vulnerability in one of its AJAX actions. This flaw allows any authenticated user, including low-privileged roles like subscribers, to retrieve the titles of published posts of any post type, even those normally hidden from them. However, draft, private, and pending posts are not disclosed.
The Countdown, Coming Soon, Maintenance WordPress plugin versions up to 3.0.8 lack authorization and nonce checks when saving countdown data. This flaw allows users with Author-level access or higher to inject arbitrary web scripts due to insufficient output sanitization that permits script tags. These scripts execute when the affected content is viewed on the front end or by administrators.
The Email Marketing 4Dem WordPress plugin versions up to 2.0.5 lack authorization and capability checks on multiple AJAX actions. This flaw allows unauthenticated users to delete stored configurations and records within the plugin.
The Email Marketing 4Dem WordPress plugin versions up to 2.0.5 lack authorization and capability checks on multiple AJAX actions and REST routes. This flaw allows unauthenticated users to access and disclose stored plugin configuration and data, as well as modify the plugin's stored settings.
A nationwide FAA ground stop occurred due to a communications problem at air route traffic control centers, likely caused by a software update overwhelming legacy equipment. Officials, including Homeland Security and the FBI, found no evidence of a cyberattack. The outage lasted over four hours and disrupted thousands of flights, with delays expected to continue. The FAA was applying patches and installing new technology, which may have triggered the failure. No official root cause has been announced, and investigations continue.