The Somatic Framework WordPress plugin versions up to 1.8.14 contain a vulnerability where no authorization check or validation of user-supplied file paths is performed before deleting files. This flaw allows any authenticated user, including low-privileged roles such as subscribers, to delete arbitrary files on the server. Exploitation of this vulnerability can lead to a full site takeover.
The Limit Login Attempts Security WordPress plugin versions before 3.4.2 contains a server-side request forgery (SSRF) vulnerability. This flaw allows users with administrator privileges to cause the site to send requests to arbitrary hosts, including internal network addresses, due to lack of validation on a user-supplied setup value.
The Dynific Addons for Elementor WordPress plugin versions before 1.3.1 contains a stored cross-site scripting (XSS) vulnerability. This flaw allows authenticated users with the Author role to inject malicious scripts via a user-controlled profile value that is not properly escaped in a quoted attribute within an Elementor widget. When an administrator or any user views a post authored by the attacker, the stored payload executes in their session.
The Forminator Forms WordPress plugin versions prior to 1.58.4 contain a vulnerability where payment enforcement is not performed on the server side if the configured payment gateway is unavailable. This allows unauthenticated users to bypass payment requirements on payment-gated User Registration forms and gain assigned roles, including administrator, once the gateway is reconnected and then disconnected.
The Smush WordPress plugin versions before 4.3.6 have an authorization flaw where users with the Author role or higher can optimize and restore media attachments owned by other users. This occurs because the plugin only checks a broad upload-files capability rather than verifying specific ownership or authorization for the targeted media. This allows unauthorized modification of other users' media files and consumption of stored backups.
The Schema & Structured Data for WP & AMP WordPress plugin versions before 1.70 has a vulnerability where it does not verify if a post is publicly viewable before returning approved comments. This flaw allows unauthenticated attackers to access approved comments on private, draft, and password-protected posts, as well as retrieve approved comments across the site.
The Printaura-Woocommerce WordPress plugin versions through 4.0.2 improperly restrict access to the WooCommerce REST API. This vulnerability allows unauthenticated attackers to access all WooCommerce REST routes, enabling them to read and modify sensitive store data such as customer orders, personal information, store and payment settings, and webhooks.
A vulnerability in the Download Manager WordPress plugin versions before 3.3.73 and before 7.6.2 allows unauthenticated visitors to download password-protected and role-restricted files. This occurs because the plugin does not verify access permissions before issuing download keys via media-preview renderers, exposing sensitive files to unauthorized users.
The Live Composer WordPress plugin versions before 2.1.24 contain a vulnerability where some staff member settings are not properly sanitized and escaped before being output on pages. This flaw allows high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks even if the unfiltered_html capability is disabled, such as in multisite WordPress setups.
A race condition in HTTP/1 servers using MaxBytesReader or MaxBytesHandler can cause a runtime panic and crash when the request body reading and response header writing occur concurrently after exceeding the MaxBytesReader limit.
The Live Composer WordPress plugin versions before 2.1.24 have a vulnerability where some Button module settings are not properly sanitized and escaped before being output on the front end. This flaw allows high-privilege users, such as administrators, to perform stored cross-site scripting (XSS) attacks even if the unfiltered_html capability is disabled, such as in multisite WordPress setups.
The User Registration & Membership WordPress plugin versions prior to 5.3.2 fail to enforce the payment-before-login restriction if a registration is submitted without selecting a membership. This flaw allows unauthenticated users to create accounts on payment-gated registration forms and log in without completing payment.
The Live Composer WordPress plugin versions before 2.1.24 contain a vulnerability where some page-builder module settings are not properly sanitized and escaped. This flaw allows users with access to the builder, typically administrators, to inject arbitrary JavaScript code. The injected script executes when any visitor views the affected page, impacting even administrators in multisite environments where the unfiltered_html capability is disabled.
The Code Snippets WordPress plugin versions prior to 4.1.0 have a vulnerability in multisite environments where network-level capability checks are not performed on snippet import routes. This allows a subsite administrator without network-management rights to create, overwrite, or deactivate network-wide snippets affecting the entire network.
The User Registration & Membership WordPress plugin versions prior to 5.3.2 contain a vulnerability where the plugin does not verify that a payment has been completed before extending a paid membership subscription. This flaw allows authenticated users with an active paid subscription to renew their membership indefinitely without making additional payments.
A vulnerability in the User Registration & Membership WordPress plugin before version 5.3.2 allows unauthenticated users to exploit improperly validated discount coupons. This flaw permits users to obtain roles mapped to paid membership plans without payment, potentially escalating privileges up to administrator if the plan is linked to a privileged role.
The Live Composer WordPress plugin versions before 2.1.24 do not properly sanitise and escape certain module settings before outputting them in href attributes. This vulnerability allows high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks even if the unfiltered_html capability is disabled, for example in multisite WordPress setups.
A vulnerability in the Go toolchain allows a malicious package using cgo to bypass "#cgo LDFLAGS" validation, potentially leading to unexpected code execution during build time or causing the go command to panic. This occurs due to improper parsing of "//go:cgo_ldflag" directives, where backslash escapes were not handled correctly, allowing disallowed linker flags to be passed to the external linker. Additionally, a slice bounds check issue could cause a panic in the go command during LDFLAGS deduplication. The issue has been addressed by properly handling escaped quotes and fixing the slice bounds check.
The Elementor Website Builder WordPress plugin versions before 4.3.6 contain a vulnerability where an element identifier is not validated or escaped before being rendered into a client-side attribute evaluated as JavaScript. This flaw allows users with the Contributor role to inject scripts that execute in the browsers of anyone viewing the affected content, including administrators reviewing submissions.
A vulnerability in the Go compiler and linker on Windows allows malicious packages using "//go:cgo_import_dynamic" directives or crafted PE objects to pass unsafe library arguments to the external linker. The issue arises because the compiler previously only checked the first character of library names and did not validate imported DLL names extracted from PE files, enabling path traversal and special character injection. The compiler and linker now fully validate library names and reject unsafe characters and path traversal sequences.