The Jupiter X Core plugin for WordPress versions up to and including 4.62.0 contains a directory traversal vulnerability via the 'file' parameter. This vulnerability allows unauthenticated attackers to read arbitrary files within the wp-content/uploads/ directory. The vulnerability is mitigated by a path confinement check that prevents access to files outside this directory, such as wp-config.php.
The Greenshift WordPress plugin (animation and page builder blocks) up to version 13.2.2 is vulnerable to sensitive information exposure. An unauthenticated attacker can exploit a crafted GET parameter to cause a logged-in user's HttpOnly WordPress session cookie (wordpress_logged_in_*) to be leaked via an image request to an attacker-controlled host. Exploitation requires that the site publisher has configured a public GreenShift Element image block with a {{GET:}} placeholder in the src attribute and that a logged-in user visits the malicious link. This vulnerability is not present in the plugin's default configuration.
The Form Maker by 10Web WordPress plugin up to version 1.15.50 is vulnerable to stored cross-site scripting (XSS) via a user-defined hidden input parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrator views a specific submissions page and interacts with a crafted entry. The flaw arises from insufficient input sanitization and output escaping in the handling of the 'wdform_<n>_element<id>' parameter. Exploitation requires an administrator to trigger the vulnerable functionality, leveraging their session and embedded nonce.
The Fluent Support plugin for WordPress versions up to and including 2.4.7 has a vulnerability allowing unauthenticated attackers to modify certain stored profile fields of linked customers. This occurs via the plugin's integration with Fluent Forms, where public form submissions can trigger ticket creation and update customer data without verifying email ownership. The vulnerability permits overwriting limited profile fields such as first and last name (only if unset), title, address, city, state, zip, and country, but not email, role, or status.
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'post_content' parameter. This affects all versions up to and including 2.8.200. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The attack bypasses the plugin's shortcode filtering due to a nested shortcode payload and limitations in WordPress's strip_shortcodes() function and kses HTML filtering.
The Flying Images WordPress plugin up to version 2.4.15 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Initial comments require administrator approval, but subsequent comments from the same user bypass moderation, causing persistent script execution for all visitors, including administrators.
The Jupiter X Core plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 4.62.0. This vulnerability arises from insufficient input sanitization and output escaping of the 'fields[<custom_meta_field_id>]' parameter. An unauthenticated attacker can exploit this by injecting malicious scripts into pages where the attacker is assigned as the post author and the page template includes the Raven Author Box widget. The vulnerability allows script execution when users access the affected pages.
The Noptin WordPress plugin up to version 4.4.3 is vulnerable to a Local File Inclusion (LFI) flaw via the 'noptin_fields[first_name]' parameter. This vulnerability allows unauthenticated attackers to include and execute arbitrary PHP files on the server. Exploitation requires an administrator to trigger the sending of a newsletter containing the malicious payload, as unauthenticated users can store PHP code in the first_name field but cannot directly execute it. The vulnerability can lead to code execution, bypassing access controls and potential data exposure.
The Greenshift WordPress plugin, used for animation and page builder blocks, suffers from a Stored DOM-Based Cross-Site Scripting (XSS) vulnerability via the 'url (comment_author_url)' parameter in all versions up to and including 13.2.2. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires a specific plugin configuration involving the GreenShift Interaction Layer and Counter block attributes, causing the payload to execute for every visitor who loads the affected page once the malicious comment is published.
The Appointment Booking Plugin – LatePoint for WordPress versions up to and including 5.7.6 is vulnerable to stored cross-site scripting (XSS) via the 'customer[email]' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Attackers can exploit this by registering as a customer through the public booking form using a crafted email address that passes validation but contains an HTML payload. The injected scripts execute whenever a user accesses the affected page, potentially compromising user interactions.
The WPBakery Page Builder plugin for WordPress up to version 9.0.1 is vulnerable to stored cross-site scripting (XSS) via the 'display_name' or 'nickname' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view pages containing the injected content. Successful exploitation requires that a public post by the attacker is displayed through a Basic Grid with a Grid Builder template configured to link to the post author. Author-level users can exploit this without assistance, while subscribers need an administrator to publish a post under their account.
The Interactive Real Estate – Floor Plan & Building Visualizer plugin for WordPress contains an arbitrary file upload vulnerability in all versions up to and including 2.6.0. The flaw arises from missing capability checks, nonce verification, and file extension or MIME type validation in the extract_zip_data function. Authenticated users with subscriber-level access or higher can exploit this vulnerability to upload potentially executable files, enabling remote code execution. Exploitation requires the plugin's Freemius Premium license or trial to be active, as the vulnerability is gated by a site-level license check rather than per-user capability checks.
The Optimole WordPress plugin up to version 4.2.17 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access affected pages. Exploitation requires the plugin to be connected with configured CDN keys and the image replacer enabled, which is the default setup. The injected payload bypasses WordPress comment sanitization by using a decoding mechanism unique to Optimole at render time.
The LifterLMS WordPress plugin up to version 10.3.2 is vulnerable to stored cross-site scripting (XSS) via the 'answer[]' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute in the administrator's browser during quiz grading. Exploitation requires the attacker to be enrolled in a course with a Content-type quiz question and occurs when the administrator clicks 'Start a Review' on the affected attempt.
The Motors – Car Dealership & Classified Listings Plugin for WordPress has a stored cross-site scripting (XSS) vulnerability in the 'stm_f_s[make]' parameter. This affects all versions up to and including 1.4.128. The flaw allows authenticated users with subscriber-level access or higher to inject malicious scripts that execute when other users view the affected pages. Exploitation requires the Free Listing Submission feature to be enabled, which is on by default in the demo setup wizard configuration.
The JS Help Desk plugin for WordPress up to version 5.0.2 contains a stored DOM-based cross-site scripting (XSS) vulnerability via the 'jsticket_message' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when an administrator or agent views the affected ticket. The vulnerability arises from insufficient input sanitization and output escaping, specifically when the page initializes VenoBox and processes the data-title attribute with jQuery .html().
The Kubio AI Page Builder plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment (review body)' parameter in all versions up to and including 2.9.4. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. Exploitation requires the attacker's review containing the payload to be approved, either automatically or manually, and the active single-product template must use a Kubio-rendered wp:post-content block.
The Form Maker by 10Web WordPress plugin up to version 1.15.50 is vulnerable to stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping. The vulnerability involves crafted parameters that allow unauthenticated attackers to inject malicious scripts that execute when an administrator views form submissions. Exploitation requires the targeted form to have a File Upload field and manipulation of the disabled_fields parameter to bypass escaping.
The LearnPress – Course Review plugin for WordPress contains a stored DOM-based cross-site scripting (XSS) vulnerability in the 'review_title' parameter. This affects all versions up to and including 4.2.2. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when an administrator or users access the injected review page. The vulnerability is triggered after an administrator approves the review, although auto-approval configurations may allow earlier execution.
The QODE Wishlist for WooCommerce WordPress plugin up to version 1.2.9 is vulnerable to a stored Cross-Site Scripting (XSS) flaw via the 'qode_wishlist_for_woocommerce_guests_items' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. Exploitation requires an administrator to take an additional action, as attackers cannot trigger the vulnerability independently.