A stored cross-site scripting (XSS) vulnerability exists in the Optimole WordPress plugin up to version 4.2.18. The flaw arises from insufficient sanitization and escaping of the 'comment' parameter, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the injected comment to be approved by an administrator and the affected post to include at least one iframe or video element, which is common when video lazy loading is enabled by default.
The Pie Register – User Registration, Profiles & Content Restriction WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the 'first_name' parameter. This vulnerability exists in all versions up to and including 3.8.4.16. It allows unauthenticated attackers to inject malicious scripts that execute when users visit the affected pages. Exploitation requires public registration to be enabled and the registration form to include a Profile Picture field. Attackers can register accounts to store malicious payloads and then trigger script execution by posting comments, impacting all visitors of the page.
The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin up to version 2.1.5 contains a path traversal vulnerability that allows unauthenticated attackers to delete media library attachments and their files. This occurs because the AJAX handler 'get_table_data()' lacks nonce verification and capability checks, enabling attackers to supply crafted parameters to trigger deletion of media files by numeric attachment ID. Files outside the uploads directory cannot be deleted via this vulnerability.
The Optimole WordPress plugin up to version 4.2.18 is vulnerable to a stored Cross-Site Scripting (XSS) flaw via the 's (missing_srcsets[*][*].s)' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. The plugin's REST endpoint authorization is effectively bypassed because the required HMAC signature is exposed in plaintext to unauthenticated visitors on pages with incomplete profiles.
The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress contains a critical arbitrary file upload vulnerability in versions up to and including 2.13.2. This flaw allows unauthenticated attackers to upload attacker-controlled PHP files outside the uploads directory via a vulnerable AJAX handler when a specific site option is enabled. Exploitation leads to remote code execution.
In October 2026, the financially motivated threat actor Storm-3358 began targeting financial organizations primarily in Southeast Asia and globally using the agentic AI offensive framework ARTEX. ARTEX automates scanning, exploitation of vulnerabilities such as anonymous file upload and SSRF, and deployment of open-source remote access trojans (RATs) for persistence and lateral movement. The framework also performs credential compromise, brute-force attacks, API abuse, and data exfiltration at machine speed. Microsoft recommends detection through behavioral signals, network traffic characteristics, and deploying defensive honeypots, decoys, tarpits, and fake wins to mitigate attacks. Microsoft security products integrate detections and investigative context to help defend against these AI-accelerated attacks.
The iubenda All-in-one Compliance for GDPR / CCPA Cookie Consent plugin for WordPress versions up to 3.13.6 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper handling of HTML comments within the plugin's parser, allowing unauthenticated attackers to inject malicious scripts via moderated comments that execute when viewed by users after approval.
The Greenshift – animation and page builder blocks plugin for WordPress contains a stored DOM-based cross-site scripting (XSS) vulnerability in the 'url (comment_author_url)' parameter. This affects all versions up to and including 13.2.2. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user accesses a page with the injected payload. Exploitation requires a specific configuration involving the GreenShift Interaction Layer and a Counter block attribute.
MotoPress Appointment Booking Lite plugin for WordPress versions up to 2.4.8 is vulnerable to a stored cross-site scripting (XSS) flaw via an unauthenticated REST endpoint. The vulnerability arises because the 'name' parameter in the '/motopress/appointment/v1/customers/create' endpoint is not sanitized before database insertion and not escaped on output in the admin bookings list. This allows attackers to inject malicious scripts that execute when a user views the affected page, even if the user lacks certain editing capabilities.
The Kubio AI Page Builder WordPress plugin versions up to 2.9.4 contain a stored cross-site scripting (XSS) vulnerability via the 'comment (review body)' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts if their review is approved and the active template uses a Kubio-rendered wp:post-content block. This vulnerability arises from insufficient input sanitization and output escaping.
The Flying Images WordPress plugin up to version 2.4.15 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Initial comments require admin approval, but subsequent comments from the same user bypass moderation, enabling persistent script execution for all visitors, including administrators.
The FV Flowplayer Video Player WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in all versions up to and including 7.5.56.7212. The flaw arises from insufficient sanitization and escaping of the 'comment' parameter when the 'Parse Vimeo and YouTube links' option is enabled. An unauthenticated attacker can inject malicious scripts via comments that, once approved, execute in the browsers of site visitors.
The Interactive Real Estate – Floor Plan & Building Visualizer WordPress plugin up to version 2.6.0 contains an arbitrary file upload vulnerability via the extract_zip_data function. Authenticated users with subscriber-level access or higher can upload malicious files due to missing capability checks, nonce verification, and file type validation. Exploitation requires the plugin's Freemius Premium license or trial to be active, enabling remote code execution.
The Form Maker by 10Web WordPress plugin up to version 1.15.50 is vulnerable to stored cross-site scripting (XSS) due to improper input sanitization and output escaping. An unauthenticated attacker can exploit this by injecting malicious scripts via specific form parameters, which execute when an administrator views the form submissions page. This attack requires the targeted form to have a File Upload field and manipulation of the disabled_fields parameter to bypass escaping.
WPBakery Page Builder plugin for WordPress versions up to 9.0.1 is vulnerable to stored cross-site scripting (XSS) via the 'display_name / nickname' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when a page with a specific configuration is viewed. The vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires that a public post attributed to the attacker be displayed through a Basic Grid with a Post Author element linking to the author. Author-level users can exploit this directly, while subscribers need an administrator to assign or publish a post under their account.
The Appointment Booking Plugin – LatePoint for WordPress up to version 5.7.6 is vulnerable to a stored cross-site scripting (XSS) flaw via the 'customer[email]' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts by submitting a crafted email address through the public booking form, which is stored and rendered without proper escaping. Exploitation requires the attacker to register as a customer, gaining an active session without a WordPress account. The vulnerability arises from insufficient input sanitization and output escaping of the email parameter.
The Fluent Support – Helpdesk & Customer Support Ticket System WordPress plugin up to version 2.4.7 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to modify certain stored profile fields of existing customers if an administrator has enabled a FluentSupport feed on a public form. The vulnerability arises because the plugin resolves submitted emails to WordPress accounts without verifying control of the email address, enabling limited profile data overwrites.
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'answer[]' parameter in all versions up to and including 10.3.2. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute in the administrator's browser during quiz grading. Exploitation requires the attacker to be enrolled as a student in a course with a Content-type quiz question and occurs when the administrator clicks 'Start a Review' on the affected attempt.
The Jupiter X Core WordPress plugin up to version 4.62.0 contains a directory traversal vulnerability via the 'file' parameter. This flaw allows unauthenticated attackers to read arbitrary files within the wp-content/uploads/ directory. Due to existing path confinement checks, access is restricted to this directory and cannot reach sensitive files like wp-config.php outside it. The vulnerability has a medium severity rating with a CVSS score of 5.3.