FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the 'shipping_first_name' parameter in all versions up to and including 3.16.0.5. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when a user accesses the affected page. The issue arises from insufficient input sanitization and output escaping.
The Motors – Car Dealership & Classified Listings Plugin for WordPress versions up to 1.4.124 is vulnerable to stored cross-site scripting (XSS) via the 'stm_f_s' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping. The AJAX handler nonce required for exploitation is exposed on every page, facilitating exploitation without higher privileges.
WP Photo Album Plus plugin for WordPress versions up to 9.3.03.002 is vulnerable to stored Cross-Site Scripting (XSS) via the REQUEST_URI session history. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.
The Simple Membership plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'country' parameter affecting all versions up to and including 4.8.4. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. Additionally, unauthenticated attackers may exploit this issue if the Enable Free Membership feature is enabled, allowing anonymous registration and profile submission.
The WP Meteor Website Speed Optimization Addon plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the comment author name field. This vulnerability affects all versions up to and including 3.4.18. It allows unauthenticated attackers to inject arbitrary scripts that execute when users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires the malicious comment to pass WordPress's comment moderation process before being displayed.
The 10Web Booster WordPress plugin versions up to and including 2.34.8 are vulnerable to a stored cross-site scripting (XSS) flaw via the 'author' parameter. This vulnerability arises from improper input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The issue is due to the plugin's handling of the comment author Name value, which can bypass WordPress core sanitization and break out of an HTML attribute context.
The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes for WordPress contains a stored cross-site scripting (XSS) vulnerability in the comment_content parameter. This affects all versions up to and including 2.4.0. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Exploitation requires a site administrator to approve the crafted comment before the payload is served to visitors.
The Team – Team Members Showcase Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'ttp_filter_taxonomy' parameter. This flaw affects all versions up to and including 6.0.2 and allows authenticated users with contributor-level access or higher to inject malicious scripts. These scripts execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.
The Frontend Admin by DynamiApps WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in all versions up to and including 3.28.36. The vulnerability arises from improper input neutralization in the 'get_dynamic_values' function, which performs text-level replacements without HTML-aware parsing. Authenticated users with Contributor-level access or higher can exploit this to inject malicious scripts that execute when other users view the affected pages. The CVSS 3.1 score is 6.4, indicating a medium severity risk.
The Favicon Rotator plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability in all versions up to and including 1.2.11. This vulnerability arises from insufficient sanitization and escaping of 'fvrt_' prefixed request parameters, allowing unauthenticated attackers to inject arbitrary scripts. Successful exploitation requires tricking a user into clicking a crafted link, leading to script execution in the user's browser.
The Photo Reviews for WooCommerce WordPress plugin up to version 1.2.30 is vulnerable to stored DOM-based cross-site scripting (XSS) via the 'wcpr_image_upload_id' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view the affected review pages. The issue arises from insufficient input sanitization and output escaping, with no authentication or ownership checks on the stored comment meta data where the payload is saved.
The Responsive Lightbox & Gallery WordPress plugin up to version 2.7.9 contains a stored cross-site scripting (XSS) vulnerability via the 'comment' parameter. This vulnerability allows authenticated users with editor-level or higher privileges to inject malicious scripts if the plugin's 'Comments' lightbox setting is enabled and a moderator approves the comment. The malicious script executes when a site visitor clicks the affected image to open the lightbox. The vulnerability has a medium severity rating with a CVSS score of 4.4.
Payment Plugins for Stripe WooCommerce versions up to and including 4.0.17 are vulnerable to a reflected cross-site scripting (XSS) flaw via the '#response' URL fragment. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user visits the crafted page. Exploitation depends on the 'Generic Errors' setting being unchecked, which causes raw Stripe error messages to be returned without sanitization.
The VikBooking Hotel Booking Engine & PMS WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the 'attachments[name]' parameter. This vulnerability exists in all versions up to and including 1.8.15 due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject malicious scripts that execute when users access the affected pages. The vulnerability has a high severity with a CVSS score of 7.2.
The Post Grid Gutenberg Blocks – PostX WordPress plugin up to version 5.1.0 is vulnerable to stored cross-site scripting (XSS) via the display_name user field. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users visit affected pages. The issue arises because the plugin insufficiently sanitizes and escapes user input, specifically allowing double-quotes in display_name to break out of HTML attributes.
A stored cross-site scripting (XSS) vulnerability exists in the WordPress plugin User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission. The flaw is due to insufficient input sanitization and output escaping of the 'wpuf_payment_method' parameter in versions up to and including 4.3.12. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability exploits a bypass technique involving appending a valid gateway keyword to evade sanitization functions.
The Quiz and Survey Master (QSM) plugin for WordPress has a stored DOM-based cross-site scripting (XSS) vulnerability in the 'qsm_hidden_questions' parameter affecting all versions up to and including 11.2.6. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. Exploitation requires triggering a failure in the mlw_results INSERT operation by submitting an over-length or duplicate qsm_unique_key, causing unescaped payloads to be written to the audit trail.
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.
The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing the gallery, including administrators.
The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections (Administrators by default) to store JavaScript that executes in the session of any user who later opens that view, including a Super Administrator on multisite.