The Noptin WordPress plugin up to version 4.4.3 contains a Local File Inclusion vulnerability via the 'noptin_fields[first_name]' parameter. This flaw allows unauthenticated attackers to include and execute arbitrary PHP files on the server. Exploitation requires an administrator to trigger the sending of a newsletter containing the malicious payload. The vulnerability can lead to code execution and potential data exposure.
The Social Slider Feed – Social Media Feed & Gallery Widgets WordPress plugin up to version 2.3.8 is vulnerable to stored Cross-Site Scripting (XSS) via the 'slidespeed' parameter. Authenticated users with subscriber-level access can exploit this due to insufficient input sanitization and missing permission checks, allowing injection of malicious scripts that execute on public pages embedding the feed shortcode.
The Jupiter X Core WordPress plugin up to version 4.62.0 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to enumerate and render arbitrary published post types not intended for public listing, including sensitive Flamingo CF7 submission data such as names, emails, phone numbers, messages, and IP addresses. Exploitation requires a Posts or Advanced Posts widget with 'Is Archive Template' enabled, a common configuration. The nonce used for authorization is ineffective as it is publicly available on frontend pages.
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'post_content' parameter. This affects all versions up to and including 2.8.200. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The attack bypasses the plugin's shortcode filtering due to a nested shortcode payload and limitations in WordPress's shortcode stripping and HTML sanitization functions.
The Greenshift – animation and page builder blocks plugin for WordPress (versions up to and including 13.2.2) contains a vulnerability that allows unauthenticated attackers to extract authenticated users' HttpOnly WordPress session cookies. This occurs via a crafted GET parameter that injects a nested {{COOKIE:}} placeholder, causing the victim's browser to send cookie values to an attacker-controlled host. Exploitation requires a specific site configuration and user interaction, which are not default states of the plugin.
A stored cross-site scripting (XSS) vulnerability exists in the Jupiter X Core WordPress plugin up to version 4.62.0. It arises from insufficient input sanitization and output escaping of the 'fields[<custom_meta_field_id>]' parameter. An unauthenticated attacker who can register an account and be assigned as the post author of a page or post using the Raven Author Box widget can inject malicious scripts that execute when users view the affected page.
The JS Help Desk – AI-Powered Support & Ticketing System WordPress plugin up to version 5.0.2 contains a stored DOM-based cross-site scripting (XSS) vulnerability. Authenticated users with subscriber-level access or higher can inject malicious scripts via the 'jsticket_message' parameter. The injected scripts execute when an administrator or agent views the affected ticket, triggered by the VenoBox component processing unsafe data. This vulnerability arises from insufficient input sanitization and output escaping.
The Optimole WordPress plugin up to version 4.2.17 is vulnerable to a stored cross-site scripting (XSS) flaw via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Exploitation requires the plugin to be connected with configured CDN credentials and the image replacer enabled, which is the default setup. The injected payload bypasses WordPress comment sanitization by using no HTML metacharacters at storage time, which are only generated by Optimole's decoder during rendering.
The LearnPress – Course Review plugin for WordPress contains a stored DOM-based cross-site scripting (XSS) vulnerability in the 'review_title' parameter affecting all versions up to and including 4.2.2. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when the injected review is viewed. Execution of the payload requires administrator approval of the review unless the site is configured to auto-approve comments, which bypasses manual moderation.
The Motors – Car Dealership & Classified Listings Plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in the 'stm_f_s[make]' parameter. This affects all versions up to and including 1.4.128. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability requires the Free Listing Submission feature to be enabled, which is on by default in the demo setup.
The payever WooCommerce Gateway plugin for WordPress up to version 4.8.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload executable PHP files. This occurs because three API callbacks lack authentication and validation, enabling remote code execution. The vulnerability is critical with a CVSS score of 9.8.
The Form Maker by 10Web plugin for WordPress up to version 1.15.50 is vulnerable to a stored cross-site scripting (XSS) flaw. This vulnerability arises from insufficient input sanitization and output escaping of a user-defined hidden input field parameter. An unauthenticated attacker can inject malicious scripts that execute when an administrator views a specific Submissions screen and clicks a Show-on-Map link. The attack leverages the administrator's session and embedded nonce to bypass protections.