The Jupiter X Core plugin for WordPress up to and including version 4.62.0 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to enumerate and render arbitrary published post types not intended for public viewing, including sensitive Flamingo CF7 submission records with personal data. Exploitation requires a specific widget configuration ('Is Archive Template' enabled) common in Jupiter X sites, and the nonce used for verification is ineffective as an authorization barrier.
The MotoPress Appointment Booking Lite plugin for WordPress versions up to and including 2.4.8 is vulnerable to a stored cross-site scripting (XSS) flaw via its public REST endpoint '/motopress/appointment/v1/customers/create'. This endpoint allows unauthenticated attackers to inject arbitrary scripts because the 'name' parameter is not sanitized before database insertion and not escaped on output in the admin bookings list. The vulnerability affects users with limited capabilities, such as the Appointment Employee role, enabling script execution when viewing injected pages.
The Social Slider Feed plugin for WordPress has a stored cross-site scripting (XSS) vulnerability in the 'slidespeed' parameter affecting all versions up to and including 2.3.8. Authenticated users with subscriber-level access or higher can exploit this flaw to inject malicious scripts that execute on any page embedding the affected feed shortcode. This occurs due to insufficient input sanitization and output escaping, combined with a missing permission check that allows subscribers to bypass capability restrictions and manipulate feed settings.
The payever WooCommerce Gateway plugin for WordPress versions up to and including 4.8.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload executable PHP files, leading to remote code execution. This is due to three WooCommerce-API callbacks lacking authentication and capability checks, combined with an insecure file upload routine that writes attacker-controlled files before validating their type. Additionally, an unauthenticated hard-coded credential identity overwrite issue exists independently.
The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter. This affects all versions up to and including 7.5.56.7212. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the 'Parse Vimeo and YouTube links' option to be enabled and that the injected comment is approved before execution occurs on pages viewed by site visitors.
The iubenda All-in-one Compliance plugin for WordPress versions up to and including 3.13.6 is vulnerable to a stored cross-site scripting (XSS) flaw. This vulnerability arises from improper handling of HTML comments inside IUB-COOKIE-BLOCK markers, allowing unauthenticated attackers to inject arbitrary scripts via moderated comments that execute when viewed by users after administrator approval.
The Jupiter X Core plugin for WordPress versions up to and including 4.62.0 contains a directory traversal vulnerability via the 'file' parameter. This vulnerability allows unauthenticated attackers to read arbitrary files within the wp-content/uploads/ directory. The vulnerability is mitigated by a path confinement check that prevents access to files outside this directory, such as wp-config.php.
The Greenshift WordPress plugin (animation and page builder blocks) up to version 13.2.2 is vulnerable to sensitive information exposure. An unauthenticated attacker can exploit a crafted GET parameter to cause a logged-in user's HttpOnly WordPress session cookie (wordpress_logged_in_*) to be leaked via an image request to an attacker-controlled host. Exploitation requires that the site publisher has configured a public GreenShift Element image block with a {{GET:}} placeholder in the src attribute and that a logged-in user visits the malicious link. This vulnerability is not present in the plugin's default configuration.
The Form Maker by 10Web WordPress plugin up to version 1.15.50 is vulnerable to stored cross-site scripting (XSS) via a user-defined hidden input parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrator views a specific submissions page and interacts with a crafted entry. The flaw arises from insufficient input sanitization and output escaping in the handling of the 'wdform_<n>_element<id>' parameter. Exploitation requires an administrator to trigger the vulnerable functionality, leveraging their session and embedded nonce.
The Fluent Support plugin for WordPress versions up to and including 2.4.7 has a vulnerability allowing unauthenticated attackers to modify certain stored profile fields of linked customers. This occurs via the plugin's integration with Fluent Forms, where public form submissions can trigger ticket creation and update customer data without verifying email ownership. The vulnerability permits overwriting limited profile fields such as first and last name (only if unset), title, address, city, state, zip, and country, but not email, role, or status.
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'post_content' parameter. This affects all versions up to and including 2.8.200. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The attack bypasses the plugin's shortcode filtering due to a nested shortcode payload and limitations in WordPress's strip_shortcodes() function and kses HTML filtering.
The Flying Images WordPress plugin up to version 2.4.15 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Initial comments require administrator approval, but subsequent comments from the same user bypass moderation, causing persistent script execution for all visitors, including administrators.
The Jupiter X Core plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 4.62.0. This vulnerability arises from insufficient input sanitization and output escaping of the 'fields[<custom_meta_field_id>]' parameter. An unauthenticated attacker can exploit this by injecting malicious scripts into pages where the attacker is assigned as the post author and the page template includes the Raven Author Box widget. The vulnerability allows script execution when users access the affected pages.
The Noptin WordPress plugin up to version 4.4.3 is vulnerable to a Local File Inclusion (LFI) flaw via the 'noptin_fields[first_name]' parameter. This vulnerability allows unauthenticated attackers to include and execute arbitrary PHP files on the server. Exploitation requires an administrator to trigger the sending of a newsletter containing the malicious payload, as unauthenticated users can store PHP code in the first_name field but cannot directly execute it. The vulnerability can lead to code execution, bypassing access controls and potential data exposure.
The Greenshift WordPress plugin, used for animation and page builder blocks, suffers from a Stored DOM-Based Cross-Site Scripting (XSS) vulnerability via the 'url (comment_author_url)' parameter in all versions up to and including 13.2.2. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires a specific plugin configuration involving the GreenShift Interaction Layer and Counter block attributes, causing the payload to execute for every visitor who loads the affected page once the malicious comment is published.
The Appointment Booking Plugin – LatePoint for WordPress versions up to and including 5.7.6 is vulnerable to stored cross-site scripting (XSS) via the 'customer[email]' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Attackers can exploit this by registering as a customer through the public booking form using a crafted email address that passes validation but contains an HTML payload. The injected scripts execute whenever a user accesses the affected page, potentially compromising user interactions.
The WPBakery Page Builder plugin for WordPress up to version 9.0.1 is vulnerable to stored cross-site scripting (XSS) via the 'display_name' or 'nickname' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view pages containing the injected content. Successful exploitation requires that a public post by the attacker is displayed through a Basic Grid with a Grid Builder template configured to link to the post author. Author-level users can exploit this without assistance, while subscribers need an administrator to publish a post under their account.
The Interactive Real Estate – Floor Plan & Building Visualizer plugin for WordPress contains an arbitrary file upload vulnerability in all versions up to and including 2.6.0. The flaw arises from missing capability checks, nonce verification, and file extension or MIME type validation in the extract_zip_data function. Authenticated users with subscriber-level access or higher can exploit this vulnerability to upload potentially executable files, enabling remote code execution. Exploitation requires the plugin's Freemius Premium license or trial to be active, as the vulnerability is gated by a site-level license check rather than per-user capability checks.
The Optimole WordPress plugin up to version 4.2.17 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access affected pages. Exploitation requires the plugin to be connected with configured CDN keys and the image replacer enabled, which is the default setup. The injected payload bypasses WordPress comment sanitization by using a decoding mechanism unique to Optimole at render time.
The LifterLMS WordPress plugin up to version 10.3.2 is vulnerable to stored cross-site scripting (XSS) via the 'answer[]' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute in the administrator's browser during quiz grading. Exploitation requires the attacker to be enrolled in a course with a Content-type quiz question and occurs when the administrator clicks 'Start a Review' on the affected attempt.