The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repeater[*][version_uid] (and many sibling fields: freeze-mode, cookie-input, ip-input, compare, utm-value, page-url-compare, group-name, custom, …)' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Postie plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.9.87. This flaw allows unauthenticated attackers to inject malicious scripts via the Email Body URL Autolink feature. The vulnerability arises because the ?postie=get-mail endpoint is accessible without authentication or capability checks, and the plugin disables WordPress's usual output filtering before saving content, enabling unescaped script injection.
The Innovative Form Builder – IvyForms WordPress plugin (versions up to 1.5.1) contains an arbitrary file upload vulnerability due to insufficient file type validation. Authenticated users with custom-level access can configure file upload fields to allow dangerous file extensions like PHP. This enables unauthenticated visitors to upload potentially executable files via a public REST API endpoint, leading to possible remote code execution.
The Waitlist Woocommerce (Back in stock notifier) WordPress plugin versions up to 2.9.1 contain a stored cross-site scripting (XSS) vulnerability via the 'type' shortcode attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This occurs because shortcode attribute values bypass the usual HTML sanitization filters and are only rendered at page display time.
The Rich Showcase for Google Reviews WordPress plugin up to version 7.1.6 contains an authorization bypass vulnerability. Authenticated users with contributor-level access or higher can retrieve a 127-character site-wide authentication secret (grw_auth_code). This secret allows impersonation of the WordPress site to the RichPlugins backend service, potentially exposing the site to unauthorized actions. The vulnerability is identified as CWE-862 (Missing Authorization).
The Related Posts for WordPress plugin (up to version 3.0.0) contains a missing authorization vulnerability that allows authenticated users with Contributor-level access or higher to read titles of non-public posts authored by higher-privileged users. This occurs because the plugin fails to verify read permissions on child post IDs linked to a parent post, exposing sensitive post titles in the editor meta box.
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtext_update_tmpl function. This makes it possible for unauthenticated attackers to write arbitrary PHP code to the plugin's executable template files such as site/helpers/email_tmpl.php, which are later include()d by loadEmailTemplate() and loadPdfTemplate(), achieving remote code execution on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected PHP payload bypasses sanitization because the plugin's own __PHP_OPEN__/__PHP_CLOSE__ placeholder expansion and cleanPHPSourceCode() logic explicitly reverse both sanitize_text_field filtering and saveHTML() HTML-encoding, restoring a literal <?php...?> payload to live PHP before it is written to disk. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
The If-So Dynamic Content – Elementor & All Page Builders Personalization WordPress plugin versions up to 1.10.2 are vulnerable to stored cross-site scripting (XSS) via the 'conversion' shortcode attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages.
The AI ChatBot for WooCommerce – WoowBot WordPress plugin up to version 5.0.0 has an authorization bypass vulnerability. Authenticated users with subscriber-level access can exploit this flaw to trigger repeated RAG document synchronization operations that invoke paid AI embedding API calls charged to the site administrator's API key. The required nonce token is exposed to all authenticated frontend users, making exploitation trivial. This can lead to financial loss due to depletion of AI API credits.
Cozy Blocks – Website Builder for WordPress Block Editor plugin versions up to 2.2.27 are vulnerable to stored cross-site scripting (XSS) via the productRating.iconColor parameter. This vulnerability allows authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages. The issue occurs only when the productRating option is enabled and the associated WooCommerce product has a non-zero rating.
The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to disable or enable the PayPal Brasil BCDC payment gateway and overwrite its WooCommerce gateway settings, removing PayPal from checkout for all customers.
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, <= 261011 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses wp_kses_post() on save because it contains no literal angle brackets — only backslash-escaped sequences that PHP's date() materializes into HTML tag characters at render time after WordPress's shortcode_parse_atts() applies stripcslashes() to the attribute value.
The DesignSetGo WordPress plugin up to version 2.11.0 is vulnerable to stored cross-site scripting (XSS) via the 'tagName' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that become active when an administrator runs the plugin's block-conversion migration. Exploitation requires administrative action to activate the payload, preventing attackers from triggering the vulnerability independently.
The Travelly – Tour & Travel Booking Manager plugin for WooCommerce versions up to 2.3.6 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper sanitization and escaping of user-supplied shortcode attributes ('width', 'height', and 'zoom') in the [ttbm-hotel-map] shortcode. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages.
The UiChemy plugin for WordPress versions up to 5.3.0 contains a stored cross-site scripting (XSS) vulnerability. Authenticated users with contributor-level access or higher can inject malicious scripts via a specific URL parameter. The injected script executes when a privileged user clicks the crafted link, potentially compromising the site.
The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes specifically in the administrator's browser session, as the vulnerable branch only renders when an administrator previews or opens the post containing the crafted shortcode.
MxChat – AI Chatbot & Content Generation for WordPress plugin versions up to 3.2.25 are vulnerable to a stored DOM-based Cross-Site Scripting (XSS) flaw via the 'feedback' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrator views the Transcripts page. The issue arises from insufficient input sanitization and output escaping of the 'feedback' parameter.
The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker matches — most notably $_GET['page'] starting with 'mep_' or 'mpwem_', which is never validated against an actually registered EventPress screen. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by appending ?page=mep_x to core admin URLs (options-general.
The Awesome Support WordPress plugin up to version 6.4.1 is vulnerable to a stored cross-site scripting (XSS) flaw via the 'wpas_files' parameter. This vulnerability allows authenticated users with custom-level access or higher to inject malicious scripts that execute when other users view the affected pages. Exploitation requires the 'Enable drag-n-drop uploader for ticket form' setting to be enabled, which is disabled by default.
The WP Visitor Statistics (Real Time Traffic) WordPress plugin versions up to and including 8.8 contain a SQL Injection vulnerability in the shortcode attributes 'from', 'to', 'first', and 'second' of the [wsm_showTrafficStatsList] shortcode. This flaw arises from insufficient sanitization of user-supplied shortcode attributes, allowing authenticated users with Contributor-level access or higher to inject arbitrary SQL code. The vulnerability enables attackers to extract sensitive database information by appending additional SQL queries.