The PayPlug for WooCommerce WordPress plugin versions before 3.1.1 lack proper capability or ownership checks on certain unauthenticated AJAX actions. This flaw allows unauthenticated attackers to modify, read, and permanently delete arbitrary WooCommerce orders by supplying order identifiers.
The WP Roster WordPress plugin versions prior to 2.35 contain a vulnerability where one of its AJAX actions lacks capability and nonce checks. This flaw allows unauthenticated attackers to delete WordPress user accounts of roster members.
The Recipe Card Blocks Lite WordPress plugin versions before 3.6.4 contain a vulnerability where a block and shortcode attribute is not properly sanitized and cast before being concatenated into SQL queries. This flaw allows authenticated users with Contributor-level access or higher to perform SQL injection attacks.
The Customer Engagement System WordPress plugin versions before 2.0.2 contain a SQL injection vulnerability. This flaw arises because the plugin does not safely construct SQL statements for storing popup visibility rules, directly concatenating user-supplied ID values into an INSERT query without parameter binding or integer casting. An authenticated administrator can exploit this to inject arbitrary SQL and read the WordPress database contents.
The Customer Engagement System WordPress plugin versions prior to 2.0.2 have a vulnerability where unauthenticated users can access the MailChimp interest-group lookup feature without proper restrictions or API key validation. This flaw allows attackers to cause the server to open connections to arbitrary internal hosts and ports and infer their reachability based on response timing.
The Product Designer for WooCommerce WordPress | Lumise plugin is affected by a directory traversal vulnerability in all versions up to and including 2.1.2. This flaw allows unauthenticated attackers to read arbitrary files on the server via the process_checkout function. The vulnerability is exploitable without credentials because the required security nonce can be obtained by any visitor through an accessible AJAX handler.
The GeoDirectory WordPress plugin versions before 2.8.196 contain a vulnerability where a post badge click-through link is not properly sanitized or escaped. This flaw allows users with Contributor role or higher to inject stored cross-site scripting (XSS) payloads that execute when higher-privileged users, such as administrators, view the affected listing.
The Welcart e-Commerce WordPress plugin versions before 2.12.6 contain a vulnerability where user-supplied URLs are not validated before being used in redirects. This flaw allows unauthenticated attackers to redirect users to arbitrary external websites.
The Royal Addons for Elementor WordPress plugin versions prior to 1.7.1070 lack authorization checks when using stored Mailchimp credentials. This flaw allows unauthenticated attackers to add arbitrary email addresses and contact details as confirmed subscribers to the site owner's Mailchimp audience.
A vulnerability in the Media Library Assistant WordPress plugin before version 3.42 allows an attacker to perform unauthorized bulk deletion or trashing of media attachments. This occurs because the plugin inconsistently validates the CSRF nonce on the bulk-action handler, only checking it when the nonce field is present. A forged request omitting this field can exploit this flaw if performed by a logged-in user with Author role or higher.
The Royal Addons for Elementor WordPress plugin versions before 1.7.1070 improperly handle access control for post content in non-public post types. Specifically, the plugin does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action. This flaw allows unauthenticated users to access sensitive content such as captured contact-form submissions containing personal information.
The Welcart e-Commerce WordPress plugin versions prior to 2.12.6 contain a vulnerability where a parameter is not properly sanitized and escaped before being used in a SQL query. This flaw allows users with the Editor role or higher to perform SQL injection attacks.
A vulnerability in the PayPlug for WooCommerce (Official) WordPress plugin before version 3.1.1 allows unauthenticated users to disclose another customer's order key and cancel their unpaid guest order. This occurs because the plugin does not verify that the requester owns the WooCommerce order referenced in a payment request.
The Page Builder by SiteOrigin WordPress plugin versions prior to 2.38.0 contain a vulnerability where a widget property is not properly sanitized or escaped before storage and output. This flaw allows users with contributor role or higher to perform stored cross-site scripting (XSS) attacks against users with higher privileges when they open the affected post in the editor.
The Copy Anything to Clipboard for WordPress plugin versions before 5.5.5 contains a vulnerability where a shortcode attribute is not properly sanitized and escaped before being stored and rendered via client-side script. This flaw allows users with contributor role or higher to execute stored cross-site scripting (XSS) attacks against users with higher privileges who view or interact with the affected content.
The Persian WooCommerce SMS WordPress plugin versions before 7.3.2 contain a reflected cross-site scripting (XSS) vulnerability. This occurs because the plugin does not properly sanitize and escape a parameter before reflecting it into an HTML attribute. The vulnerability can be exploited when a logged-in privileged user is tricked into submitting a crafted cross-site request, leading to script execution in their browser session.
The Royal Addons for Elementor WordPress plugin versions before 1.7.1070 contain a vulnerability where the email delivery configuration for contact forms is stored in a site-global namespace keyed by a non-secret identifier. This allows users with the Author role or higher to overwrite another user's form email configuration, potentially redirecting form submissions to an attacker-controlled email address.
The Customer Email Verification plugin for WooCommerce on WordPress has an authentication bypass vulnerability in all versions up to 2.8.2. The flaw arises from a predictable email verification token and lack of proper capability or nonce checks in the authentication function. This allows unauthenticated attackers to log in as verified customers or mark existing accounts as verified, bypassing email verification controls. Exploitation depends on the presence of a password column in a specific database table, which exists only on upgraded sites from older versions.
The MP3 Audio Player WordPress plugin versions before 5.16 contain a vulnerability where one of its audio player shortcode attributes is not properly escaped before being output into an HTML attribute. This flaw allows users with Contributor-level access or higher to inject arbitrary JavaScript code. The injected script executes when another user, such as an administrator previewing a pending post, views the content.
The WPOrLogin WordPress plugin versions before 3.1.0 lack capability checks and nonce validation when updating hidden-login URL settings. This vulnerability allows unauthenticated attackers to change login, registration, and password-recovery slugs, potentially locking out administrators from the login interface.