The VikRentCar Car Rental Management System WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the 'className' parameter in all versions up to and including 1.4.10. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises due to insufficient input sanitization and output escaping, with wp_kses_post() failing to neutralize the payload because of the context in which the injection occurs.
The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'l10n_print_after' parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires that the targeted site has at least one Contact Form 7 form configured with a [multistep] form-tag, as the canonicalization introduced in version 4.7 blocks the attack path on non-multistep forms.
The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the 'rp4wp_view' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the titles and publication dates of all private posts site-wide, normally restricted to Editor-level users and above. The page's existing authorization check only verifies edit_posts and edit_post on a parent post the attacker owns, both of which any Contributor satisfies, leaving no effective gate against reading other authors' private posts.
The Avada (Fusion) Builder WordPress plugin up to version 3.16.2 is vulnerable to stored cross-site scripting (XSS) via the 'tab_index' and 'empty_notice' parameters. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because the plugin insufficiently sanitizes and escapes input, and wp_kses_post does not remove the payload due to its placement within shortcode attribute text.
The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repeater[*][version_uid] (and many sibling fields: freeze-mode, cookie-input, ip-input, compare, utm-value, page-url-compare, group-name, custom, …)' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Postie plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.9.87. This flaw allows unauthenticated attackers to inject malicious scripts via the Email Body URL Autolink feature. The vulnerability arises because the ?postie=get-mail endpoint is accessible without authentication or capability checks, and the plugin disables WordPress's usual output filtering before saving content, enabling unescaped script injection.
The Innovative Form Builder – IvyForms WordPress plugin (versions up to 1.5.1) contains an arbitrary file upload vulnerability due to insufficient file type validation. Authenticated users with custom-level access can configure file upload fields to allow dangerous file extensions like PHP. This enables unauthenticated visitors to upload potentially executable files via a public REST API endpoint, leading to possible remote code execution.
The Waitlist Woocommerce (Back in stock notifier) WordPress plugin versions up to 2.9.1 contain a stored cross-site scripting (XSS) vulnerability via the 'type' shortcode attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This occurs because shortcode attribute values bypass the usual HTML sanitization filters and are only rendered at page display time.
The Rich Showcase for Google Reviews WordPress plugin up to version 7.1.6 contains an authorization bypass vulnerability. Authenticated users with contributor-level access or higher can retrieve a 127-character site-wide authentication secret (grw_auth_code). This secret allows impersonation of the WordPress site to the RichPlugins backend service, potentially exposing the site to unauthorized actions. The vulnerability is identified as CWE-862 (Missing Authorization).
The Related Posts for WordPress plugin (up to version 3.0.0) contains a missing authorization vulnerability that allows authenticated users with Contributor-level access or higher to read titles of non-public posts authored by higher-privileged users. This occurs because the plugin fails to verify read permissions on child post IDs linked to a parent post, exposing sensitive post titles in the editor meta box.
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtext_update_tmpl function. This makes it possible for unauthenticated attackers to write arbitrary PHP code to the plugin's executable template files such as site/helpers/email_tmpl.php, which are later include()d by loadEmailTemplate() and loadPdfTemplate(), achieving remote code execution on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected PHP payload bypasses sanitization because the plugin's own __PHP_OPEN__/__PHP_CLOSE__ placeholder expansion and cleanPHPSourceCode() logic explicitly reverse both sanitize_text_field filtering and saveHTML() HTML-encoding, restoring a literal <?php...?> payload to live PHP before it is written to disk. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
The If-So Dynamic Content – Elementor & All Page Builders Personalization WordPress plugin versions up to 1.10.2 are vulnerable to stored cross-site scripting (XSS) via the 'conversion' shortcode attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages.
The AI ChatBot for WooCommerce – WoowBot WordPress plugin up to version 5.0.0 has an authorization bypass vulnerability. Authenticated users with subscriber-level access can exploit this flaw to trigger repeated RAG document synchronization operations that invoke paid AI embedding API calls charged to the site administrator's API key. The required nonce token is exposed to all authenticated frontend users, making exploitation trivial. This can lead to financial loss due to depletion of AI API credits.
Cozy Blocks – Website Builder for WordPress Block Editor plugin versions up to 2.2.27 are vulnerable to stored cross-site scripting (XSS) via the productRating.iconColor parameter. This vulnerability allows authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages. The issue occurs only when the productRating option is enabled and the associated WooCommerce product has a non-zero rating.
The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to disable or enable the PayPal Brasil BCDC payment gateway and overwrite its WooCommerce gateway settings, removing PayPal from checkout for all customers.
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, <= 261011 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses wp_kses_post() on save because it contains no literal angle brackets — only backslash-escaped sequences that PHP's date() materializes into HTML tag characters at render time after WordPress's shortcode_parse_atts() applies stripcslashes() to the attribute value.
The DesignSetGo WordPress plugin up to version 2.11.0 is vulnerable to stored cross-site scripting (XSS) via the 'tagName' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that become active when an administrator runs the plugin's block-conversion migration. Exploitation requires administrative action to activate the payload, preventing attackers from triggering the vulnerability independently.
The Travelly – Tour & Travel Booking Manager plugin for WooCommerce versions up to 2.3.6 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper sanitization and escaping of user-supplied shortcode attributes ('width', 'height', and 'zoom') in the [ttbm-hotel-map] shortcode. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages.
The UiChemy plugin for WordPress versions up to 5.3.0 contains a stored cross-site scripting (XSS) vulnerability. Authenticated users with contributor-level access or higher can inject malicious scripts via a specific URL parameter. The injected script executes when a privileged user clicks the crafted link, potentially compromising the site.
The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes specifically in the administrator's browser session, as the vulnerable branch only renders when an administrator previews or opens the post containing the crafted shortcode.