MxChat – AI Chatbot & Content Generation for WordPress plugin versions up to 3.2.25 are vulnerable to a stored DOM-based Cross-Site Scripting (XSS) flaw via the 'feedback' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrator views the Transcripts page. The issue arises from insufficient input sanitization and output escaping of the 'feedback' parameter.
The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker matches — most notably $_GET['page'] starting with 'mep_' or 'mpwem_', which is never validated against an actually registered EventPress screen. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by appending ?page=mep_x to core admin URLs (options-general.
The Awesome Support WordPress plugin up to version 6.4.1 is vulnerable to a stored cross-site scripting (XSS) flaw via the 'wpas_files' parameter. This vulnerability allows authenticated users with custom-level access or higher to inject malicious scripts that execute when other users view the affected pages. Exploitation requires the 'Enable drag-n-drop uploader for ticket form' setting to be enabled, which is disabled by default.
The WP Visitor Statistics (Real Time Traffic) WordPress plugin versions up to and including 8.8 contain a SQL Injection vulnerability in the shortcode attributes 'from', 'to', 'first', and 'second' of the [wsm_showTrafficStatsList] shortcode. This flaw arises from insufficient sanitization of user-supplied shortcode attributes, allowing authenticated users with Contributor-level access or higher to inject arbitrary SQL code. The vulnerability enables attackers to extract sensitive database information by appending additional SQL queries.
The PayPlug for WooCommerce WordPress plugin versions before 3.1.1 lack proper capability or ownership checks on certain unauthenticated AJAX actions. This flaw allows unauthenticated attackers to modify, read, and permanently delete arbitrary WooCommerce orders by supplying order identifiers.
The WP Roster WordPress plugin versions prior to 2.35 contain a vulnerability where one of its AJAX actions lacks capability and nonce checks. This flaw allows unauthenticated attackers to delete WordPress user accounts of roster members.
The Recipe Card Blocks Lite WordPress plugin versions before 3.6.4 contain a vulnerability where a block and shortcode attribute is not properly sanitized and cast before being concatenated into SQL queries. This flaw allows authenticated users with Contributor-level access or higher to perform SQL injection attacks.
The Customer Engagement System WordPress plugin versions before 2.0.2 contain a SQL injection vulnerability. This flaw arises because the plugin does not safely construct SQL statements for storing popup visibility rules, directly concatenating user-supplied ID values into an INSERT query without parameter binding or integer casting. An authenticated administrator can exploit this to inject arbitrary SQL and read the WordPress database contents.
The Customer Engagement System WordPress plugin versions prior to 2.0.2 have a vulnerability where unauthenticated users can access the MailChimp interest-group lookup feature without proper restrictions or API key validation. This flaw allows attackers to cause the server to open connections to arbitrary internal hosts and ports and infer their reachability based on response timing.
The Product Designer for WooCommerce WordPress | Lumise plugin is affected by a directory traversal vulnerability in all versions up to and including 2.1.2. This flaw allows unauthenticated attackers to read arbitrary files on the server via the process_checkout function. The vulnerability is exploitable without credentials because the required security nonce can be obtained by any visitor through an accessible AJAX handler.
The GeoDirectory WordPress plugin versions before 2.8.196 contain a vulnerability where a post badge click-through link is not properly sanitized or escaped. This flaw allows users with Contributor role or higher to inject stored cross-site scripting (XSS) payloads that execute when higher-privileged users, such as administrators, view the affected listing.
The Welcart e-Commerce WordPress plugin versions before 2.12.6 contain a vulnerability where user-supplied URLs are not validated before being used in redirects. This flaw allows unauthenticated attackers to redirect users to arbitrary external websites.
The Royal Addons for Elementor WordPress plugin versions prior to 1.7.1070 lack authorization checks when using stored Mailchimp credentials. This flaw allows unauthenticated attackers to add arbitrary email addresses and contact details as confirmed subscribers to the site owner's Mailchimp audience.
A vulnerability in the Media Library Assistant WordPress plugin before version 3.42 allows an attacker to perform unauthorized bulk deletion or trashing of media attachments. This occurs because the plugin inconsistently validates the CSRF nonce on the bulk-action handler, only checking it when the nonce field is present. A forged request omitting this field can exploit this flaw if performed by a logged-in user with Author role or higher.
The Royal Addons for Elementor WordPress plugin versions before 1.7.1070 improperly handle access control for post content in non-public post types. Specifically, the plugin does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action. This flaw allows unauthenticated users to access sensitive content such as captured contact-form submissions containing personal information.
The Welcart e-Commerce WordPress plugin versions prior to 2.12.6 contain a vulnerability where a parameter is not properly sanitized and escaped before being used in a SQL query. This flaw allows users with the Editor role or higher to perform SQL injection attacks.
A vulnerability in the PayPlug for WooCommerce (Official) WordPress plugin before version 3.1.1 allows unauthenticated users to disclose another customer's order key and cancel their unpaid guest order. This occurs because the plugin does not verify that the requester owns the WooCommerce order referenced in a payment request.
The Page Builder by SiteOrigin WordPress plugin versions prior to 2.38.0 contain a vulnerability where a widget property is not properly sanitized or escaped before storage and output. This flaw allows users with contributor role or higher to perform stored cross-site scripting (XSS) attacks against users with higher privileges when they open the affected post in the editor.
The Copy Anything to Clipboard for WordPress plugin versions before 5.5.5 contains a vulnerability where a shortcode attribute is not properly sanitized and escaped before being stored and rendered via client-side script. This flaw allows users with contributor role or higher to execute stored cross-site scripting (XSS) attacks against users with higher privileges who view or interact with the affected content.
The Persian WooCommerce SMS WordPress plugin versions before 7.3.2 contain a reflected cross-site scripting (XSS) vulnerability. This occurs because the plugin does not properly sanitize and escape a parameter before reflecting it into an HTML attribute. The vulnerability can be exploited when a logged-in privileged user is tricked into submitting a crafted cross-site request, leading to script execution in their browser session.