The BuddyBoss Platform plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 3.6.0. This flaw arises from insufficient input sanitization and output escaping of the Group Name field. Authenticated users with subscriber-level access or higher can exploit this vulnerability to inject arbitrary scripts that execute when other users view the affected pages. Exploitation requires the "Enable social group creation by all members" setting to be enabled, which is the default configuration. If group creation is restricted to administrators, exploitation is not possible.
The Debug Log Manager plugin for WordPress up to version 2.5.2 is vulnerable to stored cross-site scripting (XSS) via the 'message' and 'pageUrl' parameters. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires that debug logging with JavaScript error logging is enabled and that the attacker can obtain a publicly emitted nonce to bypass endpoint checks.
The FlexStock plugin for WooCommerce on WordPress is vulnerable to stored Cross-Site Scripting (XSS) via the 'products[].post_content' parameter in all versions up to and including 3.17.2. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping, combined with exposure of the REST bearer token in the Dashboard page source without proper capability checks.
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'post_images' parameter affecting all versions up to and including 2.8.197. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute in the browsers of administrators or editors when they view the pending listing's edit screen. This vulnerability enables a privilege escalation chain through normal editorial workflows.
The Ninja Forms plugin for WordPress up to version 3.15.5 is vulnerable to reflected DOM-based cross-site scripting (XSS) via a crafted 'querystring:<key>' URL parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute in the context of a victim's browser if they are tricked into clicking a malicious link.
The WooCommerce Extra Product Options Pro plugin for WordPress up to version 3.3.2 is vulnerable to reflected cross-site scripting (XSS) via specific parameters related to Date & Time Range Picker fields. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link on affected product pages. Exploitation requires no prior knowledge beyond viewing the product page source to identify the vulnerable parameter names.
The Smart Post WordPress plugin versions up to 4.0.9 are vulnerable to stored cross-site scripting (XSS) via the 'display_name' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users interact with certain page elements. Exploitation requires a page containing an Author Filter block alongside a grid or live-filter block, with script execution triggered by clicking the attacker's author entry in the dropdown filter.
The FeedWordPress plugin for WordPress versions up to and including 2026.0517 is vulnerable to stored cross-site scripting (XSS) via syndicated RSS/Atom feed content. The vulnerability arises because the plugin's content sanitization function only removes the 'target' attribute and does not strip potentially dangerous 'style' or event-handler attributes. Additionally, the plugin disables WordPress's default content filters before saving imported feed items, allowing unauthenticated attackers controlling an external feed to inject malicious scripts that execute when users view the injected content.
The Shield Security WordPress plugin up to version 22.3.2 is vulnerable to stored cross-site scripting (XSS) via the 'REQUEST_URI' parameter due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when a user accesses the affected page. The issue stems from the hidden 'path' column in ForTraffic.php, which is rendered using innerHTML without proper escaping, making it exploitable despite a partial fix applied only to the visible 'page' column in version 18.5.8.
The WP Activity Log plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 5.6.1. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.
The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'Subject' parameter used in mail-sending features. This vulnerability affects all versions up to and including 6.2 and allows unauthenticated attackers to inject malicious scripts that execute when a user views the affected page. The issue arises due to insufficient input sanitization and output escaping, particularly when OAuth authorization is not completed immediately after plugin activation.
The SEOPress AI SEO Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'display_name' parameter affecting all versions up to and including 10.3. Authenticated users with subscriber-level access or higher can inject malicious scripts via their display name, which are then executed when other users view the affected pages. This occurs due to insufficient input sanitization and output escaping in the plugin's handling of the %%archive_title%% token combined with WordPress's storage of display names without HTML filtering.
The Content Pilot plugin for WordPress versions up to and including 2.2.4 is vulnerable to stored cross-site scripting (XSS). The vulnerability arises because the plugin processes HTML meta descriptions from remotely fetched articles without proper sanitization before storing them as post content. This allows unauthenticated attackers who control RSS feed content configured in the plugin to inject malicious scripts that execute when users view the affected pages.
The Product Filter for WooCommerce by WBW plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability via the 'wpf_fid' JSON parameter in all versions up to and including 3.4.6. The flaw is due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with crafted content. The vulnerability remains in versions patched at 3.4.3 because the sanitization was incomplete, leaving the JSON-decoded filterSettings payload unsanitized.
The User Frontend WordPress plugin up to version 4.3.13 is vulnerable to reflected cross-site scripting (XSS) via the 'field_attr[required]' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. The nonce check intended to protect the AJAX action is ineffective because the nonce value is publicly accessible to anonymous visitors, enabling attackers to harvest it and bypass protections.
A stored cross-site scripting (XSS) vulnerability exists in the PublishPress Authors plugin for WordPress affecting all versions up to and including 4.17.0. The flaw is due to insufficient input sanitization and output escaping of the 'name' parameter mapped to display_name. Authenticated users with subscriber-level access or higher can exploit this by injecting malicious scripts that execute when other users view the affected pages. Exploitation requires the attacker to have a mapped author term, which occurs when assigned as a co-author or if automatic author term creation is enabled for their role. This mapping is not present by default on a stock installation.
The W3 Total Cache plugin for WordPress up to and including version 2.10.7 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping when HTML Minify is enabled with the default 'mfunc' entry in the ignored-comment stems list. Exploitation requires an attacker to predict a time-based placeholder namespace by reading the server clock from the HTTP Date header. Successful exploitation allows injection of arbitrary scripts that execute when users access the affected pages.
The User Submitted Posts WordPress plugin is vulnerable to stored DOM-based cross-site scripting (XSS) via the 'user-submitted-content' parameter in all versions up to and including 20260916. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. By default, submitted posts require admin approval before becoming visible, limiting exposure. However, if the plugin's 'publish immediately' option is enabled, injected scripts become live without moderation.
The ThirstyAffiliates WordPress plugin up to version 3.12.1 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the site to use block themes like Twenty Twenty-Five and that the attacker has a previously approved comment, enabling subsequent crafted comments to be auto-approved and publicly rendered.
The Relevanssi – A Better Search plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 4.28.5. This vulnerability arises from insufficient input sanitization and output escaping of the 'comment' parameter. Exploitation requires that the site has both comment indexing and comment highlighting enabled. An unauthenticated attacker can inject malicious scripts that execute when a user visits a singular page via a Relevanssi search-result permalink with the highlight query parameter.