Threat Intelligence Database

The User Registration & Membership plugin for WordPress versions up to and including 5.2.8 contains a code injection vulnerability. This flaw allows unauthenticated attackers to execute arbitrary registered shortcodes on restricted pages that use the {{referrer_url}} smart tag. The vulnerability arises from insufficient sanitization of the HTTP_REFERER header, which is processed in a way that does not remove shortcode delimiters before execution.

The EU VAT Assistant for WooCommerce WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in the 'vat_number' parameter affecting all versions up to 2.1.30.260413. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute in the administrator's browser when reviewing orders, potentially leading to privilege escalation and full site takeover through rogue administrator account creation.

Themify Popup, a WordPress plugin, is affected by a stored cross-site scripting (XSS) vulnerability via the 'popup_width_unit' parameter in versions up to and including 1.4.7. This vulnerability allows authenticated users with author-level access or higher to inject malicious scripts that execute when other users view the affected pages. The issue arises from insufficient input sanitization and output escaping.

LearnPress – WordPress LMS Plugin versions up to and including 4.4.10 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can enumerate all site users and extract their email addresses character-by-character. This occurs because the plugin does not properly verify user authorization for certain actions.

Themify Builder plugin for WordPress versions up to and including 7.8.2 contains a stored cross-site scripting (XSS) vulnerability via the 'visible' shortcode attribute. This flaw allows authenticated users with contributor-level access or higher to inject malicious scripts into pages, which execute when those pages are viewed. Exploitation requires the 'slider' custom post type to be active, typically enabled when using a Themify theme or compatible plugin.

The WP Booking System – Booking Calendar WordPress plugin up to version 2.1.0.3 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers or any Subscriber-level user to access stored notification email bodies of bookings by iterating booking_id and email_log_id. Sensitive customer information such as names, email addresses, phone numbers, messages, and booking dates intended only for administrators can be exposed. The vulnerability arises because the plugin does not properly verify user authorization before allowing access to this data.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the User Registration & Membership plugin for WordPress up to version 5.2.8. The flaw arises from missing or incorrect nonce validation in the trigger_bulk_action function, allowing unauthenticated attackers to trick administrators into approving or denying user registrations. This can result in locking targeted users out of the site. The vulnerability is due to a bypass of nonce checks when an empty new_role parameter is supplied, leading to unprotected execution of bulk actions.

The WP Booking System – Booking Calendar WordPress plugin up to version 2.1.0.3 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can exploit this flaw to grant themselves and others edit access to all booking forms by manipulating the user_permission meta. Exploitation requires prior edit rights on at least one booking form to obtain a valid nonce for authorization bypass.

A stored cross-site scripting (XSS) vulnerability exists in the User Registration & Membership plugin for WordPress, affecting all versions up to and including 5.2.8. The flaw allows unauthenticated attackers to inject malicious scripts via a checkbox field value due to insufficient input sanitization and output escaping. The vulnerability is exploitable through an AJAX action that lacks nonce validation, enabling arbitrary script execution when users access the injected content.

LearnPress WordPress LMS plugin versions up to 4.4.10 are vulnerable to PHP Object Injection via unsafe deserialization of untrusted input from the 'checkout-email' parameter during checkout AJAX requests. The plugin improperly unserializes data without class restrictions, allowing unauthenticated attackers to inject malicious PHP objects. This vulnerability has a critical severity with a CVSS score of 9.8.