Threat database

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The nonce required to pass the only gate is emitted to unauthenticated visitors via the public review form, and submitted shortcode payloads are auto-published without admin approval by default, meaning exploitation requires no account and no privileged interaction.

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. The bypass relies on WordPress's own strip_shortcodes() function unwrapping the [[tag]] double-bracket escape to a bare [tag] that survives wp_insert_post storage and fires when the publicly queryable xs_review post type is rendered through the_content.

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to chain two steps: invoking the nonce-only dismiss_ajax_call endpoint (nonce accessible to Subscribers via any wp-admin page) to set the xs_social_profile_image meta flag on their own account, which activates the unescaped img output branch in xs_social_get_avatar, and then setting their display name to a script payload that core's ENT_NOQUOTES handling preserves unescaped.

Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.

The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'shopengine_product_title_header_size' parameter. This affects all versions up to and including 4.9.5. Authenticated users with Author-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.

The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress contains a privilege escalation vulnerability in all versions up to and including 4.9.4. The vulnerability arises because the `rum_importer()` function is hooked to the WordPress `import_start` action without proper capability checks, allowing authenticated users with Shop Manager-level access to write arbitrary WordPress options. This can enable attackers to set options such as `users_can_register` to `1` and `default_role` to `administrator`, allowing open self-registration of administrator accounts and full site takeover.

The MetForm plugin for Elementor versions up to and including 4.1.8 contains a stored cross-site scripting (XSS) vulnerability via the 'mf_form_id' widget setting. This vulnerability allows authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages. The attack bypasses Elementor's standard content filtering and uses a transformation of script tags to evade detection.

The FundEngine – Donation and Crowdfunding Platform WordPress plugin is vulnerable to stored Cross-Site Scripting (XSS) via the 'wfp_featured_video_url' parameter in all versions up to and including 1.8.1. Authenticated users with subscriber-level access or higher can inject arbitrary scripts that execute when other users view the affected pages. The REST endpoint involved has a permission callback that allows any authenticated user to reach the vulnerable code path.

The FundEngine – Donation and Crowdfunding Platform WordPress plugin up to version 1.8.1 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can modify arbitrary posts and pages, including changing titles, content, and ownership. This is possible because the plugin does not properly verify user authorization and relies on a wp_rest nonce that is easily obtainable by any logged-in user, thus failing to provide an effective authorization barrier.

CVE-2026-73993 is a critical vulnerability in Roxnor FundEngine versions up to and including 1.7.9. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw allows remote attackers to execute arbitrary code without requiring authentication.

Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.

Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.

Subscriber Broken Access Control in FundEngine <= 1.7.8 versions.

Missing Authorization vulnerability in Roxnor FundEngine wp-fundraising-donation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FundEngine: from n/a through <= 1.7.6.

Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions.

CVE-2026-4362 is a medium severity vulnerability in the ElementsKit Elementor Addons WordPress plugin up to version 3.8.2. It allows unauthenticated attackers to modify Elementor widget content by exploiting a missing authorization check in the Live_Action::reset() function. This function is triggered via specific GET parameters without authentication or nonce verification, enabling attackers to overwrite custom post type data with blank templates.

The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to and including 1.6.5. This is due to a flawed path traversal validation in the create_template() method of the CheckForm class, where realpath() is called on the allowed base directory (wp-content/uploads/emailkit/templates/) which may not exist, causing it to return false. In PHP 8.x, strpos($real_path, false) implicitly converts false to an empty string, and strpos() with an empty needle always returns 0, causing the check strpos(...) !== 0 to evaluate to false and bypassing the path validation entirely. This makes it possible for authenticated attackers, with Author-level access and above, to read arbitrary files from the server, including sensitive files such as wp-config.php, by supplying an absolute path to the emailkit-editor-template REST API parameter.

Missing Authorization vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wp Ultimate Review: from n/a through <= 2.3.8.

The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ekit_tab_title' parameter in the Simple Tab widget in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.