Threat database

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress contains a critical path traversal vulnerability in the rename_files function affecting all versions up to and including 34.0.10. This flaw allows unauthenticated attackers to delete arbitrary files on the server. The attack can lead to remote code execution by deleting sensitive files such as wp-config.php. Additionally, the vulnerability enables arbitrary file reads by relocating files into a publicly accessible directory.

The RSS Aggregator by Feedzy plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to and including 5.2.10. Authenticated users with contributor-level access or higher can inject malicious scripts via the RSS feed title, which are executed when other users view the affected pages. The vulnerability arises because the plugin does not properly sanitize or escape input from external RSS feed titles at render time, bypassing save-time filtering.

CVE-2026-97305 is an authorization bypass vulnerability in the Themeisle AI Chatbot for WordPress – Hyve Lite plugin. It allows attackers to exploit incorrectly configured access control security levels via a user-controlled key. This affects versions from initial releases up to 2.0.2. The vulnerability has a medium severity with a CVSS 4.0 score of 6.9.

The Otter Blocks plugin for WordPress versions up to 3.2.6 has a vulnerability that allows authenticated users with subscriber-level access or higher to access sensitive information. Specifically, these users can retrieve email addresses of the five most recent form submitters, their submission dates, and the total form submission count via the 'otter_form_widget_filter' parameter. This exposure occurs whenever the form feature is used on a site, making it a risk for sites utilizing the plugin's form blocks.

CVE-2026-62073 is a high-severity vulnerability in the WP Full Stripe Free plugin by Themeisle. It involves missing authorization controls in versions up to 8.5.6, allowing unauthenticated users to perform actions that should require authorization. The vulnerability does not impact confidentiality or availability but can lead to integrity violations. No patch or remediation information is currently provided.

Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.

The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when the [mpg_spintax] shortcode is rendered in site-wide content such as a footer or template part, as the vulnerable code path is only reached when the shortcode is active on the requested page.

The Otter Blocks plugin for WordPress versions up to 3.1.7 contains an authorization bypass vulnerability due to insecure direct object reference in the 'watch_checkout' function. This flaw allows unauthenticated attackers to manipulate the product_id parameter independently of the price_id parameter in the Stripe checkout URL, enabling them to pay for a lower-cost product while receiving entitlement for a premium product.

Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.

Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions.

Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions.

The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backend-title' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1.

Server-Side Request Forgery (SSRF) vulnerability in Themeisle Auto Featured Image (Auto Post Thumbnail) auto-post-thumbnail allows Server Side Request Forgery.This issue affects Auto Featured Image (Auto Post Thumbnail): from n/a through <= 5.0.4.

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'aspectRatio' Attribute in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access and export the contents of any visualizer chart on the site — including charts in draft, private, pending, future, or trash status — as CSV, Excel, or HTML via the /wp-json/visualizer/v1/action/{chart}/{type}/ REST endpoint. This bypass is particularly impactful because the standard WordPress REST endpoint for the non-public 'visualizer' custom post type correctly enforces capability checks and returns HTTP 401 to unauthenticated callers, whereas this plugin-registered route circumvents that protection entirely.

The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the wpfs_update_failed_payment_status AJAX action. The handler is registered through both wp_ajax_ and wp_ajax_nopriv_ hooks and the underlying update_failed_payment_status() function performs no capability check, no nonce verification, and no logged-in check before calling $this->db->updatePaymentByEventId() with attacker-controlled POST parameters. This makes it possible for unauthenticated attackers who can obtain a valid Stripe Payment Intent ID for the target site (Payment Intent IDs are exposed to the customer browser during normal Stripe.js checkout flows) to manipulate payment records in the site's database, marking previously successful payments as failed and overwriting failure codes and messages with attacker-supplied values.

Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2 versions.