siteground vulnerabilities and threats

Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.

The AI Agent by SiteGround WordPress plugin versions up to and including 1.2.7 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to upload images to the WordPress media library by circumventing the upload_files capability restriction. The vulnerability arises because the plugin does not properly verify user authorization for certain actions, relying instead on a nonce that is accessible to users with block editor access, including Contributors. This missing authorization check enables attackers to perform actions normally restricted to higher-privileged users.

The Speed Optimizer – The All-In-One Performance-Boosting Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 7.8.0. This vulnerability arises from insufficient input sanitization and output escaping of image tag attributes. It allows authenticated users with contributor-level access or higher to inject arbitrary scripts that execute when other users view the affected pages. Exploitation requires the Lazy Load Media option to be enabled in the plugin settings.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SiteGround SiteGround Email Marketing siteground-email-marketing allows Stored XSS.This issue affects SiteGround Email Marketing: from n/a through <= 1.7.5.

Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions.

Missing Authorization vulnerability in SiteGround SiteGround Security sg-security allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteGround Security: from n/a through <= 1.5.8.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SiteGround SiteGround Email Marketing siteground-email-marketing allows Stored XSS.This issue affects SiteGround Email Marketing: from n/a through <= 1.7.1.

Missing Authorization vulnerability in SiteGround SiteGround Security allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteGround Security: from n/a through 1.5.0.

Missing Authorization vulnerability in SiteGround Speed Optimizer.This issue affects Speed Optimizer: from n/a through 7.4.6.