Threat database

A stored cross-site scripting (XSS) vulnerability exists in the WordPress plugin User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission. The flaw is due to insufficient input sanitization and output escaping of the 'wpuf_payment_method' parameter in versions up to and including 4.3.12. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability exploits a bypass technique involving appending a valid gateway keyword to evade sanitization functions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.0.

Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.

Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.

Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions.

Author SQL Injection in WP ERP <= 1.17.9 versions.

Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.

Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.

Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress has a critical vulnerability (CVE-2026-18080) allowing unrestricted upload of dangerous file types via the save_attachments() function. This flaw exists in all versions up to and including 1.17.8 due to missing file extension validation and path normalization when processing inbound IMAP email attachments. An unauthenticated attacker can exploit this by sending a crafted email with a malicious attachment, potentially leading to remote code execution if PHP executes in the uploads directory. Exploitation requires the CRM module and IMAP Email Connect feature to be enabled and configured.

WP Project Manager Pro plugin for WordPress versions up to 4.0.1 is vulnerable to SQL Injection due to improper sanitization of user input. Authenticated users with Subscriber-level access or higher can exploit this vulnerability to append malicious SQL queries, potentially extracting sensitive database information. The vulnerability has a CVSS score of 6.5, indicating medium severity.

CVE-2026-78262 is a critical vulnerability in WP Project Manager versions up to and including 4.0.6. It involves unauthenticated PHP object injection due to deserialization of untrusted data, classified under CWE-502. The vulnerability allows remote attackers to execute arbitrary code without any authentication.

CVE-2026-32478 is a high-severity SQL Injection vulnerability affecting WP Project Manager Pro versions up to and including 4.0.1. The flaw involves improper neutralization of special elements in SQL commands, specifically in the Subscriber component. This vulnerability could allow an attacker with low privileges to execute unauthorized SQL commands, potentially leading to data confidentiality breaches and limited availability impact. No official patch or remediation guidance is currently available from the vendor.

Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.

Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions.

CVE-2026-11421 is a SQL Injection vulnerability in the WordPress plugin 'ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce' affecting all versions up to and including 1.17.4. The flaw arises from improper sanitization of the 'erpadvancefilter' parameter, allowing authenticated users with CRM Agent role or higher to inject SQL code. This vulnerability can be exploited to extract sensitive database information. The CVSS score is 6.5 (medium severity). No official patch or remediation guidance is currently available.

The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capability check on the bogo_category_msg_create() AJAX handler, which is registered for both authenticated (wp_ajax_) and unauthenticated (wp_ajax_nopriv_) users and only validates a nonce ('ajd_protected') that is emitted publicly via wp_localize_script() on every frontend page through front_scripts() . This makes it possible for unauthenticated attackers to modify the plugin's BOGO category-message configuration stored in the spsg_bogo_general_settings option by reading the nonce from any public page and POSTing attacker-controlled data to admin-ajax.