Jakub Herman

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This is exploitable on any block-theme install via a single unauthenticated GET request to the search results page, or by submitting an anonymous comment on any post with comments enabled; no Forminator-specific content or configuration is required to trigger execution.

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment author url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because WordPress core's esc url() preserves HTML entity-encoded characters, allowing a crafted entity-encoded payload in the comment 'Website' field to survive storage and be DOM-decoded by the browser into executable markup at the sink.

The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires that a submitted comment containing the shortcode payload in an href or src attribute is approved through the site's normal comment moderation workflow; once approved, the shortcode is executed automatically via WP-Cron without any further attacker interaction.

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator replace quiz form data() helper invoking do shortcode() on the fully expanded notification body once the {quiz result} merge tag has been substituted, while the earlier-substituted {user agent} and {refer url} merge tags carry unauthenticated attacker-controlled bytes (the User-Agent header and the referer url POST parameter) through sanitize text field()/esc html(), neither of which strip the '[' and ']' shortcode delimiters. This makes it possible for unauthenticated attackers to execute arbitrary WordPress shortcodes registered on the site by submitting a quiz whose notification template contains {quiz result}; the resulting impact depends on the shortcodes exposed by other installed plugins/themes and can range from arbitrary content injection to information disclosure.

**Name of the Vulnerable Software and Affected Versions** Responsive Lightbox & Gallery versions prior to 2.8.0 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with editor-level access or higher can inject arbitrary web scripts via the `comment` parameter. These scripts execute when a user accesses the affected page, provided the 'Comments' lightbox setting is enabled, a moderator approves the comment, and a visitor clicks the image to open the lightbox. **Recommendations** Update to a version newer than 2.7.9. Disable the 'Comments' lightbox setting to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** Unlimited Elements for Elementor versions prior to 2.0.21 **Description** Insufficient sanitization and escaping of a parameter used in a SQL statement allows authenticated users to perform blind SQL injection attacks. This flaw enables the extraction of arbitrary data from the database. While initially accessible to users with the subscriber role, access was restricted starting from version 2.0.18, meaning subsequent versions require a Contributor role or higher to exploit the issue. **Recommendations** Update Unlimited Elements for Elementor to version 2.0.21 or later.

**Name of the Vulnerable Software and Affected Versions** Kubio AI Page Builder WordPress plugin versions prior to 2.9.3 **Description** The plugin fails to restrict the expansion of allowed HTML elements to the editor context. Consequently, this expanded set of allowed elements is applied to content submitted by unauthenticated users. This allows an attacker to store malicious markup that is subsequently executed in the browser of any visitor or an administrator reviewing the unapproved submission. **Recommendations** Update the plugin to version 2.9.3 or later.

**Name of the Vulnerable Software and Affected Versions** Unlimited Elements for Elementor WordPress plugin versions prior to 2.0.21 **Description** An issue exists where search values are not correctly handled before rewriting a prepared SQL statement. This allows unauthenticated users to perform SQL injection attacks to retrieve non-public content, provided a related widget option is configured differently from its default setting. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Update the plugin to version 2.0.21 or later.

**Name of the Vulnerable Software and Affected Versions** WP Ultimate Review WordPress plugin versions prior to 2.4.4 **Description** Insufficient sanitization and escaping of reviews submitted via the public review form allow unauthenticated visitors to execute Stored Cross-Site Scripting (XSS) attacks. This occurs when user reviews are enabled, affecting any user, including administrators, who views a page displaying the malicious review. **Recommendations** Update the plugin to version 2.4.4 or later.

**Name of the Vulnerable Software and Affected Versions** Wp Social Login and Register Social Counter versions prior to 3.2.2 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. An attacker can inject arbitrary web scripts into pages that execute when a user accesses them. This is achieved by chaining two steps: first, invoking the `dismiss ajax call` endpoint to set the `xs social profile image` meta flag on their account, which activates an unescaped image output branch in the `xs social get avatar()` function; second, setting their display name to a script payload that remains unescaped due to the way `ENT NOQUOTES` is handled. **Recommendations** Update Wp Social Login and Register Social Counter to version 3.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** Rich Showcase for Google Reviews versions prior to 7.1.4 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages. The malicious payload is delivered via a Google review posted for the connected business and is automatically imported by the plugin's default daily cron. The script executes for every visitor upon the DOMContentLoaded event, which is the moment when the initial HTML document has been completely loaded and parsed, without requiring further user interaction. **Recommendations** Update the plugin to version 7.1.4 or later. Restrict the use of the `reviews[].text` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** ProfilePress versions prior to 4.17.5 **Description** Sensitive information exposure occurs via the `get user profile structure` function. Authenticated attackers with subscriber-level access or higher can extract other users' email addresses, login names, and registration dates. This is achieved through the Member Directory's per-row user rebinding by using base64 payloads within the `[pp-custom-html]` shortcode to invoke `[profile-email]`, `[profile-username]`, and `[profile-date-registered]`. Additionally, if the WordPress `users can register` option is enabled, unauthenticated attackers can exploit the issue by providing split shortcode fragments through the registration handler via the `reg nickname` and `reg bio` fields, which are processed without a nonce requirement. A nonce is a unique token used to prevent replay attacks by ensuring a request is intentional and authentic. **Recommendations** Update to version 4.17.5 or later. As a temporary mitigation, disable the `users can register` option in WordPress to prevent unauthenticated exploitation.

**Name of the Vulnerable Software and Affected Versions** All in One SEO versions prior to 5.0.2.1 **Description** Unauthenticated users can execute arbitrary shortcodes registered on the site because the plugin fails to correctly determine which shortcodes are present in content derived from user input before stripping them. On sites upgraded from older versions, the protection is disabled entirely, allowing the issue to be triggered without crafted input. This affects over 3 million WordPress sites. **Recommendations** Update to version 5.0.2.1 or later. Audit all registered shortcodes to understand the potential risk surface. Check untrusted-input fields, such as comments and submissions, for shortcode-syntax patterns.

**Name of the Vulnerable Software and Affected Versions** WP Statistics versions prior to 14.16.15 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs via the `REQUEST URI` query-parameter key, enabling the injection of arbitrary web scripts into pages that execute when a user is tricked into clicking a malicious link. **Recommendations** Update to a version newer than 14.16.14.

**Name of the Vulnerable Software and Affected Versions** The Events Calendar WordPress plugin versions prior to 6.17.5.1 **Description** An unauthenticated AJAX action fails to validate or sanitize submitted data before merging it into the rendering context. This allows unauthenticated users to execute arbitrary shortcodes registered on the site. **Recommendations** Update The Events Calendar WordPress plugin to version 6.17.5.1 or later.

**Name of the Vulnerable Software and Affected Versions** Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE versions prior to 3.2.7 **Description** An issue exists that allows authenticated attackers with subscriber-level access and above to expose sensitive information. By utilizing the `otter form widget filter` parameter, an attacker can extract the email addresses of the five most recent form submitters, their submission dates, and the total count of form submissions for the site. This exposure occurs when the `themeisle blocks form emails` option is non-empty, which is the standard state after a Form block has been saved. **Recommendations** Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to version 3.2.7 or later.

**Name of the Vulnerable Software and Affected Versions** Unlimited Elements for Elementor versions prior to 2.0.21 **Description** The plugin fails to verify if requests to render widget output are made by authorized users. This allows users with low-level permissions, such as the subscriber role, to execute arbitrary WordPress shortcodes on the site. In versions from 2.0.18 onwards, the required permission level was increased to the Contributor role or above. **Recommendations** Update the plugin to version 2.0.21 or later.

**Name of the Vulnerable Software and Affected Versions** Cache Enabler WordPress plugin versions prior to 1.8.17 **Description** An issue exists in the cache purge routine where a URL is not validated before being used to construct a filesystem path. Furthermore, the deletion process is not restricted to the cache directory. This allows unauthenticated users to delete arbitrary files and directories on sites where a request-derived URL is passed to the public cache-clearing hook. **Recommendations** Update Cache Enabler WordPress plugin to version 1.8.17 or later.

**Name of the Vulnerable Software and Affected Versions** Robin Image Optimizer versions prior to 2.0.8 **Description** The plugin fails to escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled. This allows unauthenticated users to submit content that is stored and subsequently executed as Cross-Site Scripting (XSS) in the browser of any user viewing an affected page, including administrators. Cross-Site Scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** Update to version 2.0.8 or later.

**Name of the Vulnerable Software and Affected Versions** WPForms Lite versions 1.5.0.1 through 2.0.2 **Description** The plugin fails to remove shortcode delimiters from submitted field values before they are written back into the rendered form. This allows unauthenticated users to execute arbitrary shortcodes registered on the site, which can be used to read details of attachments belonging to non-public posts. **Recommendations** Update WPForms Lite to a version newer than 2.0.2.