Kuba

The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is stored unconditionally because debug logging is enabled by default, and the debug-log viewer is accessible to anyone holding the site-wide Support PIN (an HMAC-MD5 of AUTH SALT displayed in wp-admin), meaning the injected script will execute against the administrator's session during ordinary support or troubleshooting workflows.

The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running do shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. A Subscriber-level user need only save the shortcode payload to their own Biographical Info field via the REST API or wp-admin profile page; the shortcode then executes on any unauthenticated front-end request that resolves that author's description, such as requests using the ?author= query parameter when auto redirection is disabled.

The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the get user profile structure() function assembling the front-end profile buffer — which includes raw comment excerpts inlined by author comment query() — and passing the entire buffer to do shortcode() after only a narrow neutralization pass (ppress neutralize buffer shortcodes) that blocks pp-custom-html and bracket fragments containing HTML delimiters but leaves any other well-formed shortcode intact. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary shortcodes (from any active plugin or theme) with attacker-chosen attributes by posting a comment whose body contains the shortcode markup; the shortcode is then executed server-side when any visitor loads the target's front-end profile Comments tab, letting the attacker reach capability-gated or data-returning shortcodes and inject raw HTML markup into a publicly viewable page.

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires that the site administrator has enabled the Optimize CSS feature (with the default Inline Google Fonts option active), but once that condition is met the attack is trivially triggered by an unauthenticated visitor with a single crafted GET request to the public search URL.

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route' parameter. This makes it possible for unauthenticated attackers to extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field. The plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint correctly redacts the password for unauthenticated callers via redact settings for public(), but no equivalent redaction is applied on the core /wp-json/wp/v2/modula-gallery path exposed by show in rest=true CPT registration.

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII — including full name, street address, email address, and phone number — for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty order meta] or [wfty order total] shortcode.

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe to email list` endpoint accepting an attacker-supplied `optin data[form custom field mappings]` parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary `wp users` column names — including `ID` and `user pass` — directly into `wp insert user()` via the `subscribe()` function. This makes it possible for unauthenticated attackers to force `wp insert user()` into UPDATE mode on any existing account by supplying a target user's numeric `ID`, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account — including administrators — leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the vulnerable endpoint.

The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access any order's secret order key and full billing and shipping PII — including first name, last name, email address, phone number, street address, postcode, city, region, and country — emitted inline as the klarna payments params JavaScript variable, enabling full store-wide order enumeration. Because WooCommerce order IDs are sequential integers and no order key or authenticated session is required, every order in the store can be trivially enumerated with sequential GET requests to the order-pay endpoint.

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The extension blocklist gatekeeper is bypassed by uploading text-type files (.txt, .csv, .vtt, .srt, .asc) whose contents begin with an HTML payload such as '<BODY onload=…>', as the check classifies these files as text/plain without inspecting their byte content.

The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings dialog() function building the {url} template placeholder from a sanitize text field()-filtered $ SERVER['REQUEST URI'] on archive pages and then passing the substituted greeting content to do shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp kses() runs against main content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e.

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted lesson page to have an empty nav-items array — a condition that occurs naturally when a lesson has no post content, no attachments, and comments are disabled or the viewer is not logged in — which bypasses the in array() tab validation and allows the raw attacker-controlled value to reach the sink.

The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkit post block' and 'jeg find author' AJAX actions in versions up to, and including, 3.2.19. The 'wp ajax jkit post block' handler (registered generically for every element via wp ajax {$element id} in Elements Option Abstract::setup hook) returns the element's full option schema — including a freshly minted wp create nonce('jeg find author') — to any authenticated caller, and the 'wp ajax jeg find author' handler then runs a WP User Query with the attacker-supplied 'query' wrapped in '*…*' against search columns that include user email, echoing the ID and display name of every matching user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every registered user of the site and to reconstruct arbitrary users' email addresses one character at a time by using the substring search as an oracle.

**Name of the Vulnerable Software and Affected Versions** Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker versions prior to 11.2.7 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. By submitting an over-length or duplicate `qsm unique key` value, an attacker can force the `mlw results` INSERT operation to fail. This action triggers an audit trail code branch that writes an unescaped payload via the `qsm hidden questions` parameter into `wp mlw qm audit trail.form data`, enabling the execution of arbitrary web scripts when a user accesses the affected page. **Recommendations** Update to a version newer than 11.2.6. Avoid using the `qsm hidden questions` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Table Field Add-on for ACF and SCF versions prior to 1.4.1-RC2 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the Table Field Value, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users. **Recommendations** Update the plugin to a version later than 1.4.1-RC2.

**Name of the Vulnerable Software and Affected Versions** Form Maker by 10Web versions prior to 1.15.49 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS), a technique where malicious scripts are injected into a web page and executed in the victim's browser. This occurs via the `inputs (array key)` parameter, enabling the execution of arbitrary web scripts if a user is tricked into clicking a malicious link. **Recommendations** Update the plugin to a version newer than 1.15.48.

**Name of the Vulnerable Software and Affected Versions** SpeedyCache – Cache, Optimization, Performance versions prior to 1.4.3 **Description** An issue exists where unauthenticated attackers can extract the full name and email address of returning commenters. This occurs because the plugin fails to implement a check on the write path in `advanced-cache.php`, allowing cache poisoning. When a returning commenter's information is pre-filled into comment form input fields via the `comment author *` and `comment author email *` parameters, this data can be persisted as the site-wide cached page. Consequently, any other unauthenticated attacker requesting the same public URL can access this sensitive information. **Recommendations** Update the plugin to a version newer than 1.4.2.

**Name of the Vulnerable Software and Affected Versions** All in One SEO versions prior to 5.0.3 **Description** The plugin allows unauthenticated attackers to execute arbitrary shortcodes because it fails to properly validate a value before running the `do shortcode()` function. This issue occurs when the AIOSEO breadcrumb is rendered on the search results page through a block, widget, shortcode, or template tag. **Recommendations** Update to version 5.0.3 or later.

**Name of the Vulnerable Software and Affected Versions** WPC Smart Quick View for WooCommerce versions prior to 4.4.1 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs via the `woosq-redirect` parameter, enabling the injection of arbitrary web scripts that execute when a user loads a crafted URL. The issue requires the WooCommerce redirect to cart after add to cart option to be enabled, though the `?quick-view=` auto-open mechanism allows script execution without further user interaction beyond loading the URL. **Recommendations** Update WPC Smart Quick View for WooCommerce to version 4.4.1 or later. Avoid using the `woosq-redirect` parameter in the affected plugin until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Simple Membership plugin for WordPress versions prior to 4.8.4 **Description** Unauthorized modification of data and sensitive information disclosure occur via the 'resend-activation' and 'email-activation' endpoints. These endpoints are dispatched from the `check and do email activation()` function within `SwpmInitTimeTasks` during frontend initialization without authentication, nonce, capability, or ownership checks. An unauthenticated attacker can use the `email` parameter in the `$ POST` request to override a member's registered address. This allows the redirection of pending activation emails and subsequent registration completion emails, which contain the member's username and plaintext password, to an address controlled by the attacker, enabling unauthorized account activation. **Recommendations** Update the plugin to version 4.8.4 or later. Restrict access to the 'resend-activation' and 'email-activation' endpoints as a temporary mitigation.

**Name of the Vulnerable Software and Affected Versions** Visitor Traffic Real Time Statistics plugin for WordPress versions prior to 8.17 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. An attacker can inject arbitrary web scripts by sending a forged `X-Real-IP` HTTP header to the `wp ajax nopriv ahcfree track visitor` endpoint. The payload is stored verbatim in the database and executes whenever a user accesses the affected page. **Recommendations** Update the Visitor Traffic Real Time Statistics plugin for WordPress to version 8.17 or later.