Theviper17Y

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

If you run a WordPress site, you gotta stop whatever you are doing and check your dashboard immediately. So I was just looking through the Wordfence database and found a crazy vulnerability in W3 Total Cache, that huge plugin with almost a million active installs. We are talking about an unauthenticated Stored Cross-Site Scripting flaw, CVE-2026-78438, affecting every single version up to 2.10.5. This thing gets a 7.2 severity score which is insane because an attacker does not even need to be logged in to inject malicious script through the lazy load background mutator and compromise your site. Imagine waking up to find your site or your client sites injected with spam or malware just because of a missed update. Go check your installed plugins right now and update that thing to the latest version before someone takes advantage of it. Stay safe out there guys, this stuff is no joke.

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is deliverable via unauthenticated comment submission and executes exclusively for non-logged-in visitors; if comment moderation is enabled, an approving moderator must first publish the comment before the script reaches other users.

**Name of the Vulnerable Software and Affected Versions** WP Recipe Maker Premium versions prior to 10.5.1 **Description** Stored Cross-Site Scripting occurs via the 'wprm-call-to-action' shortcode due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages, which execute when a user accesses the affected page. **Recommendations** Update WP Recipe Maker Premium to version 10.5.1 or later.

**Name of the Vulnerable Software and Affected Versions** Affiliate Super Assistent versions prior to 1.10.3 **Description** Insufficient input sanitization and output escaping in the `doCommentShortcode()` function allow unauthenticated attackers to perform Stored Cross-Site Scripting. This enables the injection of arbitrary web scripts into pages, which execute when a user accesses the affected page. **Recommendations** Update the plugin to a version later than 1.10.2. As a temporary workaround, consider disabling the `doCommentShortcode()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Bold Page Builder versions prior to 5.6.9 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes within the `bt bb shortcode` shortcode. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update Bold Page Builder to version 5.6.9 or later.

**Name of the Vulnerable Software and Affected Versions** Kadence Blocks — Page Builder Toolkit for Gutenberg Editor versions prior to 3.7.8.2 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the Identity Block Inner Image Content. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which execute when a user visits the affected page. This issue is triggerable when the `urlTransparent` attribute is set to a non-empty value, allowing the execution path in the `build html()` function to be reached. **Recommendations** Update to a version newer than 3.7.8.1. As a temporary mitigation, ensure the `urlTransparent` attribute is not set to a non-empty value.

**Name of the Vulnerable Software and Affected Versions** Customer Support Ticket System & Helpdesk plugin for WordPress versions prior to 6.0.6 **Description** Code Injection is possible due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. Unauthenticated attackers can invoke arbitrary parameterless PHP functions, which may disrupt site functionality or expose sensitive information. This is achievable via the `path` parameter. The required nonce is publicly emitted via `wp localize script` when the `[emd form]` shortcode is rendered on any public-facing page, allowing the endpoint to be reached without authentication or privileges. **Recommendations** Update the Customer Support Ticket System & Helpdesk plugin for WordPress to version 6.0.6 or later.

**Name of the Vulnerable Software and Affected Versions** Spectra Gutenberg Blocks – Website Builder for the Block Editor versions prior to 2.19.29 **Description** Stored Cross-Site Scripting occurs via the `uagb/image` block due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update to a version newer than 2.19.28.

**Name of the Vulnerable Software and Affected Versions** RPB Chessboard versions prior to 8.1.3 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. Attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This occurs because the plugin's `comment text()` filter synthesizes attribute-breaking HTML at render time, bypassing WordPress's save-time kses sanitization by using allowed tags and attributes, such as `<a>` elements with `title` and `href` attributes. **Recommendations** Update RPB Chessboard to version 8.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** Plus Addons for Elementor versions prior to 6.4.12 **Description** Authenticated users with Contributor level permissions or higher can execute a Stored Cross-Site Scripting attack. The issue occurs because the `render()` function in `modules/widgets/tp button.php` processes the `custom attributes` variable using the `tp senitize js input()` filter, which can be bypassed to inject malicious scripts. **Recommendations** Update to version 6.4.12.

**Name of the Vulnerable Software and Affected Versions** RTMKit versions prior to 2.0.8 **Description** The RTMKit plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the `render()` function fails to apply `esc attr()` to the `background text heading` setting within the Advanced Heading widget, allowing the value to be concatenated directly into an HTML attribute. Authenticated attackers with contributor-level access or higher can exploit this by injecting arbitrary web scripts into pages, which then execute when a user visits the affected page. **Recommendations** Update RTMKit to a version newer than 2.0.7. As a temporary mitigation, restrict access to the Advanced Heading widget's 'Background Text' parameter for users with contributor-level access.

**Name of the Vulnerable Software and Affected Versions** Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress versions up to, and including, 2.7.5 **Description** The issue allows authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application via the `embeddoc` shortcode. This can be used to query and modify information from internal services. **Recommendations** For versions up to, and including, 2.7.5, update to a version higher than 2.7.5 to resolve the issue. As a temporary workaround, consider restricting access to the `embeddoc` shortcode to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Read More & Accordion plugin for WordPress versions up to, and including, 3.4.2 **Description** The issue is related to a missing capability check on the `expmDeleteData()` function, which allows authenticated attackers with Subscriber-level access and above to delete arbitrary 'read more' posts, resulting in unauthorized modification and loss of data. **Recommendations** For versions up to, and including, 3.4.2, consider disabling the `expmDeleteData()` function until a patch is available to prevent unauthorized data deletion. Restrict access to the plugin's functionality to minimize the risk of exploitation, ensuring only authorized users can modify or delete 'read more' posts.

**Name of the Vulnerable Software and Affected Versions** The Custom Login Page Styler – Limit Login Attempts – Restrict Content With Login – Redirect After Login – Change Login URL – Sign in , Sign out plugin for WordPress versions up to, and including, 7.1.1 **Description** The issue is related to unauthorized access due to a missing capability check on the `lps handle delete all logs()`, `lps handle delete login log()`, and `lps handle end session()` functions. This allows authenticated attackers with Subscriber-level access and above to delete login logs and end user sessions. **Recommendations** For versions up to, and including, 7.1.1, consider disabling the `lps handle delete all logs()`, `lps handle delete login log()`, and `lps handle end session()` functions until a patch is available to prevent unauthorized access. Restrict access to these functions to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress versions up to, and including, 1.3.8.5 **Description** The issue is related to insufficient file path validation in the `dnd codedropz upload delete()` function, allowing unauthenticated attackers to delete a limited number of arbitrary files on the server. However, it is not possible to delete critical files such as `wp-config.php`, which would enable remote code execution (RCE). **Recommendations** For versions up to, and including, 1.3.8.5, update to a version higher than 1.3.8.5 to resolve the issue. As a temporary workaround, consider restricting access to the `dnd codedropz upload delete()` function until a patch is available. Additionally, monitor server logs for suspicious file deletion activity to minimize potential damage.

**Name of the Vulnerable Software and Affected Versions** MDTF – Meta Data and Taxonomies Filter plugin for WordPress versions up to, and including, 1.3.3.6 **Description** The issue is related to Stored Cross-Site Scripting via the plugin's 'mdf results by ajax' shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 1.3.3.6, update to a version higher than 1.3.3.6 to resolve the issue. As a temporary workaround, consider disabling the `mdf results by ajax` shortcode until a patch is available. Restrict access to the `mdf results by ajax` shortcode to minimize the risk of exploitation. Avoid using user-supplied attributes in the affected shortcode until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** The Ultimate WordPress Toolkit – WP Extended plugin for WordPress versions up to, and including, 3.0.12 **Description** The issue is related to time-based SQL Injection via the Login Attempts module due to insufficient escaping on the `user supplied parameter` and lack of sufficient preparation on the existing SQL query. This allows unauthenticated attackers to append additional SQL queries into already existing queries, which can be used to extract sensitive information from the database. **Recommendations** For versions up to, and including, 3.0.12, update to a version higher than 3.0.12 to resolve the issue. As a temporary workaround, consider restricting access to the Login Attempts module until a patch is available.

**Name of the Vulnerable Software and Affected Versions** SKT Page Builder plugin for WordPress versions up to, and including, 4.6 **Description** The issue allows for arbitrary file uploads due to a missing capability check on the `addLibraryByArchive` function. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files that make remote code execution possible. **Recommendations** For versions up to, and including, 4.6, update to a version that includes a fix for the missing capability check on the `addLibraryByArchive` function to prevent arbitrary file uploads. As a temporary workaround, consider disabling the `addLibraryByArchive` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Skyword API Plugin for WordPress versions up to, and including, 2.5.2 **Description** The issue is related to Stored Cross-Site Scripting via the plugin's 'skyword iframe' shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 2.5.2, consider disabling the `skyword iframe` shortcode until a patch is available to prevent exploitation. Restrict access to pages that use this shortcode to minimize the risk of arbitrary web script execution. Update to a version that includes the fix for this issue once it becomes available.