Davidanderson
Monthly
Stored cross-site scripting in the European VAT Compliance Assistant for WooCommerce plugin (all versions through 1.36.10) allows unauthenticated attackers to plant arbitrary script by controlling the CF-IPCountry header during a guest checkout; the value is persisted verbatim in order post-meta and executes when a store administrator views the order in wp-admin. The main constraint is header controllability - CF-IPCountry is normally set by Cloudflare, so injection is practical only where the store is not behind Cloudflare or the edge does not overwrite client-supplied values - and a privileged user must subsequently open the affected order. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the unauthenticated planting path and execution in the admin context warrant prompt patching.
Remote code execution in UpdraftPlus: WP Backup & Migration Plugin for WordPress (versions ≤1.26.4) allows unauthenticated attackers to forge RPC commands as the connected administrator by bypassing signature verification in the UpdraftPlus_Remote_Communications_V2::wp_loaded handler. A flaw in how unchecked decryption return values are handled collapses the encryption key to an all-zero value, enabling arbitrary plugin upload and activation. No public exploit identified at time of analysis, but the plugin's massive WordPress install base and trivial post-bypass impact make this a high-priority patch.
Stored cross-site scripting in the All-In-One Security (AIOS) WordPress plugin through version 5.4.7 allows unauthenticated attackers to inject JavaScript that executes when administrators view the debug logs page. The flaw was reported by Wordfence and requires two specific plugin settings to be enabled simultaneously, and no public exploit identified at time of analysis. Successful exploitation enables nonce theft and privileged actions on behalf of the administrator, potentially leading to full site takeover.
Arbitrary file deletion in WP-Optimize plugin versions ≤4.5.2 allows authenticated attackers with Author-level privileges to delete critical server files including wp-config.php, enabling remote code execution. The vulnerability exploits insufficient path validation in the unscheduled_original_file_deletion function combined with the non-protected 'original-file' meta key that Authors can manipulate via WordPress's Edit Media form or REST API. Wordfence discovered this CWE-22 path traversal flaw affecting the popular WordPress optimization plugin used on hundreds of thousands of sites.
Stored cross-site scripting in the Redux Framework WordPress plugin, affecting all versions up to and including 4.5.15, lets a Subscriber-level account plant script payloads that execute in an administrator's browser when that admin opens the attacker's profile in wp-admin. Two defects combine: the multi_media field renderer prints stored values unescaped into an href attribute, a hidden input value and an HTML element, and Redux_Extension_Users::user_meta_save() evaluates a field's 'permissions' requirement against a request-body 'checkuser_id' rather than the current user, so a low-privileged user can write a field declared for 'manage_options'. Exploitation is conditional - the site must have a theme or plugin that registers a multi_media field through the Redux Users API - and no public exploit code has been identified at time of analysis; the vendor-released patch is version 4.5.16.
Privilege escalation in the Redux Framework WordPress plugin through version 4.5.11 lets an authenticated attacker with only Subscriber-level access escalate to any role, including Administrator, by writing an arbitrary role value during a profile update. The flaw is conditionally exploitable: it only triggers on sites where an active plugin or theme has integrated Redux user-profile fields via Redux_Users::set_profile/set_section/set_field, which is a non-default integration requirement, so having the plugin installed alone is not sufficient. Wordfence rates this 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), the attack requires no victim interaction and is network-reachable, and no public exploit code has been identified at time of analysis; the practical limiting factor is the required third-party profile-field integration.
Stored cross-site scripting in the Redux Framework WordPress plugin affects all versions up to and including 4.5.14, letting an authenticated attacker with only Subscriber-level access plant a persistent script payload that later executes in the browsers of other users, including administrators. The chain works by storing a malicious value in user-meta fields (biography, session_tokens via a crafted login User-Agent, or persisted_preferences via the REST API) and then having that tainted data promoted into the site-wide redux_demo option when a media-URL repair runs on the Redux demo panel; the merged value is rendered without output escaping through the 'user-mediaurl' media field path and the bundled jsonview.js. Rated CVSS 3.1 6.4 Medium (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), it requires a low-privileged account and no victim interaction once the merge has occurred, and no public exploit code or confirmed active exploitation was identified at time of analysis; a fix is available in version 4.5.15.
An authorization bypass in the Redux Framework WordPress plugin, affecting all versions up to and including 4.5.14, lets an authenticated subscriber-level user delete arbitrary media library attachments - including files owned by administrators - by supplying an attacker-chosen attachment_id. Exploitation depends on a non-default configuration: a Custom Fonts field must be registered on the user profile page via Redux_Users::set_profile(), which causes the required redux_custom_fonts nonce to be rendered into the Subscriber's wp-admin/profile.php and hands the attacker the token needed for the unprotected deletion action. The impact is limited to integrity (deletion of attachments) with no confidentiality exposure or code execution; no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV. Vendor-released patch: 4.5.15.
Stored cross-site scripting in the Redux Framework plugin for WordPress through version 4.5.13 lets an authenticated attacker with subscriber-level access or above persist arbitrary JavaScript into user meta via the spinner field, which is later emitted into an unquoted HTML attribute and executed in the browser of any user who views the affected page. Exploitation requires a low-privileged account (PR:L) plus a second user - typically an administrator or profile viewer - loading the injected content, so sites with open or self-registration enabled are at the greatest risk while sites that disable registration or have moved to 4.5.14+ are not exposed. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing).
Stored cross-site scripting in the Redux Framework WordPress plugin affects versions up to and including 4.5.13, allowing an authenticated attacker with subscriber-level access or higher to persist arbitrary script into Media field filter values that execute when another user later loads the affected page. The flaw arises from insufficient sanitization of nested array values in user_meta_save() combined with unescaped output of filter CSS values in render(), yielding a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the mandatory low-privilege account and the need for a higher-privileged victim to view the injected content are the primary exploitation constraints.
Stored XSS in Redux Framework (WordPress plugin) through version 4.5.13.1 allows authenticated Subscriber-level users to inject arbitrary JavaScript into their user profile Slider field, which then executes in an Administrator's browser when the admin views that profile. Three compounding weaknesses enable this: the `user_meta_save()` function skips sanitization of scalar (non-array) values, the `Redux_Slider::render()` method writes slider values into unquoted HTML attributes without escaping, and PHP loose-type comparison in `clean_default()` permits crafted strings like `1 tabindex=0 autofocus onfocus=alert(1) x=` to pass numeric validation. Vendor-released patch 4.5.14 was published September 07, 2026; no public exploit code or active exploitation (CISA KEV) is confirmed at time of analysis.
Reflected Cross-Site Scripting in the Easy Updates Manager WordPress plugin (versions ≤ 9.0.20) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized 'paged' parameter in the pagination() function of MPSUM_List_Table.php. Successful exploitation requires social engineering a logged-in WordPress administrator into clicking a crafted URL, after which the injected script executes in the admin's browser under the site's origin - enabling session hijacking, unauthorized admin actions, or credential theft. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
WP-Optimize plugin for WordPress allows authenticated subscribers and higher to execute admin-only operations including log file access, backup image deletion, and bulk image processing due to missing capability checks in the Heartbeat handler function. The vulnerability affects all versions up to 4.5.0 and requires user authentication but no elevated privileges, enabling privilege escalation from subscriber-level accounts to perform administrative image optimization tasks that should be restricted to site administrators.
Stored cross-site scripting in the European VAT Compliance Assistant for WooCommerce plugin (all versions through 1.36.10) allows unauthenticated attackers to plant arbitrary script by controlling the CF-IPCountry header during a guest checkout; the value is persisted verbatim in order post-meta and executes when a store administrator views the order in wp-admin. The main constraint is header controllability - CF-IPCountry is normally set by Cloudflare, so injection is practical only where the store is not behind Cloudflare or the edge does not overwrite client-supplied values - and a privileged user must subsequently open the affected order. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the unauthenticated planting path and execution in the admin context warrant prompt patching.
Remote code execution in UpdraftPlus: WP Backup & Migration Plugin for WordPress (versions ≤1.26.4) allows unauthenticated attackers to forge RPC commands as the connected administrator by bypassing signature verification in the UpdraftPlus_Remote_Communications_V2::wp_loaded handler. A flaw in how unchecked decryption return values are handled collapses the encryption key to an all-zero value, enabling arbitrary plugin upload and activation. No public exploit identified at time of analysis, but the plugin's massive WordPress install base and trivial post-bypass impact make this a high-priority patch.
Stored cross-site scripting in the All-In-One Security (AIOS) WordPress plugin through version 5.4.7 allows unauthenticated attackers to inject JavaScript that executes when administrators view the debug logs page. The flaw was reported by Wordfence and requires two specific plugin settings to be enabled simultaneously, and no public exploit identified at time of analysis. Successful exploitation enables nonce theft and privileged actions on behalf of the administrator, potentially leading to full site takeover.
Arbitrary file deletion in WP-Optimize plugin versions ≤4.5.2 allows authenticated attackers with Author-level privileges to delete critical server files including wp-config.php, enabling remote code execution. The vulnerability exploits insufficient path validation in the unscheduled_original_file_deletion function combined with the non-protected 'original-file' meta key that Authors can manipulate via WordPress's Edit Media form or REST API. Wordfence discovered this CWE-22 path traversal flaw affecting the popular WordPress optimization plugin used on hundreds of thousands of sites.
Stored cross-site scripting in the Redux Framework WordPress plugin, affecting all versions up to and including 4.5.15, lets a Subscriber-level account plant script payloads that execute in an administrator's browser when that admin opens the attacker's profile in wp-admin. Two defects combine: the multi_media field renderer prints stored values unescaped into an href attribute, a hidden input value and an HTML element, and Redux_Extension_Users::user_meta_save() evaluates a field's 'permissions' requirement against a request-body 'checkuser_id' rather than the current user, so a low-privileged user can write a field declared for 'manage_options'. Exploitation is conditional - the site must have a theme or plugin that registers a multi_media field through the Redux Users API - and no public exploit code has been identified at time of analysis; the vendor-released patch is version 4.5.16.
Privilege escalation in the Redux Framework WordPress plugin through version 4.5.11 lets an authenticated attacker with only Subscriber-level access escalate to any role, including Administrator, by writing an arbitrary role value during a profile update. The flaw is conditionally exploitable: it only triggers on sites where an active plugin or theme has integrated Redux user-profile fields via Redux_Users::set_profile/set_section/set_field, which is a non-default integration requirement, so having the plugin installed alone is not sufficient. Wordfence rates this 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), the attack requires no victim interaction and is network-reachable, and no public exploit code has been identified at time of analysis; the practical limiting factor is the required third-party profile-field integration.
Stored cross-site scripting in the Redux Framework WordPress plugin affects all versions up to and including 4.5.14, letting an authenticated attacker with only Subscriber-level access plant a persistent script payload that later executes in the browsers of other users, including administrators. The chain works by storing a malicious value in user-meta fields (biography, session_tokens via a crafted login User-Agent, or persisted_preferences via the REST API) and then having that tainted data promoted into the site-wide redux_demo option when a media-URL repair runs on the Redux demo panel; the merged value is rendered without output escaping through the 'user-mediaurl' media field path and the bundled jsonview.js. Rated CVSS 3.1 6.4 Medium (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), it requires a low-privileged account and no victim interaction once the merge has occurred, and no public exploit code or confirmed active exploitation was identified at time of analysis; a fix is available in version 4.5.15.
An authorization bypass in the Redux Framework WordPress plugin, affecting all versions up to and including 4.5.14, lets an authenticated subscriber-level user delete arbitrary media library attachments - including files owned by administrators - by supplying an attacker-chosen attachment_id. Exploitation depends on a non-default configuration: a Custom Fonts field must be registered on the user profile page via Redux_Users::set_profile(), which causes the required redux_custom_fonts nonce to be rendered into the Subscriber's wp-admin/profile.php and hands the attacker the token needed for the unprotected deletion action. The impact is limited to integrity (deletion of attachments) with no confidentiality exposure or code execution; no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV. Vendor-released patch: 4.5.15.
Stored cross-site scripting in the Redux Framework plugin for WordPress through version 4.5.13 lets an authenticated attacker with subscriber-level access or above persist arbitrary JavaScript into user meta via the spinner field, which is later emitted into an unquoted HTML attribute and executed in the browser of any user who views the affected page. Exploitation requires a low-privileged account (PR:L) plus a second user - typically an administrator or profile viewer - loading the injected content, so sites with open or self-registration enabled are at the greatest risk while sites that disable registration or have moved to 4.5.14+ are not exposed. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing).
Stored cross-site scripting in the Redux Framework WordPress plugin affects versions up to and including 4.5.13, allowing an authenticated attacker with subscriber-level access or higher to persist arbitrary script into Media field filter values that execute when another user later loads the affected page. The flaw arises from insufficient sanitization of nested array values in user_meta_save() combined with unescaped output of filter CSS values in render(), yielding a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the mandatory low-privilege account and the need for a higher-privileged victim to view the injected content are the primary exploitation constraints.
Stored XSS in Redux Framework (WordPress plugin) through version 4.5.13.1 allows authenticated Subscriber-level users to inject arbitrary JavaScript into their user profile Slider field, which then executes in an Administrator's browser when the admin views that profile. Three compounding weaknesses enable this: the `user_meta_save()` function skips sanitization of scalar (non-array) values, the `Redux_Slider::render()` method writes slider values into unquoted HTML attributes without escaping, and PHP loose-type comparison in `clean_default()` permits crafted strings like `1 tabindex=0 autofocus onfocus=alert(1) x=` to pass numeric validation. Vendor-released patch 4.5.14 was published September 07, 2026; no public exploit code or active exploitation (CISA KEV) is confirmed at time of analysis.
Reflected Cross-Site Scripting in the Easy Updates Manager WordPress plugin (versions ≤ 9.0.20) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized 'paged' parameter in the pagination() function of MPSUM_List_Table.php. Successful exploitation requires social engineering a logged-in WordPress administrator into clicking a crafted URL, after which the injected script executes in the admin's browser under the site's origin - enabling session hijacking, unauthorized admin actions, or credential theft. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
WP-Optimize plugin for WordPress allows authenticated subscribers and higher to execute admin-only operations including log file access, backup image deletion, and bulk image processing due to missing capability checks in the Heartbeat handler function. The vulnerability affects all versions up to 4.5.0 and requires user authentication but no elevated privileges, enabling privilege escalation from subscriber-level accounts to perform administrative image optimization tasks that should be restricted to site administrators.