Fantasticplugins
Monthly
Unauthenticated stored cross-site scripting in the SUMO Reward Points for WooCommerce WordPress plugin (versions up to and including 32.7.0) lets any anonymous visitor inject persistent JavaScript through the `/wp-json/wc-srp/v1/earning` REST endpoint. A broken `user_has_cap` filter hands the `rs_earning_read` capability to everyone, so an attacker can write an unsanitized `reason` value that later executes in an administrator's browser when the Master Log or User Reward Points pages are viewed. There is no public exploit identified at time of analysis and the plugin is not on CISA KEV, but the flaw is trivially reachable and Wordfence-confirmed.
A PHP object injection vulnerability exists in FantasticPlugins SUMO Affiliates Pro due to unsafe deserialization of untrusted data (CWE-502). This allows attackers to inject malicious serialized objects, potentially achieving remote code execution or other arbitrary actions depending on available gadget chains in the WordPress environment. All versions before 11.4.0 are affected, and a patch has been made available by the vendor.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FantasticPlugins SUMO Reward Points allows PHP Local File Inclusion.7.0. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Unauthenticated stored cross-site scripting in the SUMO Reward Points for WooCommerce WordPress plugin (versions up to and including 32.7.0) lets any anonymous visitor inject persistent JavaScript through the `/wp-json/wc-srp/v1/earning` REST endpoint. A broken `user_has_cap` filter hands the `rs_earning_read` capability to everyone, so an attacker can write an unsanitized `reason` value that later executes in an administrator's browser when the Master Log or User Reward Points pages are viewed. There is no public exploit identified at time of analysis and the plugin is not on CISA KEV, but the flaw is trivially reachable and Wordfence-confirmed.
A PHP object injection vulnerability exists in FantasticPlugins SUMO Affiliates Pro due to unsafe deserialization of untrusted data (CWE-502). This allows attackers to inject malicious serialized objects, potentially achieving remote code execution or other arbitrary actions depending on available gadget chains in the WordPress environment. All versions before 11.4.0 are affected, and a patch has been made available by the vendor.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FantasticPlugins SUMO Reward Points allows PHP Local File Inclusion.7.0. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.