Ghozylab
Monthly
Stored cross-site scripting in the GhozyLab Image Slider Widget WordPress plugin (versions through 1.1.130) lets an authenticated low-privilege user - a contributor or author able to submit content - inject script into slider fields that executes in the browser of any administrator or editor who later views the rendered slider. CVSS 3.1 rates this 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting mandatory authentication (PR:L), required victim interaction (UI:R), and scope change because the payload escapes the plugin's context into the broader WordPress page. No public exploit identified at time of analysis, and the plugin is not in CISA KEV.
Stored cross-site scripting in WP Composer - The Easiest Page Builder (Ghozylab) affects every release up to and including 1.0.5: the pbwp_raw_shortcode handler Base64-decodes its content and echoes it into the page without sanitization or escaping, so an attacker who can author content through the plugin can persist a script that runs in the browser of anyone who later views the page. Exploitation requires an authenticated account with Contributor-level capability or above (PR:L in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N vector), and because the payload is Base64-encoded it contains no raw HTML characters at save time and therefore slips past WordPress's KSES content filtering - execution is deferred until a victim, ideally a higher-privileged editor or administrator, opens the injected page. Impact is limited to client-side script execution within the site origin (low confidentiality and integrity, no availability loss, no server-side compromise); no public exploit code or CISA KEV listing was identified at time of analysis, and consistent with the independent assessment this is a moderate, not urgent, priority.
The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and above to perform Stored Cross-Site. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Form Plugin Team - GhozyLab Easy Contact Form Lite allows Stored XSS.1.23. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WordPress plugin Gallery for Social Photo is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.0.27 due to failure to properly check for the existence of a nonce in. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The WordPress plugin Image Slider is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1.121 due to failure to properly check for the existence of a nonce in the function. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for WordPress allow remote authenticated users to inject. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Stored cross-site scripting in the GhozyLab Image Slider Widget WordPress plugin (versions through 1.1.130) lets an authenticated low-privilege user - a contributor or author able to submit content - inject script into slider fields that executes in the browser of any administrator or editor who later views the rendered slider. CVSS 3.1 rates this 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting mandatory authentication (PR:L), required victim interaction (UI:R), and scope change because the payload escapes the plugin's context into the broader WordPress page. No public exploit identified at time of analysis, and the plugin is not in CISA KEV.
Stored cross-site scripting in WP Composer - The Easiest Page Builder (Ghozylab) affects every release up to and including 1.0.5: the pbwp_raw_shortcode handler Base64-decodes its content and echoes it into the page without sanitization or escaping, so an attacker who can author content through the plugin can persist a script that runs in the browser of anyone who later views the page. Exploitation requires an authenticated account with Contributor-level capability or above (PR:L in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N vector), and because the payload is Base64-encoded it contains no raw HTML characters at save time and therefore slips past WordPress's KSES content filtering - execution is deferred until a victim, ideally a higher-privileged editor or administrator, opens the injected page. Impact is limited to client-side script execution within the site origin (low confidentiality and integrity, no availability loss, no server-side compromise); no public exploit code or CISA KEV listing was identified at time of analysis, and consistent with the independent assessment this is a moderate, not urgent, priority.
The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and above to perform Stored Cross-Site. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Form Plugin Team - GhozyLab Easy Contact Form Lite allows Stored XSS.1.23. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WordPress plugin Gallery for Social Photo is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.0.27 due to failure to properly check for the existence of a nonce in. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The WordPress plugin Image Slider is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1.121 due to failure to properly check for the existence of a nonce in the function. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for WordPress allow remote authenticated users to inject. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.