Roxnor
Monthly
Authenticated shortcode injection in the WP Ultimate Review WordPress plugin (Roxnor) allows any user with subscriber-level access or higher to run arbitrary registered shortcodes on sites running version 2.4.2 or earlier. The attacker passes a crafted value to a plugin action that feeds it into do_shortcode() without validation (CWE-94), yielding high confidentiality and integrity impact per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (8.1). No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but on sites with open registration the subscriber prerequisite is trivial to satisfy, and the real-world severity is bounded by which powerful shortcodes are registered by this or other installed plugins and themes - arbitrary operating-system command execution is not guaranteed.
Privilege escalation in ShopEngine (all versions up to and including 4.9.4) allows Shop Manager-level authenticated users to achieve full WordPress site takeover by injecting arbitrary core options through a malicious WXR import file. The plugin's `rum_importer()` function is hooked to the WordPress core `import_start` action without any plugin-owned capability check or allowlist filtering, meaning attacker-controlled `<wp_option>` pairs from a crafted import file flow directly into `update_option()` - enabling manipulation of `users_can_register` and `default_role` to open administrator self-registration. No CISA KEV listing or EPSS score was present in the provided data; exploitation requires an existing Shop Manager account and WooCommerce's grant of the `import` capability to that role, but once those conditions are met the path to full site compromise is straightforward and documented.
Unauthenticated PHP object injection in the Roxnor FundEngine (wp-fundraising-donation) WordPress plugin through version 1.7.9 lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() sink without authentication. If a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary code execution, file operations, or SQL manipulation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated PHP Object Injection in the FundEngine WordPress fundraising/donation plugin (slug wp-fundraising-donation) affects all versions up to and including 1.7.9, letting a remote attacker with no authentication inject a crafted serialized PHP object into an application deserialization sink. Given the CWE-502 root cause and the PR:N/UI:N vector, a successful attack can pivot to remote code execution, data theft, or full site takeover when a suitable POP gadget chain is reachable. Reported by Patchstack and rated CVSS 9.8, with no public exploit identified at time of analysis and no CISA KEV listing.
Unauthenticated remote attackers can execute arbitrary registered WordPress shortcodes through the WP Ultimate Review plugin (versions up to and including 2.4.3), because the plugin passes an unvalidated value to do_shortcode and the only nonce gate is emitted to anonymous visitors via the public review form, while submitted reviews auto-publish without administrator approval by default. The CVSS 3.1 base score is 6.5 (Medium) with low confidentiality and integrity impact and no availability impact; the real-world severity depends on which shortcodes exist on the target site. No public exploit code has been identified at time of analysis, and CISA KEV does not list this issue.
Arbitrary shortcode execution in the WP Ultimate Review WordPress plugin through version 2.4.3 lets any authenticated user with subscriber-level access or higher inject shortcodes that are stored and later executed when review content is rendered. The bypass abuses WordPress core behavior: the plugin passes attacker-controlled data into do_shortcode without validation, and the [[tag]] double-bracket escape is unwrapped to a bare [tag] by strip_shortcodes(), surviving wp_insert_post storage and firing through the_content on the publicly queryable xs_review post type. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV); exploitation requires a low-privilege account, which makes it practically significant on sites with open user registration.
Stored cross-site scripting in the Wp Social Login and Register Social Counter WordPress plugin (all versions up to and including 3.2.1) lets any authenticated account with subscriber-level access or above plant a script payload that executes in the browser of anyone who later views the poisoned avatar. Exploitation is a two-step chain: the attacker first invokes the plugin's nonce-only dismiss_ajax_call AJAX endpoint (the nonce is exposed to subscribers on any wp-admin page) to set the xs_social_profile_image user-meta flag on their own account, then stores a script payload in their display name, which xs_social_get_avatar echoes unescaped into an img alt attribute because WordPress core's ENT_NOQUOTES handling preserves the quotes needed to break out. Scored CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), it is a moderate-severity issue; no public exploit code has been identified at time of analysis and it is not confirmed actively exploited (CISA KEV), and the impact only materializes when a victim - ideally a privileged user such as an administrator - browses a page rendering the attacker's avatar.
ElementsKit Elementor addons Lite through version 4.0.5 contains a Cross-Site Scripting flaw (CWE-79) that lets a low-privileged user plant script content which executes in a higher-privileged user's browser session. Exploitation requires an authenticated WordPress account with at least Contributor-level privileges (CVSS vector PR:L), and the payload only fires when an administrator or other privileged user views the attacker-controlled content, making victim interaction a hard prerequisite (UI:R). The scope is rated Changed because the injected script runs in the victim's session rather than the attacker's own context, so it can act with the victim's privileges; no KEV listing or public exploit code was identified at time of analysis, and Patchstack is the reporting source. Impact is bounded to low confidentiality, integrity, and availability effects under the assessed vector, but the Changed scope means an administrator session could be abused for further actions inside the WordPress dashboard.
Stored Cross-Site Scripting in the ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress (versions up to and including 4.9.5) allows authenticated attackers with Author-level access or higher to persistently inject arbitrary JavaScript via the `shopengine_product_title_header_size` parameter. The injected payload executes in any site visitor's browser upon loading an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit code has been identified at time of analysis, and it is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in MetForm for WordPress (all versions through 4.1.8) allows authenticated contributors to permanently inject arbitrary JavaScript into pages via the 'mf_form_id' Elementor widget setting, exploiting two independent filter bypass paths. The payload evades Elementor's save-time wp_kses_post filter because it contains no HTML tags, and MetForm's own str_replace logic transforms script-tag constructs into executable JavaScript template literals - providing a second delivery route. Any visitor loading an injected page has the script execute in their browser context, enabling session hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the FundEngine WordPress plugin (versions up to and including 1.8.1) allows any authenticated user with at minimum Subscriber-level access to inject persistent malicious scripts via the `wfp_featured_video_url` parameter. The REST endpoint that processes this input has its `permission_callback` hardcoded to `__return_true`, effectively bypassing WordPress role-based access controls and exposing the vulnerable code path to the lowest-privilege registered user. Injected scripts execute in the browsers of any subsequent visitor to the affected campaign page, enabling session hijacking, credential theft, or further lateral movement. No confirmed active exploitation has been identified (not in CISA KEV) and no public exploit code is referenced at time of analysis.
Authorization bypass in the FundEngine WordPress donation and crowdfunding plugin (all versions through 1.8.1) allows authenticated subscribers to overwrite the title, body, and author field of any post or page on the affected site. The vulnerable handler in apps/content.php accepts an attacker-supplied post_author integer without verifying the caller's rights over the target post, and the wp_rest nonce that nominally gates the endpoint is freely retrievable by any logged-in user from /wp-admin/admin-ajax.php?action=rest-nonce, eliminating it as a meaningful access control. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal authentication requirement elevate real-world risk on sites that permit open subscriber registration.
Authenticated users holding only a Subscriber-level WordPress account can disrupt the fundraising functionality of sites running the FundEngine plugin (slug wp-fundraising-donation) through version 1.7.8, because a plugin action omits its capability and nonce authorization checks (CWE-862 missing authorization). The effect is limited to availability - there is no data disclosure or modification - and access requires an existing low-privilege login, which is realistic mainly where open user registration is enabled or the attacker already has an account. No public exploit code has been identified and there is no indication of active exploitation; EPSS is a low 0.35% (28th percentile) and CISA's SSVC framework rates exploitation as none, automatable as no, and technical impact as partial.
Missing authorization in the FundEngine WordPress fundraising plugin (versions through 1.7.6) permits unauthenticated remote attackers to exploit incorrectly configured access control, resulting in partial data integrity and availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, unauthenticated network exploitation with no user interaction required. No active exploitation is confirmed in the CISA KEV catalog, and no public exploit code has been identified at the time of this analysis.
ElementsKit Elementor Addons plugin for WordPress versions up to 3.8.2 allows unauthenticated attackers to overwrite Elementor widget content via a missing capability check in the Live_Action::reset() function. By crafting a URL with specific GET parameters (post and action=elementor), attackers can permanently replace any elementskit_widget custom post type's design, text, and configurations with a blank template, causing data loss without requiring authentication or user interaction.
EmailKit plugin for WordPress versions up to 1.6.5 allows authenticated attackers with Author-level access to read arbitrary files from the server due to a path traversal vulnerability in the create_template() method. The vulnerability exploits a PHP 8.x type coercion flaw where realpath() returns false for non-existent directories, causing strpos() validation to incorrectly evaluate and bypass directory restrictions. Attackers can retrieve sensitive files such as wp-config.php by submitting absolute paths via the emailkit-editor-template REST API parameter. No public exploit code identified at time of analysis, though the vulnerability mechanism is trivial to weaponize once authentication is obtained.
Missing authorization in Roxnor Wp Ultimate Review plugin versions up to 2.3.8 allows unauthenticated remote attackers to access restricted functionality through incorrectly configured access control security levels, resulting in limited information disclosure. The vulnerability carries a low EPSS exploitation probability (0.02%, 4th percentile) and has not been confirmed as actively exploited, though the simple attack vector (network-accessible, no complexity, no authentication required) means opportunistic exploitation is feasible.
Stored Cross-Site Scripting in ElementsKit Elementor Addons and Templates plugin (versions up to 3.7.9) allows authenticated contributors and above to inject malicious scripts via the 'ekit_tab_title' parameter in the Simple Tab widget due to insufficient input sanitization and output escaping. Injected scripts execute when users access affected pages. No public exploit code or active exploitation has been identified at time of analysis.
The EmailKit - Email Customizer for WooCommerce & WP WordPress plugin contains a path traversal vulnerability in the TemplateData class that allows authenticated administrators to read arbitrary files from the server via the 'emailkit-editor-template' REST API parameter. An attacker with Administrator privileges can exploit this flaw to access sensitive files such as wp-config.php or /etc/passwd by supplying directory traversal sequences, with the retrieved file contents stored as post metadata and retrievable through the fetch-data REST API endpoint. The vulnerability affects all versions up to and including 1.6.3, and while it requires high-level administrative access and has a moderate CVSS score of 4.9, it represents a critical information disclosure risk in multi-user WordPress environments.
The GetGenie plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in its REST API endpoint that allows authenticated attackers with Author-level privileges to arbitrarily modify or overwrite posts owned by any user, including administrators. The vulnerability exists in versions up to and including 4.3.2 due to missing validation on user-controlled post IDs before calling wp_update_post(), enabling attackers to change post types and reassign authorship. While not currently listed in CISA's Known Exploited Vulnerabilities catalog, the low attack complexity (network-based, low privilege requirement) and demonstrated proof-of-concept availability make this a moderate-priority issue for WordPress administrators managing multi-author sites.
Medium severity vulnerability in WordPress plugin. The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2 due to missing validation on a user controlled key in the `action` function. This makes it possible for authenticated attackers, with Author-level access and above, to update post metadata for arbitrary posts. Combined with a lack of input sanitization, this leads to S...
Authenticated shortcode injection in the WP Ultimate Review WordPress plugin (Roxnor) allows any user with subscriber-level access or higher to run arbitrary registered shortcodes on sites running version 2.4.2 or earlier. The attacker passes a crafted value to a plugin action that feeds it into do_shortcode() without validation (CWE-94), yielding high confidentiality and integrity impact per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (8.1). No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but on sites with open registration the subscriber prerequisite is trivial to satisfy, and the real-world severity is bounded by which powerful shortcodes are registered by this or other installed plugins and themes - arbitrary operating-system command execution is not guaranteed.
Privilege escalation in ShopEngine (all versions up to and including 4.9.4) allows Shop Manager-level authenticated users to achieve full WordPress site takeover by injecting arbitrary core options through a malicious WXR import file. The plugin's `rum_importer()` function is hooked to the WordPress core `import_start` action without any plugin-owned capability check or allowlist filtering, meaning attacker-controlled `<wp_option>` pairs from a crafted import file flow directly into `update_option()` - enabling manipulation of `users_can_register` and `default_role` to open administrator self-registration. No CISA KEV listing or EPSS score was present in the provided data; exploitation requires an existing Shop Manager account and WooCommerce's grant of the `import` capability to that role, but once those conditions are met the path to full site compromise is straightforward and documented.
Unauthenticated PHP object injection in the Roxnor FundEngine (wp-fundraising-donation) WordPress plugin through version 1.7.9 lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() sink without authentication. If a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary code execution, file operations, or SQL manipulation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated PHP Object Injection in the FundEngine WordPress fundraising/donation plugin (slug wp-fundraising-donation) affects all versions up to and including 1.7.9, letting a remote attacker with no authentication inject a crafted serialized PHP object into an application deserialization sink. Given the CWE-502 root cause and the PR:N/UI:N vector, a successful attack can pivot to remote code execution, data theft, or full site takeover when a suitable POP gadget chain is reachable. Reported by Patchstack and rated CVSS 9.8, with no public exploit identified at time of analysis and no CISA KEV listing.
Unauthenticated remote attackers can execute arbitrary registered WordPress shortcodes through the WP Ultimate Review plugin (versions up to and including 2.4.3), because the plugin passes an unvalidated value to do_shortcode and the only nonce gate is emitted to anonymous visitors via the public review form, while submitted reviews auto-publish without administrator approval by default. The CVSS 3.1 base score is 6.5 (Medium) with low confidentiality and integrity impact and no availability impact; the real-world severity depends on which shortcodes exist on the target site. No public exploit code has been identified at time of analysis, and CISA KEV does not list this issue.
Arbitrary shortcode execution in the WP Ultimate Review WordPress plugin through version 2.4.3 lets any authenticated user with subscriber-level access or higher inject shortcodes that are stored and later executed when review content is rendered. The bypass abuses WordPress core behavior: the plugin passes attacker-controlled data into do_shortcode without validation, and the [[tag]] double-bracket escape is unwrapped to a bare [tag] by strip_shortcodes(), surviving wp_insert_post storage and firing through the_content on the publicly queryable xs_review post type. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV); exploitation requires a low-privilege account, which makes it practically significant on sites with open user registration.
Stored cross-site scripting in the Wp Social Login and Register Social Counter WordPress plugin (all versions up to and including 3.2.1) lets any authenticated account with subscriber-level access or above plant a script payload that executes in the browser of anyone who later views the poisoned avatar. Exploitation is a two-step chain: the attacker first invokes the plugin's nonce-only dismiss_ajax_call AJAX endpoint (the nonce is exposed to subscribers on any wp-admin page) to set the xs_social_profile_image user-meta flag on their own account, then stores a script payload in their display name, which xs_social_get_avatar echoes unescaped into an img alt attribute because WordPress core's ENT_NOQUOTES handling preserves the quotes needed to break out. Scored CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), it is a moderate-severity issue; no public exploit code has been identified at time of analysis and it is not confirmed actively exploited (CISA KEV), and the impact only materializes when a victim - ideally a privileged user such as an administrator - browses a page rendering the attacker's avatar.
ElementsKit Elementor addons Lite through version 4.0.5 contains a Cross-Site Scripting flaw (CWE-79) that lets a low-privileged user plant script content which executes in a higher-privileged user's browser session. Exploitation requires an authenticated WordPress account with at least Contributor-level privileges (CVSS vector PR:L), and the payload only fires when an administrator or other privileged user views the attacker-controlled content, making victim interaction a hard prerequisite (UI:R). The scope is rated Changed because the injected script runs in the victim's session rather than the attacker's own context, so it can act with the victim's privileges; no KEV listing or public exploit code was identified at time of analysis, and Patchstack is the reporting source. Impact is bounded to low confidentiality, integrity, and availability effects under the assessed vector, but the Changed scope means an administrator session could be abused for further actions inside the WordPress dashboard.
Stored Cross-Site Scripting in the ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress (versions up to and including 4.9.5) allows authenticated attackers with Author-level access or higher to persistently inject arbitrary JavaScript via the `shopengine_product_title_header_size` parameter. The injected payload executes in any site visitor's browser upon loading an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit code has been identified at time of analysis, and it is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in MetForm for WordPress (all versions through 4.1.8) allows authenticated contributors to permanently inject arbitrary JavaScript into pages via the 'mf_form_id' Elementor widget setting, exploiting two independent filter bypass paths. The payload evades Elementor's save-time wp_kses_post filter because it contains no HTML tags, and MetForm's own str_replace logic transforms script-tag constructs into executable JavaScript template literals - providing a second delivery route. Any visitor loading an injected page has the script execute in their browser context, enabling session hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the FundEngine WordPress plugin (versions up to and including 1.8.1) allows any authenticated user with at minimum Subscriber-level access to inject persistent malicious scripts via the `wfp_featured_video_url` parameter. The REST endpoint that processes this input has its `permission_callback` hardcoded to `__return_true`, effectively bypassing WordPress role-based access controls and exposing the vulnerable code path to the lowest-privilege registered user. Injected scripts execute in the browsers of any subsequent visitor to the affected campaign page, enabling session hijacking, credential theft, or further lateral movement. No confirmed active exploitation has been identified (not in CISA KEV) and no public exploit code is referenced at time of analysis.
Authorization bypass in the FundEngine WordPress donation and crowdfunding plugin (all versions through 1.8.1) allows authenticated subscribers to overwrite the title, body, and author field of any post or page on the affected site. The vulnerable handler in apps/content.php accepts an attacker-supplied post_author integer without verifying the caller's rights over the target post, and the wp_rest nonce that nominally gates the endpoint is freely retrievable by any logged-in user from /wp-admin/admin-ajax.php?action=rest-nonce, eliminating it as a meaningful access control. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal authentication requirement elevate real-world risk on sites that permit open subscriber registration.
Authenticated users holding only a Subscriber-level WordPress account can disrupt the fundraising functionality of sites running the FundEngine plugin (slug wp-fundraising-donation) through version 1.7.8, because a plugin action omits its capability and nonce authorization checks (CWE-862 missing authorization). The effect is limited to availability - there is no data disclosure or modification - and access requires an existing low-privilege login, which is realistic mainly where open user registration is enabled or the attacker already has an account. No public exploit code has been identified and there is no indication of active exploitation; EPSS is a low 0.35% (28th percentile) and CISA's SSVC framework rates exploitation as none, automatable as no, and technical impact as partial.
Missing authorization in the FundEngine WordPress fundraising plugin (versions through 1.7.6) permits unauthenticated remote attackers to exploit incorrectly configured access control, resulting in partial data integrity and availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, unauthenticated network exploitation with no user interaction required. No active exploitation is confirmed in the CISA KEV catalog, and no public exploit code has been identified at the time of this analysis.
ElementsKit Elementor Addons plugin for WordPress versions up to 3.8.2 allows unauthenticated attackers to overwrite Elementor widget content via a missing capability check in the Live_Action::reset() function. By crafting a URL with specific GET parameters (post and action=elementor), attackers can permanently replace any elementskit_widget custom post type's design, text, and configurations with a blank template, causing data loss without requiring authentication or user interaction.
EmailKit plugin for WordPress versions up to 1.6.5 allows authenticated attackers with Author-level access to read arbitrary files from the server due to a path traversal vulnerability in the create_template() method. The vulnerability exploits a PHP 8.x type coercion flaw where realpath() returns false for non-existent directories, causing strpos() validation to incorrectly evaluate and bypass directory restrictions. Attackers can retrieve sensitive files such as wp-config.php by submitting absolute paths via the emailkit-editor-template REST API parameter. No public exploit code identified at time of analysis, though the vulnerability mechanism is trivial to weaponize once authentication is obtained.
Missing authorization in Roxnor Wp Ultimate Review plugin versions up to 2.3.8 allows unauthenticated remote attackers to access restricted functionality through incorrectly configured access control security levels, resulting in limited information disclosure. The vulnerability carries a low EPSS exploitation probability (0.02%, 4th percentile) and has not been confirmed as actively exploited, though the simple attack vector (network-accessible, no complexity, no authentication required) means opportunistic exploitation is feasible.
Stored Cross-Site Scripting in ElementsKit Elementor Addons and Templates plugin (versions up to 3.7.9) allows authenticated contributors and above to inject malicious scripts via the 'ekit_tab_title' parameter in the Simple Tab widget due to insufficient input sanitization and output escaping. Injected scripts execute when users access affected pages. No public exploit code or active exploitation has been identified at time of analysis.
The EmailKit - Email Customizer for WooCommerce & WP WordPress plugin contains a path traversal vulnerability in the TemplateData class that allows authenticated administrators to read arbitrary files from the server via the 'emailkit-editor-template' REST API parameter. An attacker with Administrator privileges can exploit this flaw to access sensitive files such as wp-config.php or /etc/passwd by supplying directory traversal sequences, with the retrieved file contents stored as post metadata and retrievable through the fetch-data REST API endpoint. The vulnerability affects all versions up to and including 1.6.3, and while it requires high-level administrative access and has a moderate CVSS score of 4.9, it represents a critical information disclosure risk in multi-user WordPress environments.
The GetGenie plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in its REST API endpoint that allows authenticated attackers with Author-level privileges to arbitrarily modify or overwrite posts owned by any user, including administrators. The vulnerability exists in versions up to and including 4.3.2 due to missing validation on user-controlled post IDs before calling wp_update_post(), enabling attackers to change post types and reassign authorship. While not currently listed in CISA's Known Exploited Vulnerabilities catalog, the low attack complexity (network-based, low privilege requirement) and demonstrated proof-of-concept availability make this a moderate-priority issue for WordPress administrators managing multi-author sites.
Medium severity vulnerability in WordPress plugin. The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2 due to missing validation on a user controlled key in the `action` function. This makes it possible for authenticated attackers, with Author-level access and above, to update post metadata for arbitrary posts. Combined with a lack of input sanitization, this leads to S...