Saadiqbal
Monthly
Unauthenticated attackers can read every WooCommerce customer's billing data through the Email Templates Customizer and Designer plugin (all versions up to and including 1.5.14) because its preview handler never checks whether the requester is authorized. Two unauthenticated requests suffice: one harvests a reusable nonce from the 302 Location header of an unguarded admin_init handler, and the second passes that nonce with an arbitrary order ID to the preview_order endpoint, returning billing name, address, phone and email; sites with many stored orders expose proportionally more PII. The issue is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, CWE-862) and is a priority for this week; no public exploit code or CISA KEV entry was reported in the available data.
Stored cross-site scripting in the WordPress plugin Post SMTP (Complete Email Deliverability and SMTP Solution) affects all versions up to and including 4.0.1, allowing an unauthenticated attacker to persist arbitrary script content through the 'user_email' parameter. Exploitation is conditional: it requires a WordPress Multisite installation with public user registration enabled, where WordPress accepts email addresses containing numeric HTML character references that Post SMTP's stricter validator rejects, causing the send to fail and the raw attacker-controlled address to be written verbatim into the email log via the failed-send exception message; the payload then executes when an administrator views the affected email-log page. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is best characterized as conditional rather than broadly urgent because the prerequisite Multisite-plus-open-registration configuration is non-default and the payload is inert until an admin opens the log view. Upgrading to 4.0.2 remediates the issue.
Unauthenticated payment hijacking in WPFormify - Stripe Payments with Form and Checkout (all versions ≤ 1.1.1) allows any remote attacker to overwrite or delete the site's Stripe API credentials with zero authentication. Two plugin functions registered on WordPress's `admin_init` hook are reachable via the publicly accessible `admin-post.php` endpoint because they perform no capability check and no nonce verification. An attacker exploiting this can silently redirect all customer payments to an attacker-controlled Stripe account, or disable payment processing entirely by erasing the stored credentials - with no public exploit identified at time of analysis but trivially low exploitation complexity.
A stored cross-site scripting (XSS) vulnerability exists in the Post SMTP WordPress plugin through version 3.8.0, allowing unauthenticated attackers to inject malicious scripts via the 'event_type' parameter. The vulnerability requires the Post SMTP Pro plugin with its Reporting and Tracking extension to be enabled for exploitation. With a CVSS score of 7.2 and unauthenticated network-based exploitation possible, this represents a moderate-to-high severity risk for WordPress sites using both the free and Pro versions of Post SMTP together.
Stored cross-site scripting in the Password Protected WordPress plugin (versions up to and including 2.8.4) lets any authenticated subscriber-level user inject arbitrary script into a persistent, site-wide administrative notice by supplying the 'purchased_plan' parameter, because the bundled Freius SDK purchase-completion handler performs no capability, nonce, or purchase validation once the plugin's Freemius opt-in is complete. The injected script then executes automatically when an administrator loads a routine admin page such as their Profile page. No confirmed active exploitation or verified working exploit code is reported at time of analysis; this is a genuine but moderate-priority issue rather than a drop-everything emergency.
Stored cross-site scripting in the WordPress plugin Post Snippets - Custom WordPress Code Snippets Customizer affects every version up to and including 4.2.4, letting a contributor-level or higher account plant script that runs in another user's browser. The bypass works because entity-encoded payloads such as <script>...</script> are not decoded by WordPress's wp_kses_post on save, and the plugin's own shortcode filter turns them back into live HTML when the page renders; the description states the snippet shortcodes must be enabled for this path to work. Rated CVSS 3.1 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and no public exploit code has been identified at time of analysis.
WordPress sites running the WP Easy Pay - Payment and Donation Form Builder for Square plugin through version 4.5.0 allow any authenticated user, including a subscriber-level account, to force-delete arbitrary posts, pages, and custom post types (bypassing the trash) or silently revert any published post to draft status. The root cause is CWE-862 missing authorization: the plugin's action handlers in wpep-setup.php perform no capability or nonce verification before invoking destructive WordPress content operations. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, so the practical risk is moderate and concentrated on sites that permit self-service or open user registration, where a low-privilege account is trivially obtainable and no further interaction or configuration is required.
Stored Cross-Site Scripting in the myCred gamification plugin for WordPress allows authenticated contributors to inject persistent malicious scripts via the 'wrapper' shortcode attribute in the sell-content addon. All plugin versions through 3.2.4 are affected. Any site visitor who loads a page containing the poisoned shortcode will execute the attacker's payload in their browser, enabling session hijacking, credential theft, or admin account compromise. No public exploit or KEV listing is present at time of analysis, but the contributor-level prerequisite is a low bar on sites with open registration.
Stored Cross-Site Scripting in the Advanced File Manager WordPress plugin (versions up to and including 5.4.12) allows unauthenticated network attackers to inject persistent malicious scripts via the unsanitized 'soundFile' parameter in elFinder.js. Successful exploitation grants script execution in an authenticated WordPress administrator's browser context, enabling session hijacking, credential theft, or administrative action abuse. No public exploit code or CISA KEV listing has been identified at time of analysis, and real-world impact is substantially constrained by a non-trivial domain-prefix precondition detailed below.
Authorization bypass in the Gutena Forms WordPress plugin (all versions through 1.9.0) enables unauthenticated remote attackers to permanently trash or toggle the read/unread status of arbitrary form submission entries across any form on the affected site. The root cause is a fatally weakened nonce check: the nonce action 'gutena_Forms' is broadcast to all anonymous site visitors via wp_localize_script() on any page embedding a Gutena Forms block, rendering the check_ajax_referer() call functionally useless as an authorization control. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE, though the low-complexity, zero-authentication attack vector means any anonymous internet user can exploit this without special tooling against any affected installation.
Authorization bypass in the WP Easy Pay WordPress plugin (versions ≤4.5.0) allows any authenticated WordPress user at subscriber level or above to set arbitrary posts and pages to 'draft', silently unpublishing site content without editorial authorization. The flaw stems from missing capability checks in the plugin's action handlers (wpep-setup.php), confirmed by Wordfence with direct source code references. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the low barrier to exploitation - any registered user qualifies - makes this a meaningful risk on sites with open user registration.
Authorization bypass in the User Management WordPress plugin (versions ≤ 1.2) permits unauthenticated network attackers to overwrite the plugin's export field configuration stored in the uiewp_export_field WordPress option, determining which user fields - including password hashes - are bundled into CSV exports and how columns are interpreted during user imports. Reported by Wordfence, the flaw stems from CWE-862 (Missing Authorization), meaning the plugin performs no privilege check before accepting these writes. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the ability to preconfigure exports to surface password hashes represents a meaningful secondary confidentiality risk beyond the raw CVSS 5.3 Medium score.
Stored XSS in the myCred WordPress plugin (versions up to and including 3.1) allows authenticated attackers holding contributor-level access or above to inject persistent JavaScript payloads via the unsanitized 'wrap' shortcode attribute in the leaderboard shortcode handler. When any user - including administrators - visits a page containing the injected shortcode, the payload executes in their browser, enabling session hijacking or privilege escalation. No public exploit or CISA KEV listing has been identified at time of analysis; fix is available in version 3.1.1 as confirmed by WordPress plugin trac changeset 3572451.
Stored Cross-Site Scripting in the Post Snippets WordPress plugin (≤4.0.19) allows authenticated administrators on multisite installations to inject persistent JavaScript into the post editor via a crafted import file, exploiting a commented-out quote-escaping routine in WPEditor.php. The injected payload executes silently in the browser of any administrator who subsequently opens any post editor page, enabling session hijacking or further lateral movement within the multisite network. No public exploit identified at time of analysis; real-world impact is bounded by the Administrator-level access prerequisite and the explicit exclusion of single-site WordPress installations.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Post SMTP WordPress plugin for versions up to 3.8.0 contains an authorization bypass vulnerability in the Office 365 OAuth redirect handler that allows authenticated subscribers and above to overwrite sensitive SMTP configuration without proper capability checks or nonce validation. An attacker with subscriber-level access can craft a malicious URL to inject attacker-controlled Azure app credentials into the site's Microsoft 365 configuration, potentially causing administrators to unknowingly connect to the attacker's account during Pro wizard setup. This vulnerability has a CVSS score of 5.3 and is classified as CWE-862 (Missing Authorization), with active evidence of the vulnerable code path present in the plugin repository.
Unauthenticated attackers can read every WooCommerce customer's billing data through the Email Templates Customizer and Designer plugin (all versions up to and including 1.5.14) because its preview handler never checks whether the requester is authorized. Two unauthenticated requests suffice: one harvests a reusable nonce from the 302 Location header of an unguarded admin_init handler, and the second passes that nonce with an arbitrary order ID to the preview_order endpoint, returning billing name, address, phone and email; sites with many stored orders expose proportionally more PII. The issue is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, CWE-862) and is a priority for this week; no public exploit code or CISA KEV entry was reported in the available data.
Stored cross-site scripting in the WordPress plugin Post SMTP (Complete Email Deliverability and SMTP Solution) affects all versions up to and including 4.0.1, allowing an unauthenticated attacker to persist arbitrary script content through the 'user_email' parameter. Exploitation is conditional: it requires a WordPress Multisite installation with public user registration enabled, where WordPress accepts email addresses containing numeric HTML character references that Post SMTP's stricter validator rejects, causing the send to fail and the raw attacker-controlled address to be written verbatim into the email log via the failed-send exception message; the payload then executes when an administrator views the affected email-log page. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is best characterized as conditional rather than broadly urgent because the prerequisite Multisite-plus-open-registration configuration is non-default and the payload is inert until an admin opens the log view. Upgrading to 4.0.2 remediates the issue.
Unauthenticated payment hijacking in WPFormify - Stripe Payments with Form and Checkout (all versions ≤ 1.1.1) allows any remote attacker to overwrite or delete the site's Stripe API credentials with zero authentication. Two plugin functions registered on WordPress's `admin_init` hook are reachable via the publicly accessible `admin-post.php` endpoint because they perform no capability check and no nonce verification. An attacker exploiting this can silently redirect all customer payments to an attacker-controlled Stripe account, or disable payment processing entirely by erasing the stored credentials - with no public exploit identified at time of analysis but trivially low exploitation complexity.
A stored cross-site scripting (XSS) vulnerability exists in the Post SMTP WordPress plugin through version 3.8.0, allowing unauthenticated attackers to inject malicious scripts via the 'event_type' parameter. The vulnerability requires the Post SMTP Pro plugin with its Reporting and Tracking extension to be enabled for exploitation. With a CVSS score of 7.2 and unauthenticated network-based exploitation possible, this represents a moderate-to-high severity risk for WordPress sites using both the free and Pro versions of Post SMTP together.
Stored cross-site scripting in the Password Protected WordPress plugin (versions up to and including 2.8.4) lets any authenticated subscriber-level user inject arbitrary script into a persistent, site-wide administrative notice by supplying the 'purchased_plan' parameter, because the bundled Freius SDK purchase-completion handler performs no capability, nonce, or purchase validation once the plugin's Freemius opt-in is complete. The injected script then executes automatically when an administrator loads a routine admin page such as their Profile page. No confirmed active exploitation or verified working exploit code is reported at time of analysis; this is a genuine but moderate-priority issue rather than a drop-everything emergency.
Stored cross-site scripting in the WordPress plugin Post Snippets - Custom WordPress Code Snippets Customizer affects every version up to and including 4.2.4, letting a contributor-level or higher account plant script that runs in another user's browser. The bypass works because entity-encoded payloads such as <script>...</script> are not decoded by WordPress's wp_kses_post on save, and the plugin's own shortcode filter turns them back into live HTML when the page renders; the description states the snippet shortcodes must be enabled for this path to work. Rated CVSS 3.1 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and no public exploit code has been identified at time of analysis.
WordPress sites running the WP Easy Pay - Payment and Donation Form Builder for Square plugin through version 4.5.0 allow any authenticated user, including a subscriber-level account, to force-delete arbitrary posts, pages, and custom post types (bypassing the trash) or silently revert any published post to draft status. The root cause is CWE-862 missing authorization: the plugin's action handlers in wpep-setup.php perform no capability or nonce verification before invoking destructive WordPress content operations. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, so the practical risk is moderate and concentrated on sites that permit self-service or open user registration, where a low-privilege account is trivially obtainable and no further interaction or configuration is required.
Stored Cross-Site Scripting in the myCred gamification plugin for WordPress allows authenticated contributors to inject persistent malicious scripts via the 'wrapper' shortcode attribute in the sell-content addon. All plugin versions through 3.2.4 are affected. Any site visitor who loads a page containing the poisoned shortcode will execute the attacker's payload in their browser, enabling session hijacking, credential theft, or admin account compromise. No public exploit or KEV listing is present at time of analysis, but the contributor-level prerequisite is a low bar on sites with open registration.
Stored Cross-Site Scripting in the Advanced File Manager WordPress plugin (versions up to and including 5.4.12) allows unauthenticated network attackers to inject persistent malicious scripts via the unsanitized 'soundFile' parameter in elFinder.js. Successful exploitation grants script execution in an authenticated WordPress administrator's browser context, enabling session hijacking, credential theft, or administrative action abuse. No public exploit code or CISA KEV listing has been identified at time of analysis, and real-world impact is substantially constrained by a non-trivial domain-prefix precondition detailed below.
Authorization bypass in the Gutena Forms WordPress plugin (all versions through 1.9.0) enables unauthenticated remote attackers to permanently trash or toggle the read/unread status of arbitrary form submission entries across any form on the affected site. The root cause is a fatally weakened nonce check: the nonce action 'gutena_Forms' is broadcast to all anonymous site visitors via wp_localize_script() on any page embedding a Gutena Forms block, rendering the check_ajax_referer() call functionally useless as an authorization control. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE, though the low-complexity, zero-authentication attack vector means any anonymous internet user can exploit this without special tooling against any affected installation.
Authorization bypass in the WP Easy Pay WordPress plugin (versions ≤4.5.0) allows any authenticated WordPress user at subscriber level or above to set arbitrary posts and pages to 'draft', silently unpublishing site content without editorial authorization. The flaw stems from missing capability checks in the plugin's action handlers (wpep-setup.php), confirmed by Wordfence with direct source code references. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the low barrier to exploitation - any registered user qualifies - makes this a meaningful risk on sites with open user registration.
Authorization bypass in the User Management WordPress plugin (versions ≤ 1.2) permits unauthenticated network attackers to overwrite the plugin's export field configuration stored in the uiewp_export_field WordPress option, determining which user fields - including password hashes - are bundled into CSV exports and how columns are interpreted during user imports. Reported by Wordfence, the flaw stems from CWE-862 (Missing Authorization), meaning the plugin performs no privilege check before accepting these writes. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the ability to preconfigure exports to surface password hashes represents a meaningful secondary confidentiality risk beyond the raw CVSS 5.3 Medium score.
Stored XSS in the myCred WordPress plugin (versions up to and including 3.1) allows authenticated attackers holding contributor-level access or above to inject persistent JavaScript payloads via the unsanitized 'wrap' shortcode attribute in the leaderboard shortcode handler. When any user - including administrators - visits a page containing the injected shortcode, the payload executes in their browser, enabling session hijacking or privilege escalation. No public exploit or CISA KEV listing has been identified at time of analysis; fix is available in version 3.1.1 as confirmed by WordPress plugin trac changeset 3572451.
Stored Cross-Site Scripting in the Post Snippets WordPress plugin (≤4.0.19) allows authenticated administrators on multisite installations to inject persistent JavaScript into the post editor via a crafted import file, exploiting a commented-out quote-escaping routine in WPEditor.php. The injected payload executes silently in the browser of any administrator who subsequently opens any post editor page, enabling session hijacking or further lateral movement within the multisite network. No public exploit identified at time of analysis; real-world impact is bounded by the Administrator-level access prerequisite and the explicit exclusion of single-site WordPress installations.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Post SMTP WordPress plugin for versions up to 3.8.0 contains an authorization bypass vulnerability in the Office 365 OAuth redirect handler that allows authenticated subscribers and above to overwrite sensitive SMTP configuration without proper capability checks or nonce validation. An attacker with subscriber-level access can craft a malicious URL to inject attacker-controlled Azure app credentials into the site's Microsoft 365 configuration, potentially causing administrators to unknowingly connect to the attacker's account during Pro wizard setup. This vulnerability has a CVSS score of 5.3 and is classified as CWE-862 (Missing Authorization), with active evidence of the vulnerable code path present in the plugin repository.