Siteground
Monthly
Authentication bypass in the SiteGround Security WordPress plugin (versions ≤ 1.6.6) enables unauthenticated remote attackers to circumvent two-factor authentication protections and obtain fully authenticated WordPress sessions. Classified as CWE-290 (Authentication Bypass by Spoofing), this network-exploitable flaw carries a CVSS 8.1 score with full high impact across confidentiality, integrity, and availability, moderated only by elevated attack complexity (AC:H). No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in the SiteGround Email Marketing WordPress plugin (versions up to and including 1.7.5) lets attackers persist malicious JavaScript that executes in the context of a victim's browser when the affected page is rendered. Reported by Patchstack with a CVSS 3.1 base score of 7.1 and a scope-changed impact, the flaw carries no public exploit identified at time of analysis and is not listed in CISA KEV. Because the injected payload is stored server-side, it can strike any user - including administrators - who later loads the tainted content.
Unauthorized file upload in the AI Agent by SiteGround WordPress plugin (all versions through 1.2.7) allows attackers to inject arbitrary images into the WordPress media library by exploiting a missing upload_files capability check in the plugin's REST API endpoint. The endpoint's nonce (sg_ai_studio_gutenberg_nonce) is broadcast to all users with block editor access - including Contributors - making the absent capability check the sole enforcement barrier. No public exploit has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects limited integrity impact with no confidentiality or availability consequence.
Stored Cross-Site Scripting in the SiteGround Speed Optimizer WordPress plugin (all versions through 7.8.0) allows authenticated contributors to inject persistent malicious JavaScript via unsanitized image tag attributes, executing in any visitor's browser upon page load. Exploitation is gated on the Lazy Load Media option being enabled in plugin settings, limiting but not eliminating real-world exposure across the large SiteGround-hosted WordPress ecosystem. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a patched release (7.8.1) is confirmed available via the WordPress plugin repository.
The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authentication bypass in the SiteGround Security WordPress plugin (versions ≤ 1.6.6) enables unauthenticated remote attackers to circumvent two-factor authentication protections and obtain fully authenticated WordPress sessions. Classified as CWE-290 (Authentication Bypass by Spoofing), this network-exploitable flaw carries a CVSS 8.1 score with full high impact across confidentiality, integrity, and availability, moderated only by elevated attack complexity (AC:H). No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in the SiteGround Email Marketing WordPress plugin (versions up to and including 1.7.5) lets attackers persist malicious JavaScript that executes in the context of a victim's browser when the affected page is rendered. Reported by Patchstack with a CVSS 3.1 base score of 7.1 and a scope-changed impact, the flaw carries no public exploit identified at time of analysis and is not listed in CISA KEV. Because the injected payload is stored server-side, it can strike any user - including administrators - who later loads the tainted content.
Unauthorized file upload in the AI Agent by SiteGround WordPress plugin (all versions through 1.2.7) allows attackers to inject arbitrary images into the WordPress media library by exploiting a missing upload_files capability check in the plugin's REST API endpoint. The endpoint's nonce (sg_ai_studio_gutenberg_nonce) is broadcast to all users with block editor access - including Contributors - making the absent capability check the sole enforcement barrier. No public exploit has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects limited integrity impact with no confidentiality or availability consequence.
Stored Cross-Site Scripting in the SiteGround Speed Optimizer WordPress plugin (all versions through 7.8.0) allows authenticated contributors to inject persistent malicious JavaScript via unsanitized image tag attributes, executing in any visitor's browser upon page load. Exploitation is gated on the Lazy Load Media option being enabled in plugin settings, limiting but not eliminating real-world exposure across the large SiteGround-hosted WordPress ecosystem. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a patched release (7.8.1) is confirmed available via the WordPress plugin repository.
The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.