Wordpress Plugin
Monthly
Authentication Bypass Using an Alternate Path or Channel vulnerability in kamleshyadav Miraculous Elementor miraculous-el allows Authentication Abuse.This issue affects Miraculous Elementor: from n/a through <= 2.0.7. [CVSS 8.8 HIGH]
Missing Authorization vulnerability in YayCommerce YayCurrency yaycurrency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayCurrency: from n/a through <= 3.3. [CVSS 7.5 HIGH]
Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.2.1. [CVSS 6.5 MEDIUM]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 GMap Targeting gmap-targeting allows Reflected XSS.This issue affects GMap Targeting: from n/a through <= 1.1.7. [CVSS 7.1 HIGH]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows SQL Injection.This issue affects Quiz And Survey Master: from n/a through <= 10.3.1. [CVSS 8.5 HIGH]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in calliko NPS computy nps-computy allows DOM-Based XSS.This issue affects NPS computy: from n/a through <= 2.8.2. [CVSS 7.1 HIGH]
Code injection in WPForms Google Sheet Connector (gsheetconnector-wpforms) WordPress plugin allows arbitrary code execution.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FixBD Educare educare allows Reflected XSS.This issue affects Educare: from n/a through <= 1.6.1. [CVSS 7.1 HIGH]
VillaTheme HAPPY happy-helpdesk-support-ticket-system is affected by missing authorization (CVSS 8.2).
Missing Authorization vulnerability in aDirectory aDirectory adirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects aDirectory: from n/a through <= 3.0.3. [CVSS 6.5 MEDIUM]
Missing Authorization vulnerability in WP Legal Pages WPLegalPages wplegalpages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLegalPages: from n/a through <= 3.5.4. [CVSS 7.5 HIGH]
sunshinephotocart Sunshine Photo Cart sunshine-photo-cart is affected by missing authorization (CVSS 6.5).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fox-themes Prague prague-plugins allows Reflected XSS.This issue affects Prague: from n/a through <= 2.2.8. [CVSS 7.1 HIGH]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja FluentCart fluent-cart allows Reflected XSS.This issue affects FluentCart: from n/a through < 1.3.0. [CVSS 7.1 HIGH]
Missing Authorization vulnerability in vertim Schedula schedula-smart-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Schedula: from n/a through <= 1.0. [CVSS 5.3 MEDIUM]
Missing Authorization vulnerability in Arya Dhiratara Optimize More! – Images optimize-more-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimize More! [CVSS 6.5 MEDIUM]
silence Silencesoft RSS Reader external-rss-reader is affected by cross-site scripting (xss) (CVSS 5.9).
Nenad Obradovic Extensive VC Addons for WPBakery page builder extensive-vc-addon is affected by php remote file inclusion (CVSS 8.1).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RylanH Storyform storyform allows Reflected XSS.This issue affects Storyform: from n/a through <= 0.6.14. [CVSS 7.1 HIGH]
wpdevstudio Easy Taxonomy Images easy-taxonomy-images is affected by cross-site scripting (xss) (CVSS 7.1).
jezza101 bbpress Simple Advert Units bbpress-simple-advert-units is affected by cross-site scripting (xss) (CVSS 7.1).
Missing Authorization vulnerability in staviravn AIO WP Builder all-in-one-wp-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AIO WP Builder: from n/a through <= 2.0.2. [CVSS 7.6 HIGH]
Improper Control of Generation of Code ('Code Injection') vulnerability in inpersttion Inpersttion For Theme err-our-team allows Code Injection.This issue affects Inpersttion For Theme: from n/a through <= 1.0. [CVSS 7.6 HIGH]
Seraphinite Solutions Seraphinite Accelerator seraphinite-accelerator is affected by missing authorization (CVSS 4.3).
Liton Arefin Master Addons for Elementor master-addons is affected by cross-site scripting (xss) (CVSS 5.9).
LiteSpeed Technologies LiteSpeed Cache litespeed-cache is affected by cross-site scripting (xss) (CVSS 6.5).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stored XSS.This issue affects Elementor Website Builder: from n/a through <= 3.29.0. [CVSS 6.5 MEDIUM]
POSIMYTH Nexter Blocks the-plus-addons-for-block-editor is affected by cross-site scripting (xss) (CVSS 6.5).
Missing Authorization vulnerability in SecuPress SecuPress Free secupress.This issue affects SecuPress Free: from n/a through <= 2.2.5.3. [CVSS 5.3 MEDIUM]
Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.19. [CVSS 5.3 MEDIUM]
Stored cross-site scripting in myCred versions up to 2.9.7.6 allows authenticated attackers to inject malicious scripts that execute in other users' browsers when viewing affected pages. An attacker with login credentials can leverage the vulnerability to steal session tokens, deface content, or perform actions on behalf of victims. No patch is currently available for this vulnerability.
Improper access control in designinvento DirectoryPress up to version 3.6.26 allows authenticated users to modify data and cause service disruptions through misconfigured security levels. An attacker with valid credentials can exploit this vulnerability to manipulate application integrity and availability without requiring user interaction. No patch is currently available for this medium-severity vulnerability.
SeedProd Coming Soon Page plugin versions 6.19.7 and earlier contain a missing authorization vulnerability that allows unauthenticated attackers to modify application content by exploiting improperly configured access controls. An attacker can leverage this flaw to alter website settings without proper authentication, potentially defacing or redirecting traffic on affected sites. No patch is currently available for this vulnerability.
Stored XSS in 10Web Photo Gallery through version 1.8.37 enables authenticated users with high privileges to inject malicious scripts that execute in victims' browsers when they view affected pages. The vulnerability requires user interaction to trigger but can compromise confidentiality, integrity, and availability across different security contexts. No patch is currently available.
GoDaddy CoBlocks through version 3.1.16 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into web pages, potentially compromising other users who view the affected content. The vulnerability requires user interaction and can impact the confidentiality, integrity, and availability of affected systems. No patch is currently available.
Inadequate access control in WPAdverts through version 2.2.11 permits authenticated users to access sensitive information they should not be authorized to view. An attacker with valid login credentials could exploit misconfigured permission checks to read confidential data within the plugin. No patch is currently available for this vulnerability.
WP Moose Kenta Companion kenta-companion is affected by cross-site request forgery (csrf) (CVSS 4.3).
Stored XSS in Shortcoder plugin version 6.5.1 and earlier enables authenticated attackers to inject malicious scripts into web pages, affecting all users who view the compromised content. An attacker with user-level privileges can execute arbitrary JavaScript in victims' browsers through improper input sanitization during page generation. No patch is currently available.
DOM-based cross-site scripting in PenciDesign Penci Recipe plugin version 4.1 and earlier allows authenticated attackers to inject malicious scripts that execute in users' browsers, potentially stealing session data or performing actions on behalf of affected users. The vulnerability requires user interaction and affects installations using vulnerable versions of the Penci Recipe component.
DOM-based cross-site scripting in PenciDesign Penci Podcast through version 1.7 allows authenticated attackers to inject malicious scripts that execute in users' browsers with user interaction. An attacker with login credentials can exploit improper input sanitization during page generation to steal session tokens, redirect users, or perform actions on their behalf. No patch is currently available for this vulnerability.
PenciDesign Penci Filter Everything penci-filter-everything is affected by cross-site scripting (xss) (CVSS 6.5).
Improper access control in StellarWP iThemes Sync through version 3.2.8 allows authenticated attackers to modify data they should not have permission to access. An attacker with valid login credentials could exploit misconfigured authorization checks to perform unauthorized modifications within the plugin. No patch is currently available for this vulnerability.
Penci AI SmartContent Creator version 2.0 and earlier contains an authorization bypass vulnerability that allows authenticated users to perform unauthorized actions due to improperly configured access controls. An attacker with valid credentials could exploit this to modify data or functionality they should not have access to. No patch is currently available for this issue.
ThimPress RealPress versions up to 1.1.0 are vulnerable to cross-site request forgery attacks that could allow attackers to perform unauthorized actions on behalf of authenticated users. An attacker can exploit this vulnerability by tricking users into visiting a malicious webpage, resulting in integrity and availability impacts. No patch is currently available for this vulnerability.
Unauthorized modification of content is possible in WPDeveloper NotificationX through version 3.2.1 due to improper access control checks that allow unauthenticated attackers to manipulate notification data. This vulnerability affects all installations of the plugin without authentication requirements, enabling attackers to alter or inject malicious content. No security patch is currently available.
AA-Team WZone through version 14.0.31 contains a missing authorization vulnerability that allows authenticated users to bypass access control restrictions. An attacker with valid credentials could exploit this misconfiguration to modify data or cause service unavailability. No patch is currently available for this issue.
Stored cross-site scripting in ThemeFusion Fusion Builder through version 3.14.3 allows authenticated attackers to inject malicious scripts that execute in other users' browsers when viewing affected pages. An attacker with login credentials can leverage this vulnerability to steal session cookies, redirect users, or perform actions on their behalf. No patch is currently available for this vulnerability.
Stored cross-site scripting in WpEstate Wpresidence Core through version 5.4.0 enables authenticated attackers to inject malicious scripts that execute in other users' browsers, potentially leading to session hijacking or credential theft. The vulnerability requires user interaction to trigger the payload and affects the broader site context, making it a persistence risk for compromised WordPress installations. No patch is currently available.
DOM-based cross-site scripting in Advanced iFrame plugin through version 2025.10 allows authenticated attackers to inject malicious scripts that execute in users' browsers, potentially compromising session data and user interactions. The vulnerability requires user interaction and network access but can affect multiple security domains due to its scope impact. No patch is currently available.
Bold Page Builder through version 5.6.4 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into web pages. An attacker with user privileges can craft malicious input that persists in the application and executes in the browsers of other users who view the affected pages, potentially leading to credential theft or unauthorized actions. No patch is currently available for this vulnerability.
LeadConnector versions 3.0.21 and earlier contain an authorization bypass vulnerability that allows unauthenticated remote attackers to modify data due to improperly configured access controls. An attacker can exploit this vulnerability without authentication or user interaction to tamper with application data, though confidentiality and availability are not affected. No patch is currently available for this vulnerability.
Stored cross-site scripting in Omnipress versions 1.6.7 and earlier allows authenticated users to inject malicious scripts that execute in other users' browsers, potentially compromising session data and user interactions. The vulnerability requires user interaction to trigger but can affect any user viewing the affected content due to its stored nature. No patch is currently available.
Server-Side Request Forgery in totalsoft TS Poll versions 2.5.5 and earlier enables authenticated attackers with high privileges to make arbitrary network requests from the affected server. While this MEDIUM severity vulnerability (CVSS 4.4) requires high-privilege credentials and difficult exploitation conditions, it could facilitate reconnaissance or attacks against internal resources. No patch is currently available.
creativeinteractivemedia Real 3D FlipBook real3d-flipbook-lite is affected by missing authorization (CVSS 3.8).
Themes4WP Popularis Extra popularis-extra is affected by cross-site request forgery (csrf) (CVSS 5.4).
MailerLite MailerLite official-mailerlite-sign-up-forms is affected by missing authorization (CVSS 4.3).
UpsellWP versions 2.2.3 and earlier contain an authorization bypass vulnerability that allows authenticated users to access checkout upsell features they should not have permission to modify. An attacker with low-privilege account access could exploit improper access control to manipulate order bump and upsell configurations, potentially affecting store operations and revenue.
blazethemes News Kit Elementor Addons news-kit-elementor-addons is affected by missing authorization (CVSS 4.3).
Inadequate access control in WPBookit Pro through version 1.6.18 permits unauthenticated attackers to modify data by bypassing authorization checks. The vulnerability allows remote attackers without credentials to perform unauthorized actions on the plugin, affecting all installations running the vulnerable versions. No patch is currently available to remediate this issue.
themastercut Revision Manager TMC revision-manager-tmc is affected by cross-site request forgery (csrf) (CVSS 4.3).
Broken Link Notifier plugin versions 1.3.5 and earlier contain an authorization bypass vulnerability that allows unauthenticated attackers to modify data through improperly configured access controls. An attacker can exploit this flaw to alter link notifications without proper authentication, potentially disrupting the plugin's functionality or manipulating stored information. No patch is currently available for this vulnerability.
Cookiebot versions 4.6.4 and earlier contain an access control bypass that allows authenticated attackers to exploit misconfigured security levels and gain unauthorized access to sensitive information. An attacker with low-level user credentials can leverage this vulnerability to read restricted data without proper authorization. No patch is currently available for this vulnerability.
The echo-knowledge-base plugin through version 16.011.0 fails to properly enforce access controls, enabling authenticated users to modify content they should not have permission to change. An attacker with valid login credentials could exploit misconfigured authorization rules to alter documentation or FAQ entries within the knowledge base system.
CryoutCreations Serious Slider cryout-serious-slider is affected by missing authorization (CVSS 4.3).
Metagauss EventPrime eventprime-event-calendar-management contains a security vulnerability (CVSS 5.3).
Inadequate access control in scripteo Ads Pro plugin version 5.0 and earlier enables authenticated attackers to modify data and cause service disruptions through misconfigured security levels. An attacker with valid credentials can exploit this vulnerability to bypass authorization checks and alter plugin functionality without administrative privileges. No patch is currently available.
Elementor Image Optimizer by Elementor image-optimization is affected by missing authorization (CVSS 4.3).
Elementor Ally versions up to 4.0.2 contain an authorization bypass vulnerability that allows unauthenticated remote attackers to modify content through improperly configured access controls. The vulnerability has a network attack vector with low complexity and no user interaction required, potentially enabling unauthorized alterations to website content. No patch is currently available.
KaizenCoders URL Shortify versions up to 1.12.3 contain a server-side request forgery vulnerability that allows high-privileged attackers to make arbitrary HTTP requests from the affected server without user interaction. An authenticated attacker could exploit this flaw to access internal resources, interact with backend services, or perform reconnaissance on the internal network. No patch is currently available for this vulnerability.
Kodezen Academy LMS versions up to 3.5.3 contain an access control misconfiguration that allows authenticated users to modify data they should not have permission to access. An attacker with valid credentials can exploit this missing authorization check to perform unauthorized changes, though no public exploit code or active exploitation has been reported. No patch is currently available for this vulnerability.
Improper access control in the WP Compress image optimizer plugin for WordPress (versions up to 6.60.28) enables unauthenticated attackers to modify plugin data and settings. The vulnerability allows unauthorized manipulation of the plugin's functionality without requiring user interaction or special network conditions. Currently, no patch is available for affected installations.
codepeople Calculated Fields Form calculated-fields-form is affected by missing authorization (CVSS 6.5).
BoldGrid Client Invoicing by Sprout Invoices sprout-invoices is affected by missing authorization (CVSS 5.3).
FooGallery through version 3.1.11 contains a missing authorization check that allows authenticated users to modify gallery content they should not have access to. An attacker with valid login credentials can exploit improperly configured access controls to alter galleries, potentially defacing or corrupting gallery data. No patch is currently available.
Stored XSS in FooGallery through version 3.1.11 allows authenticated users with high privileges to inject malicious scripts that execute in other users' browsers when viewing gallery content. An attacker with administrative or elevated access could leverage this vulnerability to steal session tokens, modify gallery data, or redirect users to malicious sites. A patch is not currently available for affected installations.
Improper access control in Alt Text AI versions up to 1.10.15 enables unauthenticated remote attackers to cause denial of service through misconfigured authorization checks. The vulnerability allows an attacker to disrupt service availability without requiring authentication or user interaction. No patch is currently available for this issue.
Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant is affected by missing authorization (CVSS 5.3).
Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection is affected by missing authorization (CVSS 4.3).
Fahad Mahmood Endless Posts Navigation endless-posts-navigation is affected by missing authorization (CVSS 5.3).
PublishPress PublishPress Authors publishpress-authors is affected by missing authorization (CVSS 4.3).
ExpressTech Systems Quiz And Survey Master quiz-master-next is affected by missing authorization (CVSS 4.3).
ExpressTech Systems Quiz And Survey Master quiz-master-next is affected by authorization bypass through user-controlled key (CVSS 5.3).
Improper access control in MiKa OSM through version 6.1.12 allows authenticated users to modify data or settings they should not have permission to access. An attacker with valid credentials could exploit misconfigured security levels to escalate privileges or alter system configuration. No patch is currently available for this vulnerability.
PublishPress PublishPress Revisions revisionary is affected by cross-site request forgery (csrf) (CVSS 5.4).
Insufficient access control in SupportCandy plugin versions 3.4.4 and earlier allows unauthenticated remote attackers to modify data through improperly configured security permissions. This vulnerability affects WordPress installations using the vulnerable plugin, enabling attackers to perform unauthorized actions without requiring authentication. No patch is currently available for this issue.
Cool Plugins Elementor Contact Form DB sb-elementor-contact-form-db is affected by missing authorization (CVSS 5.3).
wpzita Zita Elementor Site Library zita-site-library is affected by cross-site request forgery (csrf) (CVSS 4.3).
hcaptcha hCaptcha for WP hcaptcha-for-forms-and-more is affected by missing authorization (CVSS 5.3).
FluentForm versions 6.1.14 and earlier contain an access control bypass that allows authenticated users to perform unauthorized modifications. An attacker with valid credentials can exploit improperly configured security levels to alter data they should not have access to. No patch is currently available.
Improper access control in 10up Autoshare for Twitter through version 2.3.1 enables authenticated users to modify or disable sharing functionality without proper authorization checks. An attacker with limited privileges could exploit this vulnerability to disrupt social media publishing workflows or cause service unavailability for legitimate users. No patch is currently available for this medium-severity vulnerability.
Authentication Bypass Using an Alternate Path or Channel vulnerability in kamleshyadav Miraculous Elementor miraculous-el allows Authentication Abuse.This issue affects Miraculous Elementor: from n/a through <= 2.0.7. [CVSS 8.8 HIGH]
Missing Authorization vulnerability in YayCommerce YayCurrency yaycurrency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayCurrency: from n/a through <= 3.3. [CVSS 7.5 HIGH]
Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.2.1. [CVSS 6.5 MEDIUM]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 GMap Targeting gmap-targeting allows Reflected XSS.This issue affects GMap Targeting: from n/a through <= 1.1.7. [CVSS 7.1 HIGH]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows SQL Injection.This issue affects Quiz And Survey Master: from n/a through <= 10.3.1. [CVSS 8.5 HIGH]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in calliko NPS computy nps-computy allows DOM-Based XSS.This issue affects NPS computy: from n/a through <= 2.8.2. [CVSS 7.1 HIGH]
Code injection in WPForms Google Sheet Connector (gsheetconnector-wpforms) WordPress plugin allows arbitrary code execution.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FixBD Educare educare allows Reflected XSS.This issue affects Educare: from n/a through <= 1.6.1. [CVSS 7.1 HIGH]
VillaTheme HAPPY happy-helpdesk-support-ticket-system is affected by missing authorization (CVSS 8.2).
Missing Authorization vulnerability in aDirectory aDirectory adirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects aDirectory: from n/a through <= 3.0.3. [CVSS 6.5 MEDIUM]
Missing Authorization vulnerability in WP Legal Pages WPLegalPages wplegalpages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLegalPages: from n/a through <= 3.5.4. [CVSS 7.5 HIGH]
sunshinephotocart Sunshine Photo Cart sunshine-photo-cart is affected by missing authorization (CVSS 6.5).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fox-themes Prague prague-plugins allows Reflected XSS.This issue affects Prague: from n/a through <= 2.2.8. [CVSS 7.1 HIGH]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja FluentCart fluent-cart allows Reflected XSS.This issue affects FluentCart: from n/a through < 1.3.0. [CVSS 7.1 HIGH]
Missing Authorization vulnerability in vertim Schedula schedula-smart-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Schedula: from n/a through <= 1.0. [CVSS 5.3 MEDIUM]
Missing Authorization vulnerability in Arya Dhiratara Optimize More! – Images optimize-more-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimize More! [CVSS 6.5 MEDIUM]
silence Silencesoft RSS Reader external-rss-reader is affected by cross-site scripting (xss) (CVSS 5.9).
Nenad Obradovic Extensive VC Addons for WPBakery page builder extensive-vc-addon is affected by php remote file inclusion (CVSS 8.1).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RylanH Storyform storyform allows Reflected XSS.This issue affects Storyform: from n/a through <= 0.6.14. [CVSS 7.1 HIGH]
wpdevstudio Easy Taxonomy Images easy-taxonomy-images is affected by cross-site scripting (xss) (CVSS 7.1).
jezza101 bbpress Simple Advert Units bbpress-simple-advert-units is affected by cross-site scripting (xss) (CVSS 7.1).
Missing Authorization vulnerability in staviravn AIO WP Builder all-in-one-wp-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AIO WP Builder: from n/a through <= 2.0.2. [CVSS 7.6 HIGH]
Improper Control of Generation of Code ('Code Injection') vulnerability in inpersttion Inpersttion For Theme err-our-team allows Code Injection.This issue affects Inpersttion For Theme: from n/a through <= 1.0. [CVSS 7.6 HIGH]
Seraphinite Solutions Seraphinite Accelerator seraphinite-accelerator is affected by missing authorization (CVSS 4.3).
Liton Arefin Master Addons for Elementor master-addons is affected by cross-site scripting (xss) (CVSS 5.9).
LiteSpeed Technologies LiteSpeed Cache litespeed-cache is affected by cross-site scripting (xss) (CVSS 6.5).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stored XSS.This issue affects Elementor Website Builder: from n/a through <= 3.29.0. [CVSS 6.5 MEDIUM]
POSIMYTH Nexter Blocks the-plus-addons-for-block-editor is affected by cross-site scripting (xss) (CVSS 6.5).
Missing Authorization vulnerability in SecuPress SecuPress Free secupress.This issue affects SecuPress Free: from n/a through <= 2.2.5.3. [CVSS 5.3 MEDIUM]
Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.19. [CVSS 5.3 MEDIUM]
Stored cross-site scripting in myCred versions up to 2.9.7.6 allows authenticated attackers to inject malicious scripts that execute in other users' browsers when viewing affected pages. An attacker with login credentials can leverage the vulnerability to steal session tokens, deface content, or perform actions on behalf of victims. No patch is currently available for this vulnerability.
Improper access control in designinvento DirectoryPress up to version 3.6.26 allows authenticated users to modify data and cause service disruptions through misconfigured security levels. An attacker with valid credentials can exploit this vulnerability to manipulate application integrity and availability without requiring user interaction. No patch is currently available for this medium-severity vulnerability.
SeedProd Coming Soon Page plugin versions 6.19.7 and earlier contain a missing authorization vulnerability that allows unauthenticated attackers to modify application content by exploiting improperly configured access controls. An attacker can leverage this flaw to alter website settings without proper authentication, potentially defacing or redirecting traffic on affected sites. No patch is currently available for this vulnerability.
Stored XSS in 10Web Photo Gallery through version 1.8.37 enables authenticated users with high privileges to inject malicious scripts that execute in victims' browsers when they view affected pages. The vulnerability requires user interaction to trigger but can compromise confidentiality, integrity, and availability across different security contexts. No patch is currently available.
GoDaddy CoBlocks through version 3.1.16 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into web pages, potentially compromising other users who view the affected content. The vulnerability requires user interaction and can impact the confidentiality, integrity, and availability of affected systems. No patch is currently available.
Inadequate access control in WPAdverts through version 2.2.11 permits authenticated users to access sensitive information they should not be authorized to view. An attacker with valid login credentials could exploit misconfigured permission checks to read confidential data within the plugin. No patch is currently available for this vulnerability.
WP Moose Kenta Companion kenta-companion is affected by cross-site request forgery (csrf) (CVSS 4.3).
Stored XSS in Shortcoder plugin version 6.5.1 and earlier enables authenticated attackers to inject malicious scripts into web pages, affecting all users who view the compromised content. An attacker with user-level privileges can execute arbitrary JavaScript in victims' browsers through improper input sanitization during page generation. No patch is currently available.
DOM-based cross-site scripting in PenciDesign Penci Recipe plugin version 4.1 and earlier allows authenticated attackers to inject malicious scripts that execute in users' browsers, potentially stealing session data or performing actions on behalf of affected users. The vulnerability requires user interaction and affects installations using vulnerable versions of the Penci Recipe component.
DOM-based cross-site scripting in PenciDesign Penci Podcast through version 1.7 allows authenticated attackers to inject malicious scripts that execute in users' browsers with user interaction. An attacker with login credentials can exploit improper input sanitization during page generation to steal session tokens, redirect users, or perform actions on their behalf. No patch is currently available for this vulnerability.
PenciDesign Penci Filter Everything penci-filter-everything is affected by cross-site scripting (xss) (CVSS 6.5).
Improper access control in StellarWP iThemes Sync through version 3.2.8 allows authenticated attackers to modify data they should not have permission to access. An attacker with valid login credentials could exploit misconfigured authorization checks to perform unauthorized modifications within the plugin. No patch is currently available for this vulnerability.
Penci AI SmartContent Creator version 2.0 and earlier contains an authorization bypass vulnerability that allows authenticated users to perform unauthorized actions due to improperly configured access controls. An attacker with valid credentials could exploit this to modify data or functionality they should not have access to. No patch is currently available for this issue.
ThimPress RealPress versions up to 1.1.0 are vulnerable to cross-site request forgery attacks that could allow attackers to perform unauthorized actions on behalf of authenticated users. An attacker can exploit this vulnerability by tricking users into visiting a malicious webpage, resulting in integrity and availability impacts. No patch is currently available for this vulnerability.
Unauthorized modification of content is possible in WPDeveloper NotificationX through version 3.2.1 due to improper access control checks that allow unauthenticated attackers to manipulate notification data. This vulnerability affects all installations of the plugin without authentication requirements, enabling attackers to alter or inject malicious content. No security patch is currently available.
AA-Team WZone through version 14.0.31 contains a missing authorization vulnerability that allows authenticated users to bypass access control restrictions. An attacker with valid credentials could exploit this misconfiguration to modify data or cause service unavailability. No patch is currently available for this issue.
Stored cross-site scripting in ThemeFusion Fusion Builder through version 3.14.3 allows authenticated attackers to inject malicious scripts that execute in other users' browsers when viewing affected pages. An attacker with login credentials can leverage this vulnerability to steal session cookies, redirect users, or perform actions on their behalf. No patch is currently available for this vulnerability.
Stored cross-site scripting in WpEstate Wpresidence Core through version 5.4.0 enables authenticated attackers to inject malicious scripts that execute in other users' browsers, potentially leading to session hijacking or credential theft. The vulnerability requires user interaction to trigger the payload and affects the broader site context, making it a persistence risk for compromised WordPress installations. No patch is currently available.
DOM-based cross-site scripting in Advanced iFrame plugin through version 2025.10 allows authenticated attackers to inject malicious scripts that execute in users' browsers, potentially compromising session data and user interactions. The vulnerability requires user interaction and network access but can affect multiple security domains due to its scope impact. No patch is currently available.
Bold Page Builder through version 5.6.4 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into web pages. An attacker with user privileges can craft malicious input that persists in the application and executes in the browsers of other users who view the affected pages, potentially leading to credential theft or unauthorized actions. No patch is currently available for this vulnerability.
LeadConnector versions 3.0.21 and earlier contain an authorization bypass vulnerability that allows unauthenticated remote attackers to modify data due to improperly configured access controls. An attacker can exploit this vulnerability without authentication or user interaction to tamper with application data, though confidentiality and availability are not affected. No patch is currently available for this vulnerability.
Stored cross-site scripting in Omnipress versions 1.6.7 and earlier allows authenticated users to inject malicious scripts that execute in other users' browsers, potentially compromising session data and user interactions. The vulnerability requires user interaction to trigger but can affect any user viewing the affected content due to its stored nature. No patch is currently available.
Server-Side Request Forgery in totalsoft TS Poll versions 2.5.5 and earlier enables authenticated attackers with high privileges to make arbitrary network requests from the affected server. While this MEDIUM severity vulnerability (CVSS 4.4) requires high-privilege credentials and difficult exploitation conditions, it could facilitate reconnaissance or attacks against internal resources. No patch is currently available.
creativeinteractivemedia Real 3D FlipBook real3d-flipbook-lite is affected by missing authorization (CVSS 3.8).
Themes4WP Popularis Extra popularis-extra is affected by cross-site request forgery (csrf) (CVSS 5.4).
MailerLite MailerLite official-mailerlite-sign-up-forms is affected by missing authorization (CVSS 4.3).
UpsellWP versions 2.2.3 and earlier contain an authorization bypass vulnerability that allows authenticated users to access checkout upsell features they should not have permission to modify. An attacker with low-privilege account access could exploit improper access control to manipulate order bump and upsell configurations, potentially affecting store operations and revenue.
blazethemes News Kit Elementor Addons news-kit-elementor-addons is affected by missing authorization (CVSS 4.3).
Inadequate access control in WPBookit Pro through version 1.6.18 permits unauthenticated attackers to modify data by bypassing authorization checks. The vulnerability allows remote attackers without credentials to perform unauthorized actions on the plugin, affecting all installations running the vulnerable versions. No patch is currently available to remediate this issue.
themastercut Revision Manager TMC revision-manager-tmc is affected by cross-site request forgery (csrf) (CVSS 4.3).
Broken Link Notifier plugin versions 1.3.5 and earlier contain an authorization bypass vulnerability that allows unauthenticated attackers to modify data through improperly configured access controls. An attacker can exploit this flaw to alter link notifications without proper authentication, potentially disrupting the plugin's functionality or manipulating stored information. No patch is currently available for this vulnerability.
Cookiebot versions 4.6.4 and earlier contain an access control bypass that allows authenticated attackers to exploit misconfigured security levels and gain unauthorized access to sensitive information. An attacker with low-level user credentials can leverage this vulnerability to read restricted data without proper authorization. No patch is currently available for this vulnerability.
The echo-knowledge-base plugin through version 16.011.0 fails to properly enforce access controls, enabling authenticated users to modify content they should not have permission to change. An attacker with valid login credentials could exploit misconfigured authorization rules to alter documentation or FAQ entries within the knowledge base system.
CryoutCreations Serious Slider cryout-serious-slider is affected by missing authorization (CVSS 4.3).
Metagauss EventPrime eventprime-event-calendar-management contains a security vulnerability (CVSS 5.3).
Inadequate access control in scripteo Ads Pro plugin version 5.0 and earlier enables authenticated attackers to modify data and cause service disruptions through misconfigured security levels. An attacker with valid credentials can exploit this vulnerability to bypass authorization checks and alter plugin functionality without administrative privileges. No patch is currently available.
Elementor Image Optimizer by Elementor image-optimization is affected by missing authorization (CVSS 4.3).
Elementor Ally versions up to 4.0.2 contain an authorization bypass vulnerability that allows unauthenticated remote attackers to modify content through improperly configured access controls. The vulnerability has a network attack vector with low complexity and no user interaction required, potentially enabling unauthorized alterations to website content. No patch is currently available.
KaizenCoders URL Shortify versions up to 1.12.3 contain a server-side request forgery vulnerability that allows high-privileged attackers to make arbitrary HTTP requests from the affected server without user interaction. An authenticated attacker could exploit this flaw to access internal resources, interact with backend services, or perform reconnaissance on the internal network. No patch is currently available for this vulnerability.
Kodezen Academy LMS versions up to 3.5.3 contain an access control misconfiguration that allows authenticated users to modify data they should not have permission to access. An attacker with valid credentials can exploit this missing authorization check to perform unauthorized changes, though no public exploit code or active exploitation has been reported. No patch is currently available for this vulnerability.
Improper access control in the WP Compress image optimizer plugin for WordPress (versions up to 6.60.28) enables unauthenticated attackers to modify plugin data and settings. The vulnerability allows unauthorized manipulation of the plugin's functionality without requiring user interaction or special network conditions. Currently, no patch is available for affected installations.
codepeople Calculated Fields Form calculated-fields-form is affected by missing authorization (CVSS 6.5).
BoldGrid Client Invoicing by Sprout Invoices sprout-invoices is affected by missing authorization (CVSS 5.3).
FooGallery through version 3.1.11 contains a missing authorization check that allows authenticated users to modify gallery content they should not have access to. An attacker with valid login credentials can exploit improperly configured access controls to alter galleries, potentially defacing or corrupting gallery data. No patch is currently available.
Stored XSS in FooGallery through version 3.1.11 allows authenticated users with high privileges to inject malicious scripts that execute in other users' browsers when viewing gallery content. An attacker with administrative or elevated access could leverage this vulnerability to steal session tokens, modify gallery data, or redirect users to malicious sites. A patch is not currently available for affected installations.
Improper access control in Alt Text AI versions up to 1.10.15 enables unauthenticated remote attackers to cause denial of service through misconfigured authorization checks. The vulnerability allows an attacker to disrupt service availability without requiring authentication or user interaction. No patch is currently available for this issue.
Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant is affected by missing authorization (CVSS 5.3).
Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection is affected by missing authorization (CVSS 4.3).
Fahad Mahmood Endless Posts Navigation endless-posts-navigation is affected by missing authorization (CVSS 5.3).
PublishPress PublishPress Authors publishpress-authors is affected by missing authorization (CVSS 4.3).
ExpressTech Systems Quiz And Survey Master quiz-master-next is affected by missing authorization (CVSS 4.3).
ExpressTech Systems Quiz And Survey Master quiz-master-next is affected by authorization bypass through user-controlled key (CVSS 5.3).
Improper access control in MiKa OSM through version 6.1.12 allows authenticated users to modify data or settings they should not have permission to access. An attacker with valid credentials could exploit misconfigured security levels to escalate privileges or alter system configuration. No patch is currently available for this vulnerability.
PublishPress PublishPress Revisions revisionary is affected by cross-site request forgery (csrf) (CVSS 5.4).
Insufficient access control in SupportCandy plugin versions 3.4.4 and earlier allows unauthenticated remote attackers to modify data through improperly configured security permissions. This vulnerability affects WordPress installations using the vulnerable plugin, enabling attackers to perform unauthorized actions without requiring authentication. No patch is currently available for this issue.
Cool Plugins Elementor Contact Form DB sb-elementor-contact-form-db is affected by missing authorization (CVSS 5.3).
wpzita Zita Elementor Site Library zita-site-library is affected by cross-site request forgery (csrf) (CVSS 4.3).
hcaptcha hCaptcha for WP hcaptcha-for-forms-and-more is affected by missing authorization (CVSS 5.3).
FluentForm versions 6.1.14 and earlier contain an access control bypass that allows authenticated users to perform unauthorized modifications. An attacker with valid credentials can exploit improperly configured security levels to alter data they should not have access to. No patch is currently available.
Improper access control in 10up Autoshare for Twitter through version 2.3.1 enables authenticated users to modify or disable sharing functionality without proper authorization checks. An attacker with limited privileges could exploit this vulnerability to disrupt social media publishing workflows or cause service unavailability for legitimate users. No patch is currently available for this medium-severity vulnerability.