Wpdevteam
Monthly
Authenticated account takeover in the Essential Addons for Elementor WordPress plugin (versions ≤ 6.6.10) lets a Contributor-or-above user inject a Bcc header into WordPress's administrator password-reset email via the plugin's Login/Register widget, capturing a valid admin reset link and seizing the site. The flaw stems from an email-header (CRLF) injection where the allowed-values check is enforced only in the browser editor, not server-side. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the vendor fixed it in version 6.6.11.
Stored cross-site scripting in the BetterDocs WordPress plugin (versions through 4.8.1) allows contributor-level authenticated attackers to inject persistent JavaScript that executes in any visitor's browser context. The flaw exploits a two-stage processing gap: entity-encoded quotes in a heading id attribute pass WordPress's wp_kses_post sanitization at save time, but are later decoded by html_entity_decode() inside process_content_for_toc(), after which a lazy regex extracts the now-unescaped value and echoes it directly into the Table of Contents HTML output. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Authorization bypass in the BetterLinks WordPress plugin (all versions ≤ 3.1.0) permits any authenticated subscriber-level user to create arbitrary short URLs with attacker-controlled slugs and redirect destinations, enabling phishing campaigns that abuse the victim site's trusted domain and SEO manipulation. Exploitation is conditional on the Fluent Boards companion plugin being simultaneously installed and active, and is facilitated by the plugin leaking the betterlinks_admin_nonce to all authenticated users on every frontend page via wp_localize_script. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; real-world risk is bounded by the dual-plugin dependency and the requirement for a valid WordPress account.
Stored Cross-Site Scripting in the Essential Addons for Elementor WordPress plugin (versions ≤ 6.6.11) allows authenticated contributors to inject persistent JavaScript payloads via the Fancy Text Widget, executing in any visitor's browser upon page load. Source code analysis confirms two distinct sink defects: the bundled Morphext library used unsafe `innerHTML` assignment for both phrase text and animation class names, and the widget's transition-type parameter was passed unsanitized to Morphext as a CSS class token without allowlist validation. No active exploitation is confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; however, the scope-change (S:C) CVSS vector and contributor-accessible attack surface make this a credible risk on multi-author WordPress deployments.
Stored Cross-Site Scripting in the Essential Addons for Elementor WordPress plugin (all versions through 6.6.11) allows authenticated contributors to persist malicious JavaScript via the Reading Progress Global Color Settings feature, executing against any user who subsequently visits an affected page. The vulnerability stems from insufficient sanitization in the plugin's Elements and Core traits, with a scope change (S:C) meaning impact extends beyond the plugin itself to victim browser sessions. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept is referenced in available intelligence.
SQL Injection in the BetterDocs WordPress plugin (versions up to and including 4.6.0) enables authenticated attackers holding at minimum a custom-level WordPress role to append arbitrary SQL to existing queries via the unsanitized `lang` parameter, extracting sensitive data from the underlying database. The attack surface is restricted to sites where one of five specific multilingual plugins (WPML, Polylang, qTranslate, Weglot, or TranslatePress) is active, as the vulnerable code path is guarded by `Helper::is_multilingual_active()`. No public exploit identified at time of analysis; EPSS data unavailable, and the CVE is not listed in CISA KEV.
Stored Cross-Site Scripting in Essential Addons for Elementor (versions up to and including 6.6.2) allows authenticated WordPress users with Author-level access or higher to inject persistent malicious JavaScript via event titles rendered through the Event Calendar widget. The injected payload executes in the browsers of any user who visits the affected page, with scope change confirmed by the CVSS:3.1 S:C designation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication barrier is low on sites that permit contributor or author registration.
Stored Cross-Site Scripting in Essential Blocks for WordPress (all versions through 6.1.4) allows authenticated Contributor-level users to permanently embed malicious JavaScript into pages via the `configurablePrefix` attribute of the Table of Contents block. The payload persists in the database and executes in every subsequent visitor's browser, enabling session hijacking, credential theft, or forced redirects at scale across the site's audience. No public exploit code or CISA KEV listing is present in the available intelligence, but Wordfence's disclosure paired with publicly accessible source-level Trac links substantially lowers the effort required to develop a working exploit.
Stored Cross-Site Scripting in BetterDocs WordPress plugin (versions ≤4.5.3) allows authenticated contributors to inject persistent malicious scripts via the unescaped blockId attribute of the betterdocs/category-slate-layout Gutenberg block. The injected payload executes in the browser of any visitor who loads the compromised page, enabling session hijacking, credential theft, or admin-level privilege escalation against site operators. No public exploit identified at time of analysis, but the contributor-level authentication threshold makes this accessible on any WordPress site permitting open or shared content authorship.
Stored Cross-Site Scripting in the EmbedPress WordPress plugin (all versions through 4.5.3) allows authenticated attackers with contributor-level access to persistently inject arbitrary JavaScript via the block 'url' attribute, executing in the browsers of any user who visits an affected page. The vulnerability originates in insufficient sanitization within EmbedPressBlockRenderer.php and Helper.php, as confirmed by Wordfence and traceable to specific lines in the plugin's source repository. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Scope:Changed CVSS designation reflects that successful exploitation affects resources beyond the vulnerable component itself - namely, victim browser sessions.
Information exposure in Essential Addons for Elementor (all versions ≤ 6.6.4) allows unauthenticated remote attackers to extract content from password-protected, private, and draft WordPress posts via the plugin's ajax_load_more AJAX endpoint. The root cause (CWE-639) is that user-controlled query parameters are accepted without enforcing WordPress native post-visibility access controls, bypassing the platform's built-in confidentiality model. No public exploit code has been identified at time of analysis, but the zero-authentication, zero-complexity attack surface on one of the most widely deployed Elementor add-ons makes this a realistic target for automated scanning campaigns.
Privilege escalation in Essential Addons for Elementor (all versions ≤ 6.5.13) allows authenticated WordPress users with Author-level access or above to create new accounts with elevated roles such as Editor by exploiting the plugin's `register_user` function, which applies an incomplete role denylist that blocks only 'administrator' while leaving other privileged roles unguarded. The network-accessible, low-complexity attack vector (AV:N/AC:L/PR:L) makes this realistic for any site with the plugin's registration widget exposed and populated with low-trust authors. No public exploit has been identified at time of analysis and CISA KEV status is absent, but the plugin's broad WordPress deployment increases aggregate exposure.
BetterDocs plugin for WordPress versions up to 4.3.11 allows authenticated subscribers and higher to trigger arbitrary OpenAI API calls using the site's configured API key due to missing capability checks in the generate_openai_content_callback() function. An attacker with subscriber-level access can supply arbitrary prompts to exhaust the site owner's paid AI API quota without authorization, resulting in unauthorized financial impact and service degradation. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in BetterDocs WordPress plugin versions up to 4.3.8 allows authenticated attackers with contributor-level access to inject arbitrary JavaScript into pages via the 'betterdocs_feedback_form' shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the browsers of all users who view affected pages, enabling account compromise, credential theft, or malware distribution. No public exploit code or active exploitation has been identified at this time.
Authenticated account takeover in the Essential Addons for Elementor WordPress plugin (versions ≤ 6.6.10) lets a Contributor-or-above user inject a Bcc header into WordPress's administrator password-reset email via the plugin's Login/Register widget, capturing a valid admin reset link and seizing the site. The flaw stems from an email-header (CRLF) injection where the allowed-values check is enforced only in the browser editor, not server-side. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the vendor fixed it in version 6.6.11.
Stored cross-site scripting in the BetterDocs WordPress plugin (versions through 4.8.1) allows contributor-level authenticated attackers to inject persistent JavaScript that executes in any visitor's browser context. The flaw exploits a two-stage processing gap: entity-encoded quotes in a heading id attribute pass WordPress's wp_kses_post sanitization at save time, but are later decoded by html_entity_decode() inside process_content_for_toc(), after which a lazy regex extracts the now-unescaped value and echoes it directly into the Table of Contents HTML output. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Authorization bypass in the BetterLinks WordPress plugin (all versions ≤ 3.1.0) permits any authenticated subscriber-level user to create arbitrary short URLs with attacker-controlled slugs and redirect destinations, enabling phishing campaigns that abuse the victim site's trusted domain and SEO manipulation. Exploitation is conditional on the Fluent Boards companion plugin being simultaneously installed and active, and is facilitated by the plugin leaking the betterlinks_admin_nonce to all authenticated users on every frontend page via wp_localize_script. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; real-world risk is bounded by the dual-plugin dependency and the requirement for a valid WordPress account.
Stored Cross-Site Scripting in the Essential Addons for Elementor WordPress plugin (versions ≤ 6.6.11) allows authenticated contributors to inject persistent JavaScript payloads via the Fancy Text Widget, executing in any visitor's browser upon page load. Source code analysis confirms two distinct sink defects: the bundled Morphext library used unsafe `innerHTML` assignment for both phrase text and animation class names, and the widget's transition-type parameter was passed unsanitized to Morphext as a CSS class token without allowlist validation. No active exploitation is confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; however, the scope-change (S:C) CVSS vector and contributor-accessible attack surface make this a credible risk on multi-author WordPress deployments.
Stored Cross-Site Scripting in the Essential Addons for Elementor WordPress plugin (all versions through 6.6.11) allows authenticated contributors to persist malicious JavaScript via the Reading Progress Global Color Settings feature, executing against any user who subsequently visits an affected page. The vulnerability stems from insufficient sanitization in the plugin's Elements and Core traits, with a scope change (S:C) meaning impact extends beyond the plugin itself to victim browser sessions. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept is referenced in available intelligence.
SQL Injection in the BetterDocs WordPress plugin (versions up to and including 4.6.0) enables authenticated attackers holding at minimum a custom-level WordPress role to append arbitrary SQL to existing queries via the unsanitized `lang` parameter, extracting sensitive data from the underlying database. The attack surface is restricted to sites where one of five specific multilingual plugins (WPML, Polylang, qTranslate, Weglot, or TranslatePress) is active, as the vulnerable code path is guarded by `Helper::is_multilingual_active()`. No public exploit identified at time of analysis; EPSS data unavailable, and the CVE is not listed in CISA KEV.
Stored Cross-Site Scripting in Essential Addons for Elementor (versions up to and including 6.6.2) allows authenticated WordPress users with Author-level access or higher to inject persistent malicious JavaScript via event titles rendered through the Event Calendar widget. The injected payload executes in the browsers of any user who visits the affected page, with scope change confirmed by the CVSS:3.1 S:C designation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication barrier is low on sites that permit contributor or author registration.
Stored Cross-Site Scripting in Essential Blocks for WordPress (all versions through 6.1.4) allows authenticated Contributor-level users to permanently embed malicious JavaScript into pages via the `configurablePrefix` attribute of the Table of Contents block. The payload persists in the database and executes in every subsequent visitor's browser, enabling session hijacking, credential theft, or forced redirects at scale across the site's audience. No public exploit code or CISA KEV listing is present in the available intelligence, but Wordfence's disclosure paired with publicly accessible source-level Trac links substantially lowers the effort required to develop a working exploit.
Stored Cross-Site Scripting in BetterDocs WordPress plugin (versions ≤4.5.3) allows authenticated contributors to inject persistent malicious scripts via the unescaped blockId attribute of the betterdocs/category-slate-layout Gutenberg block. The injected payload executes in the browser of any visitor who loads the compromised page, enabling session hijacking, credential theft, or admin-level privilege escalation against site operators. No public exploit identified at time of analysis, but the contributor-level authentication threshold makes this accessible on any WordPress site permitting open or shared content authorship.
Stored Cross-Site Scripting in the EmbedPress WordPress plugin (all versions through 4.5.3) allows authenticated attackers with contributor-level access to persistently inject arbitrary JavaScript via the block 'url' attribute, executing in the browsers of any user who visits an affected page. The vulnerability originates in insufficient sanitization within EmbedPressBlockRenderer.php and Helper.php, as confirmed by Wordfence and traceable to specific lines in the plugin's source repository. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Scope:Changed CVSS designation reflects that successful exploitation affects resources beyond the vulnerable component itself - namely, victim browser sessions.
Information exposure in Essential Addons for Elementor (all versions ≤ 6.6.4) allows unauthenticated remote attackers to extract content from password-protected, private, and draft WordPress posts via the plugin's ajax_load_more AJAX endpoint. The root cause (CWE-639) is that user-controlled query parameters are accepted without enforcing WordPress native post-visibility access controls, bypassing the platform's built-in confidentiality model. No public exploit code has been identified at time of analysis, but the zero-authentication, zero-complexity attack surface on one of the most widely deployed Elementor add-ons makes this a realistic target for automated scanning campaigns.
Privilege escalation in Essential Addons for Elementor (all versions ≤ 6.5.13) allows authenticated WordPress users with Author-level access or above to create new accounts with elevated roles such as Editor by exploiting the plugin's `register_user` function, which applies an incomplete role denylist that blocks only 'administrator' while leaving other privileged roles unguarded. The network-accessible, low-complexity attack vector (AV:N/AC:L/PR:L) makes this realistic for any site with the plugin's registration widget exposed and populated with low-trust authors. No public exploit has been identified at time of analysis and CISA KEV status is absent, but the plugin's broad WordPress deployment increases aggregate exposure.
BetterDocs plugin for WordPress versions up to 4.3.11 allows authenticated subscribers and higher to trigger arbitrary OpenAI API calls using the site's configured API key due to missing capability checks in the generate_openai_content_callback() function. An attacker with subscriber-level access can supply arbitrary prompts to exhaust the site owner's paid AI API quota without authorization, resulting in unauthorized financial impact and service degradation. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in BetterDocs WordPress plugin versions up to 4.3.8 allows authenticated attackers with contributor-level access to inject arbitrary JavaScript into pages via the 'betterdocs_feedback_form' shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the browsers of all users who view affected pages, enabling account compromise, credential theft, or malware distribution. No public exploit code or active exploitation has been identified at this time.