Wpmonks
Monthly
Broken access control in Gravity Booster - Styles & Layouts for Gravity Forms (WordPress plugin by WPMonks) through version 6.0 permits any authenticated subscriber to invoke functionality restricted to higher-privileged roles, yielding limited but real confidentiality and integrity impact. Reported by Patchstack and catalogued as EUVD-2026-60813, the flaw stems from missing authorization checks (CWE-862) on plugin operations, enabling subscriber-level users to read or modify form style and layout configurations beyond their intended permissions. No public exploit code and no active exploitation have been identified at time of analysis.
Stored Cross-Site Scripting in the Gravity Booster - Styles & Layouts for Gravity Forms WordPress plugin (versions ≤ 5.26) allows authenticated attackers with editor-level permissions to inject persistent malicious scripts into admin settings fields. The injected payload executes in the browser of any user who subsequently visits an affected page, enabling session hijacking, credential theft, or further privilege escalation within the WordPress environment. Exploitation is constrained to multi-site WordPress installations or single-site deployments where the unfiltered_html capability has been explicitly disabled; no public exploit or CISA KEV listing has been identified at time of analysis.
The Styler for Ninja Forms plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the deactivate_license. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Broken access control in Gravity Booster - Styles & Layouts for Gravity Forms (WordPress plugin by WPMonks) through version 6.0 permits any authenticated subscriber to invoke functionality restricted to higher-privileged roles, yielding limited but real confidentiality and integrity impact. Reported by Patchstack and catalogued as EUVD-2026-60813, the flaw stems from missing authorization checks (CWE-862) on plugin operations, enabling subscriber-level users to read or modify form style and layout configurations beyond their intended permissions. No public exploit code and no active exploitation have been identified at time of analysis.
Stored Cross-Site Scripting in the Gravity Booster - Styles & Layouts for Gravity Forms WordPress plugin (versions ≤ 5.26) allows authenticated attackers with editor-level permissions to inject persistent malicious scripts into admin settings fields. The injected payload executes in the browser of any user who subsequently visits an affected page, enabling session hijacking, credential theft, or further privilege escalation within the WordPress environment. Exploitation is constrained to multi-site WordPress installations or single-site deployments where the unfiltered_html capability has been explicitly disabled; no public exploit or CISA KEV listing has been identified at time of analysis.
The Styler for Ninja Forms plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the deactivate_license. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.