WordPress Vulnerabilities

Datafeedr Product Sets exposes missing authorization in dfrps_ajax_delete_saved_search in functions/ajax.php. The CVSS 4.0 vector requires low-privilege authenticated access and scores limited integrity and availability impacts; the minimum WordPress role, request parameters and object-ownership rules are not disclosed in the export. The affected operation concerns saved-search deletion, not arbitrary filesystem deletion. The CNA states that an exploit is public; this archive has not retrieved or tested it. Published affected versions: 1.3.0 through 1.3.24 (enumerated by the CNA).

Chikkili Google Pay India for WooCommerce through 1.0.6 accepts payment notifications without verifying that they came from the payment provider. An unauthenticated attacker can submit a forged notification and mark an arbitrary order paid without making a payment. The notification endpoint, parameter names and expected verification method are not disclosed in the export. Published affected versions: <= 1.0.6.

Duplicator does not restrict its one-click upgrade routine to users authorized to install plugins. The routine is also exposed without authentication, but the disclosed attacker scenario is a multisite child-site administrator who is not a network administrator: that user can install and run arbitrary PHP in the network-wide shared Duplicator directory. This record does not establish that an unauthenticated outsider can complete the same code-execution chain. The route, upload parameter and any additional prerequisites are not disclosed in the export. Published affected versions: 1.5.17 to < 5.0.0.

Datawiza Proxy Auth trusts user-identity and role HTTP headers without verifying that a trusted reverse proxy supplied them. An unauthenticated attacker whose headers reach that trust path can create and authenticate as a WordPress administrator. The exact header names, authentication route and proxy configuration are not disclosed in the export. Published affected versions: 1.1.0 to < 1.1.1.

Qi Addons for Elementor decodes HTML entities in widget heading text without adequately sanitizing the decoded result. A Contributor or higher can supply heading text that becomes live HTML forms in posts, including password inputs that submit to an external host, bypassing markup restrictions WordPress would otherwise apply. This supports credential-harvesting content; arbitrary JavaScript execution is not established by this description. The exact widget identifier, heading parameter and processing function are not disclosed in the export. Published affected versions: < 1.11.2.

InstaWP Connect checks only a nonce, not a capability, when handling its settings-update action. A low-privileged authenticated user can overwrite settings, including which roles may access the sync feature, if an administrator has already granted that role sync access. This grant is not enabled by default, and the flaw is not established for every ordinary low-privilege account. The exact action identifier and settings parameter names are not disclosed in the export. Published affected versions: < 0.1.4.2.

WPVR lacks object-level ownership checks when updating virtual tours. A Contributor or higher can direct an update at another user’s tour and modify, reconfigure and publish it without the required authority over that object. The update route, tour-ID parameter and exact editable fields are not disclosed in the export. Published affected versions: 8.3.0 to < 9.0.3.

WPVR does not perform object-level authorization when reading and updating virtual tours. A Contributor or higher can select a tour belonging to another user and read or modify it. The affected routes, object-ID parameters and scope of returned fields are not disclosed in the export; access to unrelated WordPress content is not established. Published affected versions: 9.0.0 to < 9.0.3.

WPVR incorrectly checks user capabilities in its tour-creation setup wizard. A Contributor or higher can use that path to create and publish tour content and set arbitrary post metadata that the caller would not otherwise be allowed to create or publish. The wizard endpoint, metadata parameter and any specific privilege-escalation metadata key are not disclosed in the export; administrator account takeover is not established. Published affected versions: 8.5.55 to < 9.1.3.

GiveWP does not check the required editing capability when processing donor-address changes. A user granted donor-report viewing access but not donor-edit access can add, modify or delete the stored address of any donor. Report-view permission is the disclosed prerequisite; this is not established for an arbitrary Subscriber. The handler, donor-ID parameter and address-field names are not disclosed in the export. Published affected versions: < 4.19.0.1.

GiveWP incorrectly resolves which page a page-capability request applies to. A user with a custom fundraising role can use the resulting authorization error to edit, publish and read pages owned by other users, including administrators. The exact role name, capability request and page-ID handling function are not disclosed in the export; this does not establish administrator impersonation. Published affected versions: < 4.19.0.1.

GiveWP insufficiently sanitizes and escapes a donation-form template setting before inserting it into an HTML attribute. A user with a custom GiveWP form-editing role can store attacker-controlled script that executes when a visitor or administrator opens the affected donation form. The setting name, save endpoint and rendering function are not disclosed in the export. Published affected versions: < 4.19.0.1.

GiveWP reads a user-supplied filename without adequate validation. A user with a high-privilege custom role can traverse paths to disclose JSON-parseable files anywhere on the server and overwrite the plugin’s stored configuration. The JSON-parseability restriction is part of the disclosed read primitive; unrestricted arbitrary-file disclosure or filesystem writes are not established. The exact role, file-reading endpoint and filename parameter are not disclosed in the export. Published affected versions: < 4.19.0.1.

GiveWP renders donation forms through a public front-end route without checking form status or caller capability. An unauthenticated visitor can retrieve content and settings from draft, pending, private and scheduled forms that WordPress would otherwise keep non-public. The route identifier, selector parameter and exact exposed setting fields are not disclosed in the export. Published affected versions: < 4.19.0.1.

WP Stripe Checkout skips Stripe webhook-signature verification when no signing secret is configured, which is its default state. In that configuration, an unauthenticated attacker can forge a payment-completion notification and create a completed order without paying. The webhook endpoint and payload field names are not disclosed in the export; the described bypass is conditional on the absent secret. Published affected versions: < 1.2.2.62.

Contact Form by Supsystic fails to sanitize and escape form names. A user with access to the form editor can store script in a form name that executes when another user views the form. On multisite, this crosses a privilege boundary because site administrators lack unfiltered_html. The minimum role outside that scenario, save action and output context are not disclosed in the export. Published affected versions: < 1.8.0.

Relevanssi: The CVSS vector requires an authenticated attacker with high privileges; the minimum WordPress role is not disclosed. Attacker-controlled serialized data can reach unsafe deserialization and instantiate PHP objects. The source rates confidentiality, integrity and availability impacts as high. A usable gadget chain and a particular code-execution path are not established in the export. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 4.28.4.

WpEvently: The CVSS vector permits an unauthenticated attacker. An operation lacks the required authorization checks. The vector indicates limited unauthorized information access and changes, with no availability impact scored. The export does not identify the protected resource, exact action or capability that is missing; more specific read or write operations are not established. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 5.7.8.

UPI QR Code Payment Gateway for WooCommerce: The CVSS vector permits an unauthenticated attacker. An operation lacks the required authorization checks. The vector indicates unauthorized access to sensitive information (high confidentiality impact), without scored integrity or availability impact. The export does not identify the protected resource, exact action or capability that is missing; more specific read or write operations are not established. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 1.6.3.

aBlocks through 2.17.0 lets a Contributor or higher save a block in their own post with formType set to login and an attacker-chosen roleSlug, bypassing the registration-only save-time check in RegistrationFormSanitizer::verify(). The /ablocks/v1/form-builder/registration REST route has a permissive permission callback; register() reads roleSlug from post_content without checking at runtime that formType is registration. A valid wp_rest nonce and post ownership are still required. WP_User::set_role() and wp_set_auth_cookie() then grant the elevated role and an authenticated session. is_safe_registration_role() rejects roles with administrator-tier capabilities, so the disclosed escalation reaches Editor or another permitted non-Administrator role, not Administrator on standard WordPress.

WP Social Feed Gallery: The CVSS vector permits an unauthenticated attacker. An operation lacks the required authorization checks. The vector indicates limited unauthorized information access and changes, with no availability impact scored. The export does not identify the protected resource, exact action or capability that is missing; more specific read or write operations are not established. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 5.0.13.

Ad Inserter: The CVSS vector requires an authenticated attacker with low privileges; the minimum WordPress role is not disclosed. Attacker-controlled input is reflected into web output without adequate neutralization. A victim must interact with the crafted content for script to execute in the affected site origin. The export does not disclose the reflection context or victim role. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 2.8.18.

Newsletters: The CVSS vector permits an unauthenticated attacker. Attacker-controlled serialized data can reach unsafe deserialization and instantiate PHP objects. The source rates confidentiality, integrity and availability impacts as high. A usable gadget chain and a particular code-execution path are not established in the export. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 4.18.1.

QA Analytics: The CVSS vector permits an unauthenticated attacker. Attacker-controlled content is stored and later rendered without adequate neutralization, allowing script to execute in the affected site origin when a user views the output. The export does not identify the victim role, storage field or rendering function. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 5.3.0.1.

VOD Infomaniak: The CVSS vector permits an unauthenticated attacker. Attacker-controlled content is stored and later rendered without adequate neutralization, allowing script to execute in the affected site origin when a user views the output. The export does not identify the victim role, storage field or rendering function. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 1.5.14.

Events Manager: The CVSS vector permits an unauthenticated attacker. Attacker-controlled input is reflected into web output without adequate neutralization. A victim must interact with the crafted content for script to execute in the affected site origin. The export does not disclose the reflection context or victim role. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 7.4.8.

All-in-One Video Gallery: The CVSS vector requires an authenticated attacker with low privileges; the minimum WordPress role is not disclosed. Attacker-controlled content is stored and later rendered without adequate neutralization, allowing script to execute in the affected site origin when a user views the output. The export does not identify the victim role, storage field or rendering function. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 4.9.7.

Paytium: The CVSS vector permits an unauthenticated attacker. Attacker-controlled serialized data can reach unsafe deserialization and instantiate PHP objects. The source rates confidentiality, integrity and availability impacts as high. A usable gadget chain and a particular code-execution path are not established in the export. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 5.0.5.

LiteSpeed Cache: The CVSS vector permits an unauthenticated attacker. Sensitive information is included in data sent to an unauthorized recipient. The CVSS vector specifies high attack complexity and high confidentiality impact, but the export does not disclose the additional conditions, exact data, response field or receiving endpoint. No integrity or availability impact is scored. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 7.9.

BP Better Messages: The CVSS vector permits an unauthenticated attacker. Attacker-controlled input reaches unsafe client-side DOM handling and can execute script in the affected site origin after victim interaction. The export does not disclose the DOM source, sink or victim role. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 3.1.3.

W3 Total Cache: The CVSS vector permits an unauthenticated attacker. Attacker-controlled content is stored and later rendered without adequate neutralization, allowing script to execute in the affected site origin when a user views the output. The export does not identify the victim role, storage field or rendering function. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 2.10.7.

We’re Open!: The CVSS vector permits an unauthenticated attacker. Attacker-controlled input is reflected into web output without adequate neutralization. A victim must interact with the crafted content for script to execute in the affected site origin. The export does not disclose the reflection context or victim role. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 2.6.

Product Filter by WBW: The CVSS vector permits an unauthenticated attacker. Attacker-controlled input can alter an inadequately neutralized SQL query, permitting blind extraction of database information. The export does not identify the inference channel. The source rates confidentiality impact as high and availability impact as limited, with no integrity impact; database writes or operating-system command execution are not established. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 3.4.6.

WP Event Solution: The CVSS vector permits an unauthenticated attacker. Attacker-controlled content is stored and later rendered without adequate neutralization, allowing script to execute in the affected site origin when a user views the output. The export does not identify the victim role, storage field or rendering function. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 4.1.26.

Newsletters: The CVSS vector permits an unauthenticated attacker. Attacker-controlled input can alter an inadequately neutralized SQL query. The source rates confidentiality impact as high and availability impact as limited, with no integrity impact; database write access or operating-system command execution is not established. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 4.18.1.

SureDash: The CVSS vector requires an authenticated attacker with low privileges; the minimum WordPress role is not disclosed. An operation lacks the required authorization checks. The vector indicates unauthorized access to sensitive information (high confidentiality impact), without scored integrity or availability impact. The export does not identify the protected resource, exact action or capability that is missing; more specific read or write operations are not established. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 1.12.2.

The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privileged users. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: at most 1.4.7.

A Subscriber or higher can invoke an authenticated AJAX action without the required capability check to install and activate a designated plugin from WordPress.org. The export duplicates the affected product name where it describes the installation target, so the target identity is unclear; it does not establish arbitrary-plugin installation. The AJAX action and parameter names are not disclosed. News Kit Addons For Elementor versions before 1.4.9 are affected; the authoritative record identifies 1.4.9 as fixed.

The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and paid, bypassing the Front End Users WordPress plugin through 3.2.35's content restrictions and its registration gating. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: at most 3.2.35.

The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: 8.5.49 to before 9.0.3. The source narrative identifies Contributor-level access, while the newly supplied CVSS vector specifies high privileges (PR:H); this discrepancy is unresolved, so the disclosed Contributor role is retained.

The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 2.8.194.

The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 2.8.194.

The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 2.8.194. The source narrative identifies Contributor-level access, while the newly supplied CVSS vector specifies high privileges (PR:H); this discrepancy is unresolved, so the disclosed Contributor role is retained.

The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 2.8.194.

The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 2.8.194.

The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 2.8.194.

The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 2.8.194.

The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 5.3.4.

The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 1.1.8.

The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a minimal role to permanently delete arbitrary posts, pages, attachments and other content belonging to other users. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: at most 1.3.4.

A Subscriber or higher can invoke the bundled-child creation/activation action without capability or nonce checks, causing the site-wide activation change described by the export. The source omits the object name in that passage. The same action can be induced via CSRF against a logged-in user, including an administrator. The action and parameter names are not disclosed. Advanced Twenty Seventeen through 1.3.1 is affected.

The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 2.2.3. The source narrative identifies Contributor-level access, while the newly supplied CVSS vector specifies high privileges (PR:H); this discrepancy is unresolved, so the disclosed Contributor role is retained.

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role attribute directly into the `[wppb-register]` shortcode without server-side authorization. The role guard in the form builder only downgrades roles that carry the manage_options or remove_users capability, leaving the Editor role and other privileged non-Administrator roles completely unrestricted. This makes it possible for authenticated attackers with Author-level access and above to create new WordPress accounts bearing the Editor role (or any other role that lacks the two guarded capabilities). Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: at most 4.0.3.

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: at most 2.2.1. The narrative requires the later administrator or higher-privileged user action described above even though the vector records UI:N.

The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: >= 2.0.0, before 2.1.48.

An unauthenticated attacker can craft script-bearing input that reaches the response without adequate escaping. A victim must interact with the crafted request or page for script to execute in the site origin; the victim role is not disclosed. The endpoint, action and parameter are not disclosed. The CNA vector records limited confidentiality impact, limited integrity impact, limited availability impact. Affected versions: at most 4.25.0.

An unauthenticated attacker can supply untrusted serialized input that is converted into application objects. The export identifies object injection but does not disclose the deserialization function, input format or a usable gadget chain; code execution is not independently established by this sparse record. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, high integrity impact, high availability impact. Affected versions: at most 1.3.16.

An unauthenticated attacker can supply untrusted serialized input that is converted into application objects. The export identifies object injection but does not disclose the deserialization function, input format or a usable gadget chain; code execution is not independently established by this sparse record. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, high integrity impact, high availability impact. Affected versions: at most 1.3.3.

An unauthenticated attacker can supply untrusted serialized input that is converted into application objects. The export identifies object injection but does not disclose the deserialization function, input format or a usable gadget chain; code execution is not independently established by this sparse record. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, high integrity impact, high availability impact. Affected versions: at most 1.0.8.

An unauthenticated attacker can supply untrusted serialized input that is converted into application objects. The export identifies object injection but does not disclose the deserialization function, input format or a usable gadget chain; code execution is not independently established by this sparse record. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, high integrity impact, high availability impact. Affected versions: at most 1.3.10.

An unauthenticated attacker can supply untrusted serialized input that is converted into application objects. The export identifies object injection but does not disclose the deserialization function, input format or a usable gadget chain; code execution is not independently established by this sparse record. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, high integrity impact, high availability impact. Affected versions: at most 1.3.5.

An unauthenticated attacker can supply untrusted serialized input that is converted into application objects. The export identifies object injection but does not disclose the deserialization function, input format or a usable gadget chain; code execution is not independently established by this sparse record. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, high integrity impact, high availability impact. Affected versions: at most 1.2.6.

An unauthenticated attacker can supply untrusted serialized input that is converted into application objects. The export identifies object injection but does not disclose the deserialization function, input format or a usable gadget chain; code execution is not independently established by this sparse record. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, high integrity impact, high availability impact. Affected versions: at most 1.1.1.

An unauthenticated attacker can supply untrusted serialized input that is converted into application objects. The export identifies object injection but does not disclose the deserialization function, input format or a usable gadget chain; code execution is not independently established by this sparse record. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, high integrity impact, high availability impact. The vector rates attack complexity as high; the additional conditions are not disclosed. Affected versions: at most 1.1.12.

An unauthenticated attacker can supply untrusted serialized input that is converted into application objects. The export identifies object injection but does not disclose the deserialization function, input format or a usable gadget chain; code execution is not independently established by this sparse record. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, high integrity impact, high availability impact. Affected versions: at most 1.3.9.

An unauthenticated attacker can influence a filename used by an include or require operation, allowing inclusion of a local file outside the intended selection. The export does not identify an executable attacker-controlled file or establish a remote-file inclusion path. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, high integrity impact, high availability impact. The vector rates attack complexity as high; the additional conditions are not disclosed. Affected versions: at most 1.4.1.

An unauthenticated attacker can craft script-bearing input that reaches an unsafe browser-side DOM operation. A victim must interact with the crafted request or page for script to execute in the site origin; the victim role is not disclosed. The endpoint, action and parameter are not disclosed. The CNA vector records limited confidentiality impact, limited integrity impact, limited availability impact. Affected versions: at most 7.0.

An unauthenticated attacker can supply untrusted serialized input that is converted into application objects. The export identifies object injection but does not disclose the deserialization function, input format or a usable gadget chain; code execution is not independently established by this sparse record. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, high integrity impact, high availability impact. Affected versions: at most 7.0.

An unauthenticated attacker can supply untrusted serialized input that is converted into application objects. The export identifies object injection but does not disclose the deserialization function, input format or a usable gadget chain; code execution is not independently established by this sparse record. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, high integrity impact, high availability impact. Affected versions: at most 1.13.

An unauthenticated attacker can supply untrusted serialized input that is converted into application objects. The export identifies object injection but does not disclose the deserialization function, input format or a usable gadget chain; code execution is not independently established by this sparse record. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, high integrity impact, high availability impact. Affected versions: at most 1.2.14.

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: Both editions: 0.9.2.4 to before 0.9.2.8.

The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: 4.0.0 to before 4.0.5.

An unauthenticated attacker can supply untrusted serialized input that is converted into application objects. The export identifies object injection but does not disclose the deserialization function, input format or a usable gadget chain; code execution is not independently established by this sparse record. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, high integrity impact, high availability impact. Affected versions: at most 2.7.8.5.

An unauthenticated attacker can supply input that reaches a database query without adequate separation of data from SQL syntax, altering query behavior. The export does not establish operating-system command execution or a particular query-stacking technique. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, limited availability impact. Affected versions: at most 2.7.8.5. Blind SQL injection is disclosed, but the extraction channel is not.

An unauthenticated attacker can store script-bearing input that is later rendered without sufficient output escaping. A victim must view or otherwise interact with the affected content for script execution in the site origin. The export does not identify the exact attacker or victim WordPress roles. The endpoint, action and parameter are not disclosed. The CNA vector records limited confidentiality impact, limited integrity impact, limited availability impact. Affected versions: at most 1.4.8.

A low-privilege authenticated attacker can supply input that reaches a database query without adequate separation of data from SQL syntax, altering query behavior. The export does not establish operating-system command execution or a particular query-stacking technique. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, limited availability impact. Affected versions: at most 8.0.7. Blind SQL injection is disclosed, but the extraction channel is not.

An unauthenticated attacker can craft script-bearing input that reaches the response without adequate escaping. A victim must interact with the crafted request or page for script to execute in the site origin; the victim role is not disclosed. The endpoint, action and parameter are not disclosed. The CNA vector records limited confidentiality impact, limited integrity impact, limited availability impact. Affected versions: at most 1.4.8.

A low-privilege authenticated attacker can reach protected functionality without the required authorization. The protected resource and exact operation are not disclosed. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact. Affected versions: at most 1.5.3.

An unauthenticated attacker can reach protected functionality without the required authorization. The protected resource and exact operation are not disclosed. The endpoint, action and parameter are not disclosed. The CNA vector records limited confidentiality impact, limited integrity impact. Affected versions: at most 9.6.3.0.

An unauthenticated attacker can reach protected functionality without the required authorization. The protected resource and exact operation are not disclosed. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact. Affected versions: at most 11.86.

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: Both editions: 0.9.2.7 to before 0.9.2.8.

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: Both editions: before 0.9.2.8.

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: Both editions: 0.8.9.4 to before 0.9.2.8. The narrative names the role described above, while the CVSS vector records high privileges (PR:H); that vector does not establish an Administrator-only requirement.

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: Both editions: 0.9.2.7 to before 0.9.2.8.

The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user (Subscriber) can dismiss administrative notices the LiteSpeed Cache WordPress plugin before 7.9.2 marks as non-dismissible, including a warning that sensitive files may be publicly accessible. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 7.9.2.

The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 7.9.2.

The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 7.9.2.

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to upload files with other active extensions into the public uploads directory, leading to stored script execution in the site origin and, depending on the server's handler mapping, to code execution. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: 4.0.5 to before 4.8.2.

The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 4.4.6.

The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and have the Download Monitor WordPress plugin before 5.3.5 serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors; single-site installations are unaffected. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 5.3.5.

The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 4.0.5.

The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged users who submit the affected form. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 4.0.5. The narrative names the role described above, while the CVSS vector records high privileges (PR:H); that vector does not establish an Administrator-only requirement.

The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed, allowing a site administrator who is not a Super Admin to create or overwrite network-wide options. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 7.8.5.

The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup). Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 7.8.5.

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 6.8.7.

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 6.8.7. The narrative names the role described above, while the CVSS vector records high privileges (PR:H); that vector does not establish an Administrator-only requirement.

The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allows unauthenticated users to achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 3.2.8.

The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 3.2.8.

The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: 3.1.1 to before 3.2.8.

The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 3.2.8. The narrative names the role described above, while the CVSS vector records high privileges (PR:H); that vector does not establish an Administrator-only requirement.