Security Alerts

Unauthenticated remote code execution risk in PHP request handling when out-of-memory interrupts partial internal initialization. Highest risk for mod_php; also affects PHP-FPM, php-cgi, FrankenPHP, LiteSpeed. Fixed in PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12. Update is the only complete fix. See php.net security advisory (21 Oct 2026).

What to do: Upgrade PHP to the fixed release for your branch (8.2.35, 8.3.36, 8.4.27 or 8.5.12+). Updating is the only complete fix — see php.net for temporary mitigations.

Unauthenticated remote code execution risk when request-owned internal state survives after memory is freed across worker requests. Partial mitigation: session.upload_progress.enabled=0 (and fatal_error_backtraces=0 on PHP 8.5) — not a complete fix. Fixed in PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12. Update is the only complete fix. See php.net security advisory (21 Oct 2026).

What to do: Upgrade PHP to the fixed release for your branch (8.2.35, 8.3.36, 8.4.27 or 8.5.12+). Updating is the only complete fix — see php.net for temporary mitigations.

Critical PHP Security Release The PHP project has announced a security release that fixes two critical security vulnerabilities discovered in PHP. Due to the critical severity of the issues, site owners are encouraged to immediately update their installations of PHP. Your web host may already be working to update PHP and put web application firewall (WAF) rules in place […]

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

WordPress 7.1.3 Maintenance and Security Release This security and maintenance release features 7 security fixes and 4 bug fixes. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.3 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background […]

What to do: Update wordpress to 7.1.3 or later, then verify the change in your environment.

WordPress 7.1.2 Release This security release features a fix for a critical severity security vulnerability. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.2 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, […]

What to do: Update wordpress to 7.1.2 or later, then verify the change in your environment.

WordPress 7.1.1 Maintenance and Security Release This security and maintenance release features 17 bug fixes on Core, 19 bug fixes for the Block Editor, and 11 security fixes. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.1 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update […]

What to do: Update wordpress to 7.1.1 or later, then verify the change in your environment.

WordPress 7.0.4 Release WordPress 7.0.4 is now available WordPress 7.0.4 is now available which features a security fix. Because this is a security release, it is recommended that you update your sites immediately. You can update to WordPress 7.0.4 by downloading it from WordPress.org, or visiting your site’s Dashboard → Updates and clicking Update Now. Sites that support […]

What to do: Update wordpress to 7.0.4 or later, then verify the change in your environment.

WordPress 7.0.3 release WordPress 7.0.3 is now available WordPress 7.0.3 is now available which features several security fixes. Because this is a security release, it is recommended that you update your sites immediately. You can update to WordPress 7.0.3 by downloading it from WordPress.org, or visiting your site’s Dashboard → Updates and clicking Update Now. Sites that support […]

What to do: Update wordpress to 7.0.3 or later, then verify the change in your environment.

WordPress 7.0.2 Release WordPress 7.0.2 is now available. The 7.0.2 security release addresses one critical and one high severity security issue. Because this is a security release, it is recommended that you update your sites immediately. Due to the severity, the WordPress.org team have enabled forced updates via the auto-update system for sites running affected versions. To manually […]

What to do: Update wordpress to 7.0.2 or later, then verify the change in your environment.

The Ajax Load More - Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'taxonomy_include_children' parameter in all versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activate_plugin function in all versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate a limited set of plugins. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

Unauthenticated Cross Site Scripting (XSS) in MapPress Maps for WordPress <= 2.97.3 versions. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

Unauthenticated Remote Code Execution (RCE) in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.47 versions. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

Unauthenticated Broken Access Control in WordPress Dating Theme <= 11.2.0 versions. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

Unauthenticated Cross Site Request Forgery (CSRF) in WordPress Dating Theme <= 11.2.0 versions. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8. This is due to missing authorization checks on the wpfb_hide_review and wprp_save_review_admin AJAX handlers combined with insufficient path validation in the wpfb_hidereview_ajax() function, which uses strpos() to check that a stored media URL starts with the expected prefix but fails to sanitize path traversal sequences in the remaining relative path before passing it to unlink(). This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the affected site's server which may make remote code execution possible. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $_POST['curselrevs'] raw with no sanitization or type casting, then concatenating each array element directly into a `WHERE id IN ( ... )` clause without quoting and executing via $wpdb->get_results() without $wpdb->prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes() on user-supplied JSON strings prior to json_decode(), which removes the escaping applied by WordPress's wp_magic_quotes; the resulting decoded array values are then concatenated directly into SQL WHERE clauses without parameterization, and the constructed query is executed via $wpdb->get_results() without $wpdb->prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The handler also returns the executed SQL string in its JSON response, which simplifies oracle construction for blind exploitation. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 versions. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9 versions. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

WP23 WordPress at 23 is simultaneously both the strongest and most precarious it’s ever been. Last week, we shipped WordPress 7 to the world. In seven days, 46% of all WordPresses, tens of millions across countless different hosting environments, are already on 7.0, auto-updated with no breakage. From a Raspberry Pi to the most secure sites [&#8230;]

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dt_default_button' shortcode in all versions up to, and including, 14.3.2. This is due to insufficient input sanitization and output escaping on the 'title' component of the 'link' shortcode parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.1.2 via the popup_submit. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, products, or orders, mass-delete all comments on any post, and change any post's status. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including, 5.1.2. This is due to missing nonce verification and capability checks in the iwar_save_recipe() AJAX handler. This makes it possible for unauthenticated attackers to create a malicious automation recipe that pairs an HTTP post trigger with an auto-login action, allowing any unauthenticated visitor to visit a crafted URL and receive authentication cookies for any targeted user account (e.g., administrator), achieving complete authentication bypass and privilege escalation. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.1.2. This is due to the infusedwoo_gdpr_upddata() function missing authorization and capability checks, as well as lacking restrictions on which user meta keys can be updated. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their own wp_capabilities user meta to grant themselves Administrator role privileges. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Vantage theme for WordPress is vulnerable to Stored Cross-Site Scripting via Gallery block text content in versions up to, and including, 1.20.32 due to insufficient output escaping in the gallery template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

WordPress 6.9.2 Release WordPress 6.9.2 is now available This is a security release that features several fixes. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 6.9.2 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic [&#8230;]

What to do: Update wordpress to 6.9.2 or later, then verify the change in your environment.

The Gravity Forms WordPress plugin before 2.9.23.1 does not properly prevent users from uploading dangerous files through its chunked upload functionality, allowing attackers to upload PHP files to affected sites and achieve Remote Code Execution, granted they can discover or enumerate the upload path. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.8.0 via the 'WooCommerce_Delivery_Notes::update' function. This is due to missing capability check in the 'WooCommerce_Delivery_Notes::update' function, PHP enabled in Dompdf, and missing escape in the 'template.php' file. This makes it possible for unauthenticated attackers to execute code on the server. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'register_form' and 'restrict' shortcodes in all versions up to, and including, 3.2.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_page_custom_js' parameter in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, despite the intended role restriction of Custom JS to Administrators. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_template_content' function in all versions up to, and including, 4.11.53. This makes it possible for unauthenticated attackers to view the content of private, draft, and pending templates. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Premium Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.11.53. This is due to missing nonce validation in the 'insert_inner_template' function. This makes it possible for unauthenticated attackers to create arbitrary Elementor templates via a forged request granted they can trick a site administrator or other user with the edit_posts capability into performing an action such as clicking on a link. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates on URL-decoded paths, and `appendNormalized()` which strips everything after a null byte before constructing the filesystem path. This makes it possible for unauthenticated attackers to read arbitrary files from the webroot, including wp-config.php, by appending a double URL-encoded null byte (%2500) followed by an allowed extension (.txt) to the file path. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event_desc' parameter in all versions up to, and including, 1.3.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted they can convince an administrator to enable lower privilege users to manage calendar events via the plugin settings. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'duplicate_wpml_layout' function in all versions up to, and including, 2.9.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary posts with the content of other existing posts, potentially exposing private and password-protected content and deleting any content that is not saved in revisions or backups. Posts must have been created with Beaver Builder to be copied or updated. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory creation in all versions up to, and including, 0.9.120. This is due to the check_filesystem_permissions() function not properly restricting the directories that can be created, or in what location. This makes it possible for authenticated attackers, with Administrator-level access and above, to create arbitrary directories. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode attributes in all versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Web to SugarCRM Lead plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the custom field deletion functionality. This makes it possible for unauthenticated attackers to delete custom fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Custom scripts' setting in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Product Table for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_key' parameter in all versions up to, and including, 5.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Tainacan plugin for WordPress is vulnerable to unauthorized metadata section creation due to missing authorization checks in all versions up to, and including, 1.0.1. This is due to the `create_item_permissions_check()` function unconditionally returning true, which bypasses authentication and authorization validation. This makes it possible for unauthenticated attackers to create arbitrary metadata sections for any collection via the public REST API granted they can access the WordPress site. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The WC Builder – WooCommerce Page Builder for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'heading_color' parameter (and multiple other styling parameters) of the `wpbforwpbakery_product_additional_information` shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.2 via deserialization of untrusted input in the dslc_module_posts_output shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.5. This is due to missing authorization checks on the post update functionality in the fpsml_form_process AJAX action. This makes it possible for unauthenticated attackers to modify arbitrary posts by providing a post_id parameter via the guest posting form, allowing them to change post titles, content, excerpts, and remove post authors. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the '/ultp/v2/get_dynamic_content/' REST API endpoint in all versions up to, and including, 5.0.3. This makes it possible for unauthenticated attackers to retrieve sensitive user metadata, including password hashes. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The WishSuite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_text' parameter of the 'wishsuite_button' shortcode in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Five Star Restaurant Reservations – WordPress Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rtb-name' parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'hide_fields' and the 'attr_search' parameter in all versions up to, and including, 1.4.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'ays_chatgpt_save_wp_media' function in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to upload media files. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.0 via the ays_chatgpt_pinecone_upsert function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Blubrry PowerPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 11.15.2. This is due to the plugin validating file extensions but not halting execution when validation fails in the 'powerpress_edit_post' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Tainacan plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via uploaded files marked as private being exposed in wp-content without adequate protection. This makes it possible for unauthenticated attackers to extract potentially sensitive information from files that have been marked as private. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing unauthenticated users to retrieve a valid session for arbitrary users by knowing their email address. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The attention-bar WordPress plugin through 0.7.2.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users such as administrator to perform SQL injection attacks This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing unauthenticated users to upload arbitrary file on the server and lead to RCE This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in all versions up to, and including, 2.9.21.1. This is due to the extension blacklist not including .phar files, which can be uploaded through the chunked upload mechanism. This makes it possible for unauthenticated attackers to upload executable .phar files and achieve remote code execution on the server, granted they can discover or enumerate the upload path. In order for an attacker to achieve RCE, the web server needs to be set up to process .phar file as PHP via file handler mapping or similar. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Team Members Showcase WordPress plugin before 3.5.0 does not sanitize and escape a parameter before outputting it back in the page, leading to reflected cross-site scripting, which could be used against high-privilege users such as admins. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The age-restriction WordPress plugin through 3.0.2 does not have authorisation in the age_restrictionRemoteSupportRequest function, allowing any authenticated users, such as subscriber to create an admin user with a hardcoded username and arbitrary password. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.48 does not sanitize user input provided via an AJAX action, allowing unauthenticated users to store XSS payloads which are later retrieved from another AJAX call and output unescaped. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copy_post_image() function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This only impacts sites that have allow_url_fopen set to `On`, the post creation form enabled along with a file upload field for the post This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rainbow-Themes Education WordPress Theme | HiStudy histudy allows SQL Injection.This issue affects Education WordPress Theme | HiStudy: from n/a through < 3.1.0. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

Path Traversal: '.../...//' vulnerability in CocoBasic Blanka - One Page WordPress Theme blanka-wp allows PHP Local File Inclusion.This issue affects Blanka - One Page WordPress Theme: from n/a through < 1.5. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticated users, such as subscriber to reset the password of arbitrary accounts, including administrators. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing attackers to conduct reflected XSS attacks against logged-in users. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The ElementInvader Addons for Elementor WordPress plugin before 1.4.1 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form action. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The WP Carticon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carticon_js_script' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The ViaAds plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.2. This is due to missing nonce validation on the `ViaAds_pluginHandler` function. This makes it possible for unauthenticated attackers to modify the plugin's API key and cookie consent settings via a forged request granted they can trick an administrator into performing an action such as clicking on a link. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The List category posts plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 0.92.0 via the 'catlist' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.3.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Author-level access and above, to enable or disable arbitrary SiteSEO features that they should not have access to. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 12.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the __construct function in all versions up to, and including, 3.6.0. This makes it possible for unauthenticated attackers to read arbitrary logged emails sent through the Post SMTP plugin, including password reset emails containing password reset links, which can lead to account takeover. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The WPCOM Member plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.14 via the action parameter in one of its shortcodes. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Inactive Logout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ina_redirect_page_individual_user' parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disconnect_account_request() function in all versions up to, and including, 3.5.1. This makes it possible for unauthenticated attackers to disconnect the site from its API plan. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Document Library Lite plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 1.1.6. This is due to the plugin exposing an unauthenticated AJAX action dll_load_posts which returns a JSON table of document data without performing nonce or capability checks. The handler accepts an attacker-controlled args array where the status option explicitly allows draft, pending, future, and any. This makes it possible for unauthenticated attackers to retrieve unpublished document titles and content via the AJAX endpoint. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The TARIFFUXX plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4. This is due to insufficient neutralization of user-supplied input used directly in SQL queries. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject additional SQL into queries and extract sensitive information from the database via a crafted id attribute in the 'tariffuxx_configurator' shortcode. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Digiseller plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ds' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Error Log Viewer by BestWebSoft plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.6 via the rrrlgvwr_get_file function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Stored Cross-Site Scripting via the ‘cs_job_title’ parameter in all versions up to, and including, 7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Candidate-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to authorization bypass in all versions up to, and including, 7.6. This is due to insufficient login restrictions on inactive and pending accounts. This makes it possible for authenticated attackers, with Candidate- and Employer-level access and above, to log in to the site even if their account is inactive or pending. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Slider Revolution plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions in all versions up to, and including, 6.7.37. This makes it possible for authenticated attackers, with Contributor-level access and above, to install and activate plugin add-ons, create sliders, and download arbitrary files. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The TextBuilder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 1.0.0 to 1.1.1. This is due to missing or incorrect nonce validation on the 'handleToken' function. This makes it possible for unauthenticated attackers to update a user's authorization token via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Once the token is updated, an attacker can update the user's password and email address. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used to remove an attribute in post content, which can be abused to inject arbitrary HTML attributes, including JavaScript event handlers. This vulnerability allows a user with Contributor access or higher to create a post containing a malicious JavaScript payload. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The CTL Behance Importer Lite WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The AffiliateWP plugin for WordPress is vulnerable to SQL Injection via the ajax_get_affiliate_id_from_login function in all versions up to, and including, 2.28.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPress allows Stored XSS. WordPress core security team is aware of the issue and working on a fix. This is low severity vulnerability that requires an attacker to have Author or higher user privileges to execute the attack vector.This issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it. This issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Quiz Maker plugin for WordPress is vulnerable to SQL Injection via spoofed IP headers in all versions up to, and including, 6.7.0.56 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable in configurations where the server is set up to retrieve the IP from a user-supplied field like `X-Forwarded-For` and limit users by IP is enabled. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.

The Evenium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'evenium_single_event' shortcode in all versions up to, and including, 1.3.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do: Review the advisory, apply vendor guidance, and confirm your sites are not running an affected version.