The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required nonce (getpaidformnonce) is publicly emitted to all visitors via wplocalizescript as WPInv.formNonce, meaning no authentication or prior nonce leak is needed; the stored payload fires when an administrator views the affected invoice's Payment Form Details metabox.

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also function, plugin, posttype, poststatus, ids, loggedout, and POST posttitle)' parameter in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.

The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.

The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.

The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin records in its statistics table: the newstatpressgenerateoverviewlastreferrers() function concatenates the stored urlrequested value into a single-quoted href attribute after only FILTERSANITIZEURL, which does not encode the apostrophe. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a high-privileged user, such as an administrator, accesses the Overview page and hovers the injected link.

The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the maybeaddroletouser() function unconditionally re-assigning every role stored in the dfxwcrcforeignroles user meta cache without verifying that each cached role is still actively assigned by the external provider — a condition made permanent by rememberforeignroles(), which merges new foreign roles into the cache but never evicts roles that have since been revoked. This makes it possible for authenticated attackers with subscriber-level access and above to restore a previously revoked Administrator role to their own account, gaining full administrative control of the site, by triggering any role-assignment event such as completing a purchase for a role-mapped product. Exploitation requires Replace Roles mode to be enabled and the attacker's account to have previously received Administrator legitimately through a separate role-management mechanism while the plugin was active, so that administrator was written into the dfxwcrcforeignroles user meta cache before the external provider revoked it.

The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.

The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector WordPress plugin through 1.4's settings page or when a visitor loads a page displaying its output.

The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators.

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors.

Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.

Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.

Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.

Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.

Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.

Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.

Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions.

Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.

Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions.

Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.

Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions.

Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.

Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions.

Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions.

Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions.

Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.