CVE Vulnerability Advisory Database

[Affected Scope] WordPress Core versions 4.7 through 7.1.3

[Impact] Unauthenticated attackers can execute arbitrary code on the server by exploiting predictable staging paths during the core upgrade process

[Mitigation] Immediately upgrade to WordPress 7.1.4 or later and restrict web access to the upgrade staging directories

[Affected Scope] Payment Forms for Paystack WordPress plugin versions before 4.0.6

[Impact] Users with Contributor role and above can view sensitive live and test Paystack API secret keys, granting full access to the site owner's payment account

[Mitigation] Immediately update the plugin to version 4.0.6 or higher and rotate all potentially exposed API secret keys

[Affected Scope] WordPress Ninja Forms plugin versions up to, and including, 3.15.5

[Impact] Unauthenticated attackers can inject malicious scripts via a single request, potentially leading to administrator session hijacking and site takeover

[Mitigation] Immediately update the Ninja Forms plugin to the latest secure version (3.15.6 or higher)

[Affected Scope] All versions of Meow Lightbox plugin for WordPress up to, and including, 5.6.4

[Impact] Unauthenticated attackers can inject arbitrary web scripts via the 'post_content' parameter, executing malicious JavaScript in the context of any user viewing the affected page under specific configurations

[Mitigation] Immediately update the Meow Lightbox plugin to the latest secure version (5.6.5 or higher) and apply temporary configuration workarounds if patching is delayed

[Affected Scope] Ninja Forms WordPress plugin versions up to, and including, 3.15.5

[Impact] Authenticated attackers with subscriber-level access can execute arbitrary shortcodes and potentially access sensitive data by manipulating their profile display name

[Mitigation] Immediately update the Ninja Forms plugin to the latest version (3.15.6 or higher) and review default field configurations

[Affected Scope] Ninja Forms WordPress plugin versions up to, and including, 3.15.5

[Impact] Unauthenticated attackers can execute arbitrary WordPress shortcodes, potentially leading to sensitive information disclosure or further exploitation

[Mitigation] Immediately update the Ninja Forms plugin to the latest secure version (3.15.6 or higher)

[Affected Scope] YITH WooCommerce Product Add-Ons plugin versions 4.34.0 and below.

[Impact] Unauthenticated attackers can bypass authorization checks by manipulating user-controlled keys to modify data.

[Mitigation] Immediately update the plugin to version 4.35.0 or later.

[Affected Scope] Ad Inserter WordPress plugin versions 2.8.19 and below

[Impact] Unauthenticated remote attackers can inject malicious scripts to hijack admin sessions, deface websites, or conduct phishing attacks

[Mitigation] Immediately update the plugin to version 2.8.20 or later

[Affected Scope] Booktics WordPress plugin versions up to 1.0.31.

[Impact] Authenticated users with low privileges can access unauthorized data or functions due to broken access control.

[Mitigation] Update to the latest version (1.0.32 or higher) immediately.