CVE Vulnerability Advisory Database

[Affected Scope] WordPress Ninja Forms plugin versions up to, and including, 3.15.5

[Impact] Unauthenticated attackers can inject malicious scripts via a single request, potentially leading to administrator session hijacking and site takeover

[Mitigation] Immediately update the Ninja Forms plugin to the latest secure version (3.15.6 or higher)

[Affected Scope] Ninja Forms WordPress plugin versions up to, and including, 3.15.5

[Impact] Authenticated attackers with subscriber-level access can execute arbitrary shortcodes and potentially access sensitive data by manipulating their profile display name

[Mitigation] Immediately update the Ninja Forms plugin to the latest version (3.15.6 or higher) and review default field configurations

[Affected Scope] Ninja Forms WordPress plugin versions up to, and including, 3.15.5

[Impact] Unauthenticated attackers can execute arbitrary WordPress shortcodes, potentially leading to sensitive information disclosure or further exploitation

[Mitigation] Immediately update the Ninja Forms plugin to the latest secure version (3.15.6 or higher)

[Affected Scope] YITH WooCommerce Product Add-Ons plugin versions 4.34.0 and below.

[Impact] Unauthenticated attackers can bypass authorization checks by manipulating user-controlled keys to modify data.

[Mitigation] Immediately update the plugin to version 4.35.0 or later.

[Affected Scope] Ad Inserter WordPress plugin versions 2.8.19 and below

[Impact] Unauthenticated remote attackers can inject malicious scripts to hijack admin sessions, deface websites, or conduct phishing attacks

[Mitigation] Immediately update the plugin to version 2.8.20 or later

[Affected Scope] Booktics WordPress plugin versions up to 1.0.31.

[Impact] Authenticated users with low privileges can access unauthorized data or functions due to broken access control.

[Mitigation] Update to the latest version (1.0.32 or higher) immediately.