Hung Nguyen

The HBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hb country iso', 'hb usa state iso', and 'hb canada province iso' parameters in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (the HBook Customers admin page).

**Name of the Vulnerable Software and Affected Versions** Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets versions prior to 4.2.3 **Description** Remote Code Execution is possible via the Display Logic feature. The issue arises because the plugin uses the `eval()` function on user-supplied Display Logic expressions with an insufficient blocklist/allowlist that can be bypassed using `array map` with string concatenation. Additionally, there is a lack of authorization enforcement on the `extended widget opts block` attribute. This allows authenticated attackers with Contributor-level access or higher to execute arbitrary code on the server. **Recommendations** Update to a version later than 4.2.2.

**Name of the Vulnerable Software and Affected Versions** Breeze Cache versions prior to 2.4.5 **Description** An arbitrary file upload flaw exists in the Breeze Cache plugin for WordPress, affecting approximately 400,000 active installations. The issue occurs within the `fetch gravatar from remote()` function due to missing file type validation and an incorrect regular expression that allows URLs to be extracted from the `alt` attribute of image tags instead of just the `src` attribute. Unauthenticated attackers can exploit this by manipulating the display name of a comment to include a malicious URL pointing to a PHP file. When processed, the plugin downloads and saves the file to the server, potentially allowing remote code execution through the upload of PHP backdoors. This is only exploitable if the "Host Files Locally - Gravatars" setting is enabled. Real-world exploitation began immediately upon disclosure on April 22, 2026, with over 30,000 attempts blocked by security firewalls. Attackers have been observed uploading self-deleting PHP droppers to create backdoors and rogue administrator accounts. **Recommendations** Update Breeze Cache to version 2.4.5 or later. As a temporary mitigation, disable the "Host Files Locally - Gravatars" setting.

**Name of the Vulnerable Software and Affected Versions** Download Monitor plugin for WordPress versions prior to 5.1.8 **Description** The software contains an Insecure Direct Object Reference issue in the `executePayment()` function. Missing validation on a user-controlled key allows unauthenticated attackers to complete arbitrary pending orders. This is possible due to a mismatch between the PayPal transaction `token` and the local `order id`, potentially enabling theft of paid digital goods by exploiting a payment token from a low-cost item to finalize a high-value order. **Recommendations** Update to Download Monitor plugin version 5.1.8 or later.

**Name of the Vulnerable Software and Affected Versions** The Ultimate WordPress Toolkit – WP Extended versions prior to 3.2.4 **Description** The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is susceptible to a privilege escalation issue. This is caused by an insecure `strpos()` check within the `isDashboardOrProfileRequest()` method against the `$ SERVER['REQUEST URI']` variable, used to determine if a request targets the dashboard or profile page. The `grantVirtualCaps()` function, which is connected to the `user has cap` filter, grants elevated capabilities, including `manage options`, when this check returns true. Authenticated attackers with Subscriber-level access or higher can exploit this by adding a crafted query parameter to any admin URL, enabling them to update arbitrary WordPress options and create new Administrator accounts. **Recommendations** Update 'The Ultimate WordPress Toolkit – WP Extended' to version 3.2.4 or later.

**Name of the Vulnerable Software and Affected Versions** Aimogen Pro versions up to 2.7.5 **Description** The Aimogen Pro plugin for WordPress is susceptible to an Arbitrary Function Call, potentially leading to privilege escalation. This is due to a missing capability check within the `aiomatic call ai function realtime` function. Unauthenticated attackers can exploit this to invoke arbitrary WordPress functions, such as `update option`, to modify site settings. Specifically, attackers can update the default user role for registration to administrator, enabling them to gain administrative access to a vulnerable site. The `update option` function allows modification of WordPress options, potentially impacting site security and functionality. **Recommendations** Aimogen Pro versions prior to 2.7.5 should be updated. As a temporary workaround, consider disabling the `aiomatic call ai function realtime` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Autoptimize versions prior to 3.1.15 **Description** The Autoptimize plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `ao post preload` meta value. This is a result of inadequate input sanitization within the `ao metabox save()` function and a lack of output escaping when the value is rendered into a `<link>` tag in `autoptimizeImages.php`. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses an injected page, provided the "Image optimization" or "Lazy-load images" setting is enabled in the plugin configuration. **Recommendations** Update Autoptimize to version 3.1.15 or later.

**Name of the Vulnerable Software and Affected Versions** WP Go Maps (formerly WP Google Maps) versions through 10.0.05 **Description** The WP Go Maps plugin for WordPress is susceptible to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. A missing capability check in the `admin post wpgmza save settings` hook anonymous function allows authenticated attackers with Subscriber-level access or higher to inject arbitrary web scripts into pages. These scripts will execute whenever a user accesses the injected page via the `wpgmza custom js` parameter. **Recommendations** Versions prior to 10.0.06 should be updated.

**Name of the Vulnerable Software and Affected Versions** LatePoint – Calendar Booking Plugin for Appointments and Events versions through 5.2.7 **Description** The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is susceptible to privilege escalation through a flaw in the password reset functionality. The issue stems from the plugin permitting users with a LatePoint Agent role, while creating new customers, to define the `wordpress user id` field. This allows authenticated attackers possessing Agent-level access or higher to obtain elevated privileges by associating a customer with an arbitrary user ID, potentially including administrators, and subsequently resetting the password. The `wordpress user id` field is used to link a customer to a WordPress user account. **Recommendations** Versions prior to 5.2.7 should be updated to address this issue.

**Name of the Vulnerable Software and Affected Versions** Post Duplicator plugin for WordPress versions up to and including 3.0.8 **Description** The Post Duplicator plugin for WordPress is susceptible to unauthorized modification of protected post meta data. This occurs because the `duplicate post()` function utilizes `$wpdb->insert()` directly into the `wp postmeta` table, bypassing the standard `add post meta()` function and its associated `is protected meta()` check. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary protected meta keys, such as ` wp page template` and ` wp attached file`, on duplicated posts. The issue is exploitable through the `customMetaData` JSON array parameter in the `/wp-json/post-duplicator/v1/duplicate-post` API endpoint. **Recommendations** Update the Post Duplicator plugin to a version later than 3.0.8.

**Name of the Vulnerable Software and Affected Versions** Product Table and List Builder for WooCommerce Lite versions prior to 4.6.3 **Description** The Product Table and List Builder for WooCommerce Lite plugin for WordPress is susceptible to time-based SQL Injection. This is due to inadequate escaping of user-supplied input in the `search` parameter and insufficient preparation of the existing SQL query. This allows unauthenticated attackers to inject additional SQL queries into existing queries, potentially extracting sensitive information from the database. **Recommendations** Update to version 4.6.3 or later.

**Name of the Vulnerable Software and Affected Versions** SiteOrigin Widgets Bundle versions prior to 1.70.5 **Description** The SiteOrigin Widgets Bundle plugin for WordPress is susceptible to unauthorized arbitrary shortcode execution. This is caused by a missing capability check within the `siteorigin widget preview widget action()` function, which is registered through the `wp ajax so widgets preview` AJAX action. The function verifies a nonce (`widgets action`) but does not confirm user capabilities, allowing authenticated attackers with Subscriber-level access or higher to execute arbitrary shortcodes. The necessary nonce is exposed on the public frontend when the Post Carousel widget is present on a page, embedded within the `data-ajax-url` HTML attribute. Attackers can invoke the `SiteOrigin Widget Editor Widget` via the preview endpoint to exploit this issue. **Recommendations** Update SiteOrigin Widgets Bundle to version 1.70.5 or later.

**Name of the Vulnerable Software and Affected Versions** The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress versions up to, and including, 2.2.68 **Description** The issue allows unauthenticated attackers to extract sensitive data, including full draft posts and password-protected posts, as well as the password for password-protected posts, via the `get posts` REST API Endpoint. **Recommendations** For versions up to, and including, 2.2.68, consider disabling the `get posts` REST API Endpoint as a temporary workaround until a patch is available. Restrict access to sensitive data to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Limit Login Attempts Reloaded plugin for WordPress versions up to, and including, 2.25.26 **Description** The issue is related to Stored Cross-Site Scripting via the plugin's shortcode(s) due to insufficient input sanitization and output escaping on user supplied attributes, such as `attributes` from users. This allows authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, potentially through `API Endpoints` like `/wp-admin/admin.php`. **Recommendations** For versions up to, and including, 2.25.26, update to a version higher than 2.25.26 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's shortcode(s) until a patch is available. Restrict permissions for contributor-level and above users to minimize the risk of exploitation.