Vulnerabilities

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or nonce verification. Attackers can force the plugin to use Basic HTTP authentication regardless of configured JWT or API token settings, then exploit distinguishable error codes and the absence of rate limiting to perform unthrottled username enumeration and credential guessing attacks.

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).

The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter.

The Design Scuole Italia WordPress theme, a theme purpose-built for Italian school websites, contains multiple missing-authorization flaws (CWE-862) in its dsi_pdf_generator and dsi_csv_generator functions, resulting in sensitive-information exposure (CWE-200). An unauthenticated remote attacker can invoke these PDF/CSV export functions directly to retrieve restricted 'Circolare' (school circular/notice) content and data belonging to registered users without any credentials. Exploitation is further eased by an unauthenticated RSS feed at /circolare/feed/, which makes restricted circular content trivially harvestable in bulk. The issue is rated CVSS 4.0 8.7 (high) because it is network-exploitable with no privileges, no user interaction, and high confidentiality impact. No public proof of concept is known, the flaw is not in CISA's KEV catalog, and no exploitation in the wild has been reported.

Do: Update the Design Scuole Italia theme to the latest available release as soon as a patched version is published, and verify with the maintainers which version fixes the dsi_pdf_generator/dsi_csv_generator flaws. Until then, block or require authentication for requests hitting the PDF/CSV generator endpoints and the /circolare/feed/ RSS feed (e.g., via a security plugin or web-server rules), and review access logs for unauthenticated access to these paths. Also audit whether restricted Circolare content or registered-user data has already been exported, and consider rotating user data if leaks are confirmed.

The Design Scuole Italia WordPress theme contains an unauthenticated path traversal flaw (CWE-22) in the reserved_file_check function of functions.php, rated 8.7 (high) under CVSS 4.0. A remote attacker with no credentials can send a crafted request with traversal sequences to a file-download endpoint handled by the theme, tricking it into serving files outside the intended directory. Successful exploitation discloses arbitrary files readable by the web server process, most critically wp-config.php, which contains database credentials, salts, and keys. Affected parties are WordPress sites — primarily Italian school websites — running an unpatched version of the theme; the advisory data does not specify an exact affected version range. No public proof of concept is known, the flaw is not in CISA's KEV catalog, and no exploitation has been observed.

Do: Update the Design Scuole Italia theme to the latest release from the official repository and confirm the reserved_file_check function in functions.php is patched. Inspect access logs for unauthenticated file-download requests containing dot-dot path traversal patterns or successful retrieval of sensitive files such as wp-config.php, /etc/passwd, or environment files. As defense-in-depth, block traversal sequences in download parameters via WAF rules, and rotate database credentials and authentication salts if any suspicious file access is found.

The MotoPress Hotel Booking plugin for WordPress contains a stored cross-site scripting flaw in the premium Stripe gateway's webhook listener (webhook-listener.php), affecting all versions up to and including 6.2.4. Because the plugin only verifies the Stripe webhook signature when an optional signing secret is configured — and that secret is empty by default — an unauthenticated attacker can send a forged webhook event (e.g., a fake 'refund.created') that is accepted without cryptographic verification. The attacker-controlled event object 'id' is then written unescaped into the payment log and executes as arbitrary JavaScript when an administrator views the payment in the WordPress dashboard. Exploitation requires knowledge of a valid Stripe PaymentIntent ID for an existing payment, which limits the attacker pool to those with some visibility into a site's transactions. The vulnerable handler exists only in the premium Stripe integration, not the lite plugin, and no public PoC or in-the-wild exploitation is currently known.

Do: Update MotoPress Hotel Booking to a version newer than 6.2.4 as soon as a patched release is available. Immediately configure the Stripe webhook signing secret in the plugin settings — this forces cryptographic verification of incoming webhooks and blocks forged events even on unpatched installs. Review payment log entries and admin-facing payment pages for unexpected or injected script content, and check Stripe dashboard webhook delivery logs for events that do not correspond to legitimate Stripe-originated transactions.

The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Consulting theme for WordPress, in versions up to and including 6.7.16, chains two flaws that let any authenticated user with subscriber-level access or above escalate to full administrator privileges. The unprotected masterstudy_ms_stm_set_discard_transient AJAX endpoint in admin/admin-notices/classes/STMHandler.php allows an attacker to set arbitrary transients without capability checks or nonce validation, so they can set stm_developer_access_token to a known value (1). Because the developer-access login mechanism in admin/classes/stm-theme-support.php trusts that transient for authentication when running in legacy string mode, visiting a specially crafted URL then logs the attacker in as any existing user, including administrators. Any site running the theme at or below 6.7.16 where an attacker can obtain even a low-privileged account (e.g., via open registration) is affected. No public PoC exists and no exploitation in the wild has been reported, though the attack is straightforward to reproduce for anyone with the technical details.

Do: Update to the latest Consulting theme release (any version newer than 6.7.16) as soon as the vendor ships a fix; until then, disable open user registration and audit existing low-privileged accounts. Check for unexpected stm_developer_access_token transient values and any newly created or modified administrator accounts, and consider a WAF rule blocking the masterstudy_ms_stm_set_discard_transient AJAX action and the developer-access login URL.

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to access and retrieve the transcribed contents of private audio attachments belonging to other users, including Administrators, via a supplied attachment ID. This vulnerability requires the Public API module to be enabled in the plugin settings; when disabled, the REST route is absent and the endpoint returns HTTP 404.

The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to privilege escalation in all versions up to and including 4.1.23. Its PermissionManager::manage_permissions() function, hooked to WordPress core's map_meta_cap filter, unconditionally returns the always-true 'exist' primitive for every capability check whenever the evaluated user ID is 1, without scoping this to plugin-specific capabilities. An authenticated attacker who controls the site's user ID 1 account — even one demoted to Subscriber, a common administrator-account hardening practice — can therefore pass every capability check, including manage_options, edit_plugins, edit_themes, promote_users, and update_core, gaining administrator-equivalent power, full site takeover, and remote code execution via the plugin and theme editors. On default installations where user ID 1 retains the administrator role, no incremental privilege gain occurs, which explains the High attack-complexity CVSS 3.1 score of 7.5. No public proof of concept is known and the flaw is not listed in CISA's KEV catalog, so exploitation is currently considered none known.

Do: Update Eventin to a version newer than 4.1.23 (the latest release) as soon as possible. If you use the 'demote user ID 1' hardening pattern, audit that account for signs of compromise and enforce a strong password plus two-factor authentication until patched. As a defense-in-depth measure against the plugin/theme editor RCE path, define DISALLOW_FILE_EDIT in wp-config.php.

The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'position_button' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users.

The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder (Editor and above) to perform SQL injection attacks that execute when the affected page is rendered.

The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users.

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data including the full metadata payload of password-protected flipbooks — including title, outline, props, and the serialized data blob containing the underlying PDF file's direct URL — bypassing WordPress post-password confidentiality. Flipbook post IDs can be pre-enumerated via the also-unauthenticated fb3d_send_posts AJAX action, requiring no prior knowledge to target specific flipbooks.

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profile_fields_user_email_value_prefix’ parameter in all versions up to, and including, 4.15.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks on a link.

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengine_product_title_header_size’ parameter in all versions up to, and including, 4.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.