## The Exploit An unauthenticated attacker can inject a stored XSS payload into a Rich-Text Textarea field; when a site administrator opens the submission in the Forminator Entries view and clicks a crafted link embedded in the stored data, the payload executes in the administra...
## The Exploit An authenticated user with subscriber-level access or higher can modify any plugin configuration setting—including business name, email, logo, GDPR settings, and payment options—by chaining two AJAX endpoints to forge a vali...
Read article →## The Exploit An authenticated user with Subscriber-level access can escalate to Administrator by appending a crafted query parameter to any WordPress admin URL, triggering a privilege check that unconditionally grants `manage_options` ca...
Read article →## The Exploit An authenticated user with *any* role can follow a restricted document and receive email notifications containing field values and table row changes they have no permission to read. ```http POST /api/resource/Document%20Fol...
Read article →## The Exploit An attacker whose document read permissions have been revoked or restricted can continue to receive email notifications containing the full document data and field-level changes by remaining in the Document Follow subscripti...
Read article →## The Exploit An authenticated user with Student-level access can escalate their privileges to Administrator by sending a single REST API request that modifies their own `roles` parameter. The plugin fails to validate that only admins sho...
Read article →## The Exploit An authenticated WordPress user with contributor-level permissions (or higher) can extract the full template data—including layouts, styles, and HTML—from any private or draft Elementor template by sending a single AJAX requ...
Read article →## The Exploit An attacker can craft a specially malformed UTF-16 encoded XML document containing low surrogate code points positioned at specific byte offsets to trigger an out-of-bounds read in libexpat's character conversion routines, c...
Read article →## The Exploit An unauthenticated attacker with network access to any WordPress site running W3 Total Cache ≤2.9.3 can leak the `W3TC_DYNAMIC_SECURITY` constant by sending a single GET request with a spoofed User-Agent header. Once leaked,...
Read article →## The Exploit An unauthenticated attacker can trigger reflected XSS on the WordPress login page by crafting a malicious login URL that, when visited by a victim, injects arbitrary JavaScript into the response. No session or authentication...
Read article →