## The Exploit An unauthenticated attacker can perform SQL injection via the `author__not_in` parameter in any REST API endpoint that passes user input to `WP_Query`. The following curl request demonstrates the injection against the default `/wp/v2/posts` endpoint. ```bash curl...
## The Exploit **An unauthenticated attacker submits a malicious radio or checkboxgroup value through the WooCommerce Block Checkout Store API; when an administrator later views the order details page, the payload executes in their browser...
Read article →## The Exploit An unauthenticated attacker can inject arbitrary JavaScript into the Post SMTP email log by crafting a malicious email with a crafted `from` or `subject` header. When any WordPress user accesses the email log page, the store...
Read article →## The Exploit An unauthenticated attacker can inject arbitrary JavaScript into the donor wall shortcode by crafting a donation with a malicious `name` field. The payload executes in the browser of any visitor who views the page, provided ...
Read article →## The Exploit An unauthenticated attacker can inject arbitrary JavaScript into WP Statistics analytics pages by poisoning the User-Agent HTTP header with a malicious payload. The stored XSS fires whenever a logged-in user visits the analy...
Read article →## The Exploit An unauthenticated attacker can inject arbitrary JavaScript into WooCommerce email designer preview pages by crafting a malicious customer name during checkout. The payload is stored in the WooCommerce order object and execu...
Read article →## The Exploit An unauthenticated attacker can inject a malicious script into the `utm_source` parameter; on the next admin page load of the Referrals Overview or Social Media analytics, the payload executes in the administrator's browser ...
Read article →## The Exploit An unauthenticated attacker can inject arbitrary JavaScript into a Google Review via the plugin's review ingestion mechanism. When any visitor loads a page displaying the poisoned review, the payload executes in their browse...
Read article →## The Exploit An unauthenticated attacker can upload arbitrary JSON files to a vulnerable Redux Framework installation without any authentication or capability checks. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target.local Con...
Read article →## The Exploit An unauthenticated attacker can store a malicious JavaScript payload in a Ninja Forms calculation field, which will execute in the browser of any WordPress admin (or user viewing the form debug output) who accesses the affec...
Read article →