## The Exploit An unauthenticated attacker can inject a stored XSS payload into a Rich-Text Textarea field; when a site administrator opens the submission in the Forminator Entries view and clicks a crafted link embedded in the stored data, the payload executes in the administra...
## The Exploit An authenticated subscriber (role: `subscriber` or higher) can extract the admin nonce token from the frontend and use it to forge AJAX requests that would otherwise require proper administrative permissions. Because the non...
Read article →## The Exploit An attacker with control over an OAuth2-linked account's login method can trick the logout handler into redirecting to an external OIDC provider's logout endpoint, even when the user signed in via password form instead of OA...
Read article →## The Exploit An unauthenticated attacker can trick a site administrator into clicking a malicious link that clears all ThirstyAffiliates connection data (site UUID, account email, secret token) without the administrator's knowledge or co...
Read article →## The Exploit **An authenticated user with Editor-level access can read arbitrary files on the server by injecting path traversal sequences into the `logFile` AJAX parameter.** ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target....
Read article →## The Exploit An authenticated WordPress user with contributor-level access or above can inject arbitrary JavaScript into a page by crafting a malicious block attribute. The stored payload executes in the browser of any user who visits th...
Read article →## The Exploit **Scenario:** An authenticated Shop Manager (or higher role) with a valid WordPress session. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: vulnerable-site.local Content-Type: application/x-www-form-urlencoded Cookie:...
Read article →## The Exploit **A Subscriber-level user can inject arbitrary JavaScript into form definitions by calling the AI Form Builder endpoint without proper capability verification, then trigger code execution when any visitor renders the generat...
Read article →## The Exploit An unauthenticated attacker can export the complete activity time database as CSV by issuing a single GET request to the plugin's export handler. ```http GET /wp-admin/admin-ajax.php?action=activity_time_csv_url&url_export=...
Read article →## The Exploit An authenticated subscriber-level user can delete arbitrary Zoom meetings or change their state by sending an AJAX request that bypasses the plugin's authorization layer. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host:...
Read article →