WordPress plugin vulnerabilities

The miniOrange Social Login and Register WordPress plugin before 7.8.0 does not bind the one-time code used for optional email verification to the account it was issued for. This allows an unauthenticated attacker to obtain a valid session for any account, including administrators, by requesting a code for a controlled email and replaying it against the victim's email.

The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions. This allows an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in stored Cross-Site Scripting (XSS).

The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler. This allows an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.

The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption written into the page DOM without escaping. An authenticated user with Author-level access can store a JavaScript payload that executes in any visitor's browser, including an administrator, who clicks the link.

The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints. This allows unauthenticated users to retrieve information about non-published WooCommerce products (e.g., draft, pending, or private).