Aktuelle WordPress-Sicherheitslücken

The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitize_content() function only strips the 'target' attribute (the lines that would strip 'style' and 'on[a-z]+' event-handler attributes are commented out), and SyndicatedPost::insert_post() deliberately removes WordPress's wp_filter_kses and wp_filter_post_kses filters from content_save_pre before persisting imported feed items via wp_insert_post(). This makes it possible for unauthenticated attackers who control an external feed that a site has already subscribed to to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

FeedWordPress: Update to version 2026.1016, or a newer patched version

Prüfe die installierte Version und die Herstellerhinweise. Erstelle vor einem Update ein Backup und kontrolliere danach die Funktionen. Ist keine Fehlerbehebung verfügbar, prüfe eine vorübergehende Deaktivierung oder eine Alternative.

Originalmeldung bei Wordfence →

The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The route's permission callback only verifies a generic wp_rest nonce that the plugin itself emits inside the public acadlixOptions JavaScript object on every frontend page, effectively reducing the authentication requirement to unauthenticated.

Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress: Update to version 1.2.0, or a newer patched version

Prüfe die installierte Version und die Herstellerhinweise. Erstelle vor einem Update ein Backup und kontrolliere danach die Funktionen. Ist keine Fehlerbehebung verfügbar, prüfe eine vorübergehende Deaktivierung oder eine Alternative.

Originalmeldung bei Wordfence →

The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

WP Activity Log: Update to version 5.6.2, or a newer patched version

Prüfe die installierte Version und die Herstellerhinweise. Erstelle vor einem Update ein Backup und kontrolliere danach die Funktionen. Ist keine Fehlerbehebung verfügbar, prüfe eine vorübergehende Deaktivierung oder eine Alternative.

Originalmeldung bei Wordfence →

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name (maps to display_name)' parameter in all versions up to, and including, 4.17.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker's user account to have a mapped author term, which occurs when an administrator has assigned them as a co-author on content or has enabled automatic author term creation for their role — this mapping is not present by default for new users on a stock install.

Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors: Update to version 4.18.0, or a newer patched version

Prüfe die installierte Version und die Herstellerhinweise. Erstelle vor einem Update ein Backup und kontrolliere danach die Funktionen. Ist keine Fehlerbehebung verfügbar, prüfe eine vorübergehende Deaktivierung oder eine Alternative.

Originalmeldung bei Wordfence →

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'field_attr[required]' parameter in all versions up to, and including, 4.3.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The nonce check on the wpuf_get_child_cat AJAX action is not an effective security barrier because the wpuf_nonce value is publicly localized to every anonymous visitor of any page containing a WPUF shortcode, making it freely harvestable by an unauthenticated attacker.

User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission: Update to version 4.3.14, or a newer patched version

Prüfe die installierte Version und die Herstellerhinweise. Erstelle vor einem Update ein Backup und kontrolliere danach die Funktionen. Ist keine Fehlerbehebung verfügbar, prüfe eine vorübergehende Deaktivierung oder eine Alternative.

Originalmeldung bei Wordfence →

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the `post_content` parameter of the `submit_post()` function. The vulnerability exists because the protected-shortcode blocklist guard inspects the `sanitize_textarea_field()` copy of the submitted `post_content`, while the copy actually persisted to the database is processed through `wp_kses()`, whose `wp_kses_no_null()` step strips C0 control bytes — allowing an attacker to inject a single `\x01` byte inside the `[wpuf-registration]` tag name to defeat the `strpos()` blocklist check while the clean, functional shortcode is stored verbatim; `strip_shortcodes()` does not neutralize the stored shortcode either, because the Frontend container that registers it via `add_shortcode()` is only instantiated when `is_admin()` is false, and `admin-ajax` requests have `is_admin() === true`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a `[wpuf-registration role="editor"]` shortcode into a published post, causing a live Editor-role registration form to be rendered publicly on the frontend that any visitor — or the attacker themselves — can submit to mint a WordPress Editor account with an immediately active privileged session when the default `autologin_after_registration` setting is enabled.

User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission: Update to version 4.3.14, or a newer patched version

Prüfe die installierte Version und die Herstellerhinweise. Erstelle vor einem Update ein Backup und kontrolliere danach die Funktionen. Ist keine Fehlerbehebung verfügbar, prüfe eine vorübergehende Deaktivierung oder eine Alternative.

Originalmeldung bei Wordfence →