CVE Vulnerability Catalog

The Broken Link Checker plugin for WordPress in versions up to and including 2.4.14.1 is vulnerable to arbitrary shortcode execution because it does not properly validate a value before running do_shortcode. Unauthenticated attackers can execute arbitrary shortcodes if a submitted comment containing the payload in an href or src attribute is approved through the normal comment moderation workflow; once approved, the shortcode executes automatically via WP-Cron.

The Nexter Extension plugin for WordPress (versions up to and including 4.7.11) is vulnerable to privilege escalation. The /?reset-view handler in role_switcher_to_view_admin_as() performs no nonce or capability check, and the profile_update cleanup hook does not fire during bulk role changes via wp-admin/users.php?action=promote, leaving a stale 'administrator' value in user meta.

The Mail Mint plugin for WordPress in versions up to and including 1.31.4 is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint. Insufficient escaping of the user-supplied filter 'value' before it is appended to a SQL query in SegmentFilterService::get_meta_join_query() at line 797 — the value is string-interpolated into the WHERE fragment in a numeric (unquoted) context and the surrounding $wpdb->prepare() calls do not cover the injected value.

The NotificationX plugin for WordPress in versions up to and including 3.3.3 is vulnerable to Missing Authorization leading to arbitrary content injection. The /notificationx/v1/popup-submit REST route is registered with permission_callback => '__return_true', and the handler PopupNotification::handle_popup_submission() accepts an attacker-controlled nx_id, loads the referenced NotificationX campaign, and copies its source into the new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup.

The Klarna for WooCommerce plugin for WordPress (versions up to and including 4.13.3) is vulnerable to authorization bypass due to improper verification of user authorization. An unauthenticated attacker can access any order's secret order_key and full billing and shipping PII (name, email, phone, address, postcode, city, region, country) exposed inline as the klarna_payments_params JavaScript variable.

The Bulk Page Generator – LPagery plugin for WordPress in versions up to and including 3.1.0 is vulnerable to authorization bypass because it does not properly verify that a user is authorized to perform an action. An authenticated attacker with subscriber-level access and above can create, modify, and delete LPagery-managed pages and bulk page-generation processes otherwise restricted to administrators. On default fresh installations where Freemius has not been opted into, the AES-256-CBC key used to validate Bearer tokens collapses to the publicly known SHA-256 hash of an empty string, making the token entirely forgeable.

The Mang Board plugin for WordPress (versions up to and including 2.4.3) is vulnerable to stored Cross-Site Scripting (XSS) via the 'content' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The MailOptin plugin for WordPress (versions up to and including 1.2.78.6) is vulnerable to privilege escalation. The subscribe_to_email_list endpoint accepts the optin_data[form_custom_field_mappings] parameter without validation, allowing an attacker to override the administrator's mapping and pass arbitrary wp_users columns (including ID and user_pass) to wp_insert_user().

The Mang Board plugin for WordPress in versions up to and including 2.4.4 is vulnerable to Stored Cross-Site Scripting via the 'content' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access and above can inject arbitrary web scripts into pages that execute whenever a user accesses the injected page. The sanitization bypass is compounded by the ability to omit the data_type parameter in a modify request, skipping the HTMLPurifier branch entirely and leaving only mbw_htmlspecialchars2 encoding — fully reversed at render.

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress (versions up to and including 0.1.4.1) is vulnerable to privilege escalation. The plugin registers its admin page using a role name returned by InstaWP_Setting::get_allowed_role() as the required capability, and generate_section_field() renders the master API key as a plain-text HTML input without additional manage_options checks. An authenticated attacker with Subscriber-level access or above can read the plaintext master API key, use its SHA-256-derived secret as a bearer token in the plugin's REST API, and call POST /wp-json/instawp-connect/v2/auto-login to mint a 30-second single-use login URL that sets an administrator authentication cookie.

The Groundhogg plugin for WordPress (versions up to and including 4.9.3) is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function. An authenticated attacker with Sales Representative-level access or above can delete arbitrary files on the server, which can easily lead to remote code execution.

The Mang Board plugin for WordPress (versions up to and including 2.4.4) is vulnerable to arbitrary file upload via the mbw_file_upload function. Missing file extension validation on the image_path parameter allows unauthenticated attackers to upload executable files, enabling remote code execution.

The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress in versions up to and including 1.2.0 is vulnerable to Sensitive Information Exposure via the 'image_hub_api_keys_* (6 options)' parameter. An authenticated attacker with subscriber-level access and above can extract plaintext API credentials for six third-party services — Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash — emitted verbatim into every admin page's HTML via wp_localize_script. The leaked HTML also contains a valid image_hub_nonce AJAX nonce, which — combined with the absence of any capability check in the image_hub_update_settings AJAX handler — allows the same attacker to overwrite all six stored API credential options via update_option().

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress (versions up to and including 3.16.0.6) is vulnerable to authorization bypass due to improper verification of user authorization. An unauthenticated attacker can retrieve billing PII (full name, street address, email address, phone number) for any WooCommerce order by submitting an enumerable sequential order ID.

The Modula Image Gallery plugin for WordPress (versions up to and including 3.0.11) is vulnerable to sensitive information exposure via the 'id' parameter in /wp-json/wp/v2/modula-gallery/{id}. An unauthenticated attacker can extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field.

The My Calendar – Accessible Event Manager plugin for WordPress (versions up to and including 3.8.7) is vulnerable to privilege escalation. The mcs parameter is reflected unsanitized, allowing an unauthenticated attacker to inject a nested [my_calendar above=...] shortcode, which then calls arbitrary PHP functions via call_user_func(), including edit_user(), leading to administrator account takeover.

The Forminator Forms plugin for WordPress (versions up to and including 1.58.1) allows unauthenticated attackers to execute arbitrary shortcodes because a value passed to do_shortcode is not properly validated. Exploitation is possible on any block-theme install via a single unauthenticated GET request to the search results page or by submitting an anonymous comment, with no Forminator-specific content required.

The miniOrange OTP Login plugin for WordPress (versions up to and including 5.5.8) is vulnerable to authentication bypass via the mo_by_pass_login() function. The mo_delay_otp_process() short-circuits the authentication flow before password validation, and the Delay OTP grace flag is stored in user meta without binding to the session, allowing an unauthenticated attacker to log in as any user, including administrators.

The FluentCart plugin for WordPress (versions up to and including 1.7.0) is vulnerable to Insecure Direct Object Reference (IDOR) via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user-controlled key. An unauthenticated attacker can read and exfiltrate another customer's stored billing and shipping address PII, including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID.

The Gwolle Guestbook plugin for WordPress (versions up to and including 5.1.1) is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute if a user is tricked into clicking a crafted link.