CVE Vulnerability Catalog

The WPConsent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms allows Object Injection. This issue affects Gravity Forms: from n/a before 3.1.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez allows Reflected XSS. This issue affects Houzez: from n/a through 4.4.0.

The YaySMTP plugin for WordPress (versions up to and including 2.7.7) is vulnerable to arbitrary file upload via the putFile function. Insufficient file type validation allows an authenticated subscriber-level user to upload an executable file, leading to remote code execution (RCE). The .htaccess protection is ignored by nginx and Apache with AllowOverride None.

The WP Photo Album Plus plugin for WordPress (versions up to and including 9.3.02.002) is vulnerable to command injection via the 'value' parameter in the 'update-photo' AJAX action. Insufficient shell escaping in the wppa_image_magick_a() function allows an authenticated user with the wppa_upload capability to execute arbitrary OS commands as the web server user. ImageMagick must be enabled.

The CP Multi View Events Calendar plugin for WordPress (versions up to and including 1.4.42) is vulnerable to stored cross-site scripting via the 'CalendarTitle' parameter. Insufficient input sanitization and output escaping allows an unauthenticated attacker to inject arbitrary web scripts that execute when a user visits the injected page. This requires the 'Allow edition in frontend?' option to be enabled.

The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.

The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.

The HivePress plugin for WordPress (versions up to and including 1.7.32) is vulnerable to stored cross-site scripting via the '<custom user attribute slug>' parameter (e.g., hp_custom_link). Insufficient input sanitization and output escaping allows an unauthenticated attacker to inject arbitrary web scripts that execute when a user visits the injected page. Exploitation requires a custom user attribute configured with a display_format template placing %value% inside an href, src, or style attribute context.

The TranslatePress plugin for WordPress (versions up to and including 3.3.7) is vulnerable to stored cross-site scripting via the 'comment' parameter. Insufficient input sanitization and output escaping allows an unauthenticated attacker to inject arbitrary web scripts that execute when a user visits the injected page. Exploitation requires unmoderated comment submission and a secondary language configured.

A flaw in cifs-utils allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a CIFS share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. An attacker can inject unauthorized mount options, bypassing permission checks and executing files with root privileges.

The Schema & Structured Data for WP & AMP plugin (versions up to and including 1.67) is vulnerable to stored cross-site scripting via the 'saswp_review_text' parameter. Insufficient input sanitization and output escaping allows an unauthenticated attacker to inject arbitrary web scripts that execute when a user visits the injected page. The nonce, the only authorization gate, is publicly printed in the shortcode HTML, making it ineffective.

The Opti-Behavior plugin for WordPress (versions up to and including 1.9.2.1) is vulnerable to stored DOM-based cross-site scripting via the 'country_name' location parameter. Insufficient input sanitization and output escaping allows an unauthenticated attacker to inject arbitrary web scripts that execute when a user visits the injected page. The heatmap recording endpoint accepts unauthenticated requests protected only by a nonce that any visitor can freely obtain.

The Opti-Behavior plugin for WordPress (versions up to and including 1.9.2.1) is vulnerable to stored DOM-based cross-site scripting via the 'targetUrl' parameter. Insufficient input sanitization and output escaping allows an unauthenticated attacker to inject arbitrary web scripts that execute when a user visits the injected page. The ingest endpoint is gated only by a nonce that is publicly emitted to every anonymous visitor.

The WP Ghost (Hide My WP Ghost) plugin for WordPress (versions up to and including 7.0.12) is vulnerable to stored cross-site scripting via the 'replaceHeadersAndTags' function. Insufficient input sanitization and output escaping allows an unauthenticated attacker to inject arbitrary web scripts that execute when a user clicks on the injected link.

The PilotPress plugin for WordPress (versions up to and including 2.0.43) is vulnerable to privilege escalation via account takeover. The update_cc_details() AJAX handler forwards an attacker-supplied username to ONTRAPORT before the local username_exists() collision check, and aborts without rolling back the remote rename when a collision is detected, allowing an authenticated Subscriber-level attacker to take over an Administrator account.

The SiteOrigin CSS plugin for WordPress (versions up to and including 1.6.7) is vulnerable to stored DOM-based Cross-Site Scripting via the 'href' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The NotificationX plugin for WordPress (versions up to and including 3.3.3) is vulnerable to stored Cross-Site Scripting via the 'name' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The User Profile Builder plugin for WordPress (versions up to and including 4.0.3) is vulnerable to privilege escalation via the 'role' parameter handled by the wppb_add_meta_to_user_on_activation() function. An unauthenticated attacker can gain a fully activated WordPress administrator account by submitting role=administrator through the public registration form and clicking the confirmation activation link.

The Salon Booking System plugin for WordPress (versions up to and including 10.31.9) is vulnerable to stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.