CVE Vulnerability Catalog

The My Sticky Elements WordPress plugin (Premio) up to and including version 2.3.3 has a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels.

The Product Loops for WooCommerce WordPress plugin (XforWooCommerce) up to and including version 2.1.2 has a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels.

The Share, Print and PDF Products for WooCommerce WordPress plugin (XforWooCommerce) up to and including version 3.1.2 has a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xenioushk BWL Knowledge Base Manager bwl-kb-manager allows Stored XSS.This issue affects BWL Knowledge Base Manager: from n/a through <= 1.6.3.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xenioushk BWL Pro Voting Manager bwl-pro-voting-manager allows DOM-Based XSS.This issue affects BWL Pro Voting Manager: from n/a through <= 1.4.9.

The Contact Form 7 Mailchimp Extension for WordPress contains a sensitive information insertion vulnerability that allows retrieving embedded sensitive data. The issue affects versions up to and including 0.9.68.

The E-Invoice App Malaysia (einvoiceapp-malaysia) in versions up to and including 1.3.0 contains an exposure of sensitive system information to an unauthorized control sphere vulnerability. This allows retrieval of embedded sensitive data.

The DesignThemes LMS Addon for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 2.6.

The HomeFix Elementor Portfolio plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.0.1.

The WeDesignTech Portfolio plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.0.2.

Authorization Bypass Through User-Controlled Key vulnerability in SimpleCalendar Google Calendar Events google-calendar-events allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Google Calendar Events: from n/a through <= 3.5.9.

DOM-Based XSS vulnerability in DesignThemes Core (up to version 1.6) allows an attacker to manipulate the DOM in the victim's browser, potentially leading to malicious code execution.

DOM-Based XSS vulnerability in DesignThemes Portfolio Addon (up to 1.5) due to improper input neutralization during web page generation.

The Eagle Booking plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.3.4.3.

The Eagle Booking plugin (eagle-booking) in versions up to and including 1.3.4.3 contains an authorization bypass through user-controlled key vulnerability. This allows exploitation of incorrectly configured access control security levels.

The WordPress plugin 'Social Login and Register' by miniOrange up to version 7.7.0 has a PHP Local File Inclusion vulnerability, which could allow reading sensitive files on the server.

ISOinsight developed by NetVision Information has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.

A vulnerability has been found in Tenda CH22 up to 1.0.0.1. Affected is the function fromDhcpListClient of the file /goform/DhcpListClient. Manipulation of the argument LISTLEN leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public.

A vulnerability has been found in Dromara Sa-Token up to 1.44.0. This issue affects the function ObjectInputStream.readObject of the file SaSerializerTemplateForJdkUseBase64.java. Such manipulation leads to deserialization. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early but did not respond.

The Advance WP Query Search Filter WordPress plugin through version 1.0.10 does not sanitize and escape a parameter before outputting it back in the page, leading to Reflected Cross-Site Scripting. This can be exploited against high-privilege users such as administrators.