CVE Vulnerability Catalog

The Easy Theme Options plugin for WordPress (all versions up to and including 1.0) is vulnerable to Missing Authorization due to missing authorization checks in the eto_import_settings function. This allows authenticated attackers with Subscriber-level access and above to import arbitrary plugin settings via the 'eto_import_settings' parameter.

The Eyewear prescription form plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 6.0.1. This is due to missing authorization checks on the SubmitCatProductRequest AJAX action, allowing unauthenticated attackers to create arbitrary WooCommerce products with custom names, prices, and category assignments via the 'Name', 'Price', and 'Parent' parameters.

The Eyewear prescription form plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 6.0.1. This is due to missing capability checks on the RemoveItems AJAX action, allowing unauthenticated attackers to delete arbitrary WooCommerce product categories, including all child categories, via the 'catIds' parameter.

The Gallery Blocks with Lightbox plugin for WordPress in versions up to and including 3.3.0 allows authenticated users with Contributor-level access and above to modify plugin settings. This is due to the plugin using the `edit_posts` capability check instead of `manage_options` in the `pgc_sgb_action_wizard` AJAX handler. This makes it possible to modify arbitrary plugin settings prefixed with `pgc_sgb_*`.

The HT Slider for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slide_title' parameter in all versions up to and including 1.7.4 due to insufficient input sanitization and output escaping in JavaScript.

The Custom Post Type UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'label' parameter during custom post type import in all versions up to and including 1.18.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Administrator-level access to inject arbitrary web scripts that execute when a user accesses the Tools → Get Code page.

The Design Import/Export plugin for WordPress up to version 2.2 is vulnerable to SQL Injection via XML File Import due to insufficient escaping and lack of query preparation. Authenticated attackers with administrator access can append additional SQL queries and extract sensitive information from the database.

The Custom Frames plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter of the 'customframe' shortcode in all versions up to and including 1.0.1 due to insufficient input sanitization and output escaping.

The Employee Spotlight – Team Member Showcase & Meet the Team plugin for WordPress in versions up to and including 5.1.3 is vulnerable to unauthorized tracking settings modification due to missing authorization validation in the `employee_spotlight_check_optin()` function. This allows authenticated attackers with Subscriber-level access and above to enable or disable tracking settings.

The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint in all versions up to and including 1.1.8. This allows unauthenticated attackers to update leads tags.

The Devs CRM plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the /wp-json/devs-crm/v1/attendances REST API endpoint in all versions up to and including 1.1.8. This allows unauthenticated attackers to retrieve private user data, including password hashes.

The GenerateBlocks plugin for WordPress in versions up to and including 2.1.2 is vulnerable to information exposure due to missing object-level authorization checks. It registers multiple REST API routes under generateblocks/v1/meta/ that gate access with current_user_can('edit_posts'), which is granted to low-privileged roles such as Contributor. The handlers accept arbitrary entity IDs (user IDs, post IDs, etc.) and meta keys, returning any requested metadata with only a short blacklist of password-like keys for protection. There is no object-level authorization ensuring the caller is requesting only their own data, and no allowlist of safe keys. This allows authenticated attackers with Contributor-level access and above to exfiltrate personally identifiable information (PII) and other sensitive profile data of administrator accounts or any other users by directly querying user meta keys via the exposed endpoints via the get_user_meta_rest function. In typical WordPress + WooCommerce setups, this includes names, email, phone, and address fields that WooCommerce stores in user meta, enabling targeted phishing, account takeover pretexting, and privacy breaches.

The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.9.7. This is due to the plugin not properly verifying that a user is authorized to perform an action, allowing unauthenticated attackers to approve withdrawal requests, modify user point balances, and manipulate the payment processing system via the cashcred_pay_now AJAX action.

The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the script adder present in posts. This is due to insufficient input sanitization and output escaping. It affects all versions up to and including 2.0.5.

The WP to LinkedIn Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the PostMessage parameter in all versions up to and including 1.9.8. This is due to insufficient input sanitization and output escaping. It allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into performing an action such as clicking a link.

The Social Media Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the PostMessage parameter in all versions up to and including 3.6.5. This is due to insufficient input sanitization and output escaping. It allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into performing an action such as clicking a link.

The Emplibot plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 1.0.9 via specific functions. This allows authenticated attackers with Administrator-level access to make requests to arbitrary locations and potentially access internal services.

The Login Lockdown & Protection plugin for WordPress up to version 2.14 has an IP block bypass vulnerability. The unblock key is insufficiently random, allowing unauthenticated users with access to an admin email to generate valid keys and bypass blocks.

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'colibri_loop' shortcode in all versions up to and including 1.0.335 due to insufficient input sanitization and output escaping on user supplied attributes.

The Mavix Education theme for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the 'mavix_education_activate_plugin' AJAX action in all versions up to 1.0. This allows authenticated attackers with Subscriber-level access to activate the Creativ Demo Importer plugin.