CVE Vulnerability Catalog

The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress (versions up to and including 9.6.1.0) is vulnerable to privilege escalation. The maybe_update_user_role() function reads the target role directly from an attacker-controlled Gravity Forms entry field and passes it to WP_User::set_role() without validating against an allowlist of permitted roles. An authenticated attacker with Subscriber-level access can elevate privileges to administrator by tampering with the hidden role field at form submission. Exploitation is enabled by $0 orders being synchronously marked as SUCCESS without a real payment, and when no GF User Registration user can be resolved, the role assignment target falls back to $lead['created_by'] – the currently authenticated submitter's own user ID.

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress (versions up to and including 3.0.1) is vulnerable to unauthorized disclosure of private gallery contents. The Modula_Meta::add_metas() function is hooked to wp_head on every frontend request and looks up any post via get_post($_GET['modula_gallery_id']) without verifying the gallery's post_status or the requester's capability to read it. An unauthenticated attacker can enumerate private modula-gallery posts and their member attachments and recover the image's title, description, dimensions, and original upload URL via Open Graph/Twitter meta tags, allowing direct unauthenticated download of the original private image bytes.

The WPForms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page_title' POST parameter and {page_title} Smart Tag in all versions up to and including 2.0.2 due to insufficient input sanitization and output escaping. It is only exploitable on forms whose confirmation message places the {page_title} Smart Tag inside an HTML attribute context.

The Fancy Product Designer plugin for WordPress (versions up to and including 6.5.2) is vulnerable to stored cross-site scripting via the 'elements[].title' parameter in shortcode orders due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when a user visits an injected page. The injected payload is written to the DOM via innerHTML within the beforeElementAdd JavaScript event handler when processing the elements[].title field from the stored order JSON, meaning execution occurs specifically when an administrator reviews shortcode orders in the WordPress admin panel.

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress (versions up to and including 260814) is vulnerable to remote code execution via the 'first_name' parameter. This is due to insufficient sanitization of the first_name parameter via esc_refs(), which strips only regex backreferences and not PHP tags, before substitution into the eval'd Signup Tracking Codes template, combined with disclosure of the site-global proxy verification key that allows PayPal postback verification to be bypassed. An unauthenticated attacker can execute code on the server. Successful exploitation requires that the site administrator has configured a Signup Tracking Codes template containing the %%first_name%% placeholder (a documented, GUI-supported feature) and that the attacker has obtained the site-global proxy verification key, which is exposed in plaintext in the JSON response of any PayPal Checkout AJAX request on the target site.

The SSL Zen plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 4.7.42 via the 'file_name' parameter. This allows reading the contents of arbitrary files on the server.

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' and 'host' parameters in versions up to and including 4.7.42. The getMessages() function decodes base64 input and echoes raw HTML without escaping.

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress (versions up to and including 4.9.8) is vulnerable to local file inclusion via the 'page' parameter. An authenticated attacker with subscriber-level access or higher can include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

The WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shapes_values parameter in all versions up to and including 4.9.8 due to insufficient input sanitization and output escaping. The fc-call-nonce is exposed to all frontend visitors, and the secondary _wpnonce check can be bypassed by omitting the parameter.

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 1.4.0.5 via the 'page_url' parameter. It is only reachable when the dom_get_type setting is configured to 'wp_remote_post'.

Keycloak's mTLS holder-of-key binding ensures a token can only be used by the client that requested it by binding it to their certificate. The new Standard Token Exchange V2 feature does not check for this certificate, allowing an attacker with stolen client credentials to obtain a standard, unrestricted token.

The GeoDirectory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_hours' parameter in all versions up to and including 2.8.183 due to insufficient input sanitization and output escaping. The AJAX save handler validates only post authorship and a nonce with no additional capability check.

The BA Book Everything plugin for WordPress (versions up to and including 1.8.27) is vulnerable to stored cross-site scripting via the first_name parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when a user visits an injected page. An unauthenticated attacker can obtain the valid order_id, order_num, and order_hash credentials required to reach the vulnerable action_to_pay() handler simply by placing a guest booking through the public [babe-booking-form] shortcode, making the full exploit chain reachable without any account.

The Better Messages plugin for WordPress (versions up to and including 3.0.4) is vulnerable to Stored DOM-Based Cross-Site Scripting via User Display Name. Due to insufficient input sanitization and output escaping, an authenticated attacker with subscriber-level access can store a malicious script that executes whenever a user accesses the injected page.

The Better Messages plugin for WordPress (versions up to and including 3.0.4) is vulnerable to generic SQL Injection via the 'group_id' Message Meta Parameter. Due to insufficient escaping of user-supplied input, an authenticated attacker with subscriber-level access can append additional SQL queries to existing ones, enabling extraction of sensitive information from the database.

The GeoDirectory plugin for WordPress (versions up to and including 2.8.181) is vulnerable to Stored Cross-Site Scripting via a Text-type Custom Field (e.g., 'phone'). Due to insufficient input sanitization and output escaping, an authenticated attacker with subscriber-level access can inject malicious scripts that execute whenever a user accesses the injected page.

A vulnerability in the Ash library allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Arguments declared with public?: false should only be set by trusted server-side code, but the lack of a public? check on these paths enables modification from user input.

The Bookly plugin for WordPress (up to and including 28.2) is vulnerable to Insecure Direct Object Reference (IDOR) via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar', and 'bookly_rollback_order' AJAX actions. The 'bookly_get_form_id' handler stores an attacker-controlled 'order_id' into a new booking session, which 'bookly_render_complete' then trusts to return the order's secret token without verifying session ownership. This allows unauthenticated attackers to enumerate order IDs, disclose other customers' order tokens, retrieve calendar/appointment information, and permanently delete arbitrary non-completed bookings.

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin (versions up to and including 2.10.1) is vulnerable to stored DOM-based cross-site scripting via the 'form_data' Rich Text Field during Draft Save/Resume due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when a user visits an injected page. Exploitation requires tricking a user into clicking an attacker-supplied draft resume URL, which the attacker constructs using the draft_key and access_token returned directly in the save response.

The Blog2Social plugin for WordPress (versions up to and including 9.1.0) is vulnerable to authorization bypass. Due to improper verification of user authorization, an authenticated attacker with contributor-level access can view, modify, or delete other users' Blog2Social records, including disclosing network authentication IDs and scheduled post content.