CVE Vulnerability Catalog

The Groundhogg plugin for WordPress is vulnerable to SQL injection via the 'term' parameter in all versions up to and including 4.2.6.1 due to insufficient escaping and lack of preparation on the SQL query. This allows authenticated attackers with Administrator-level access and above to append additional SQL queries to extract sensitive information from the database.

The WP Delete Post Copies plugin for WordPress (all versions up to and including 6.0.2) is vulnerable to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. An authenticated attacker with administrator-level permissions or above can inject arbitrary web scripts into pages that execute whenever a user accesses the injected page; this only affects multi-site installations and installations where unfiltered_html has been disabled.

The Schedule Post Changes With PublishPress Future plugin for WordPress in versions up to and including 4.9.1 is vulnerable to unauthorized modification of data due to a missing authorization check on the saveFutureActionData function. An authenticated attacker with author-level access or higher can change the status of arbitrary posts and pages via the REST API endpoint.

The HT Mega – Absolute Addons For Elementor plugin for WordPress up to version 3.0.0 is vulnerable to Stored Cross-Site Scripting (XSS) in Gutenberg blocks. The vulnerability is due to insufficient input validation on user-supplied HTML tag names, allowing dangerous tags like 'script', 'iframe', and 'object' to be injected.

The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 2.0.5 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to retrieve the output of phpinfo().

The 简数采集器 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.6.3 via the __kds_flag functionality that imports featured images. This allows authenticated attackers with Administrator-level access and above to read the contents of arbitrary files on the server.

The WP Company Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the 'social-networks' shortcode in all versions up to, and including, 1.9.0. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an injected page.

The Shortcode for Google Street View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'streetview' shortcode in all versions up to, and including, 0.5.7. This is due to insufficient input sanitization and output escaping on the 'id' attribute, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts.

The WPSite Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'format' shortcode attribute in the wpsite_y shortcode and the 'before' attribute in the wpsite_postauthor shortcode in all versions up to and including 1.2. This is due to insufficient input sanitization and output escaping in error messages. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.

The Custom Post Type plugin for WordPress (all versions up to and including 1.0) is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce validation on the custom post type deletion functionality. This makes it possible for unauthenticated attackers to delete custom post types via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The HotelRunner Booking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hotelrunner' shortcode in all versions up to, and including, 5.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The AuthorSure plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.3. Missing nonce validation on the 'authorsure' page allows unauthenticated attackers to update settings and inject malicious scripts via a forged request if an admin clicks a link.

The Import WP – Export and Import CSV and XML files plugin for WordPress up to version 2.14.17 is vulnerable to sensitive information exposure due to a lack of .htaccess protection. Unauthenticated attackers can extract sensitive data from exports stored in /exportwp and import data stored in /importwp.

The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the wps_rma_fetch_order_msgs() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read other user's order messages.

The Pollcaster Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter in the 'pollcaster' shortcode in all versions up to and including 1.0. Insufficient input sanitization and output escaping allows authenticated attackers with contributor-level access to inject arbitrary web scripts.

The Padlet Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'key' parameter in the 'wallwisher' shortcode in all versions up to and including 1.3. Insufficient input sanitization and output escaping allows authenticated attackers with contributor-level access to inject arbitrary web scripts.

The Checkbox plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'wp_ajax_nopriv_checkbox_clean_log' AJAX endpoint in all versions up to and including 2.8.10. This allows unauthenticated attackers to clear log files.

The Return Refund and Exchange For WooCommerce plugin for WordPress up to version 4.5.5 is vulnerable to Insecure Direct Object Reference in the AJAX endpoint 'wps_rma_cancel_return_request' due to missing validation on a user controlled key. This makes it possible for authenticated attackers with Subscriber-level access and above to delete other users' refund requests.

The EchBay Admin Security plugin for WordPress (all versions up to and including 1.3.0) is vulnerable to reflected XSS via the '_ebnonce' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute if a user clicks a crafted link.

The UiPress lite plugin for WordPress (versions up to and including 3.5.08) lacks a capability check in the uip_save_site_option() function. An authenticated attacker with Subscriber-level access or above can change arbitrary plugin settings, and other AJAX actions are also affected.