CVE Vulnerability Catalog

The SiteOrigin CSS plugin for WordPress (versions up to and including 1.6.7) is vulnerable to stored DOM-based Cross-Site Scripting via the 'url (comment_author_url)' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The Search Regex plugin for WordPress version 3.5 is vulnerable to PHP Object Injection via deserialization of untrusted input in the replace_all function. An authenticated attacker with subscriber-level access or higher can inject a PHP Object, and the presence of a POP chain allows code execution.

The Simply Schedule Appointments plugin for WordPress (versions up to and including 1.6.12.35) is vulnerable to stored Cross-Site Scripting via the 'status' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The Ultra Addons for Contact Form 7 plugin for WordPress (versions up to and including 3.5.54) is vulnerable to stored Cross-Site Scripting via File Upload due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The 10Web Booster plugin for WordPress (versions up to and including 2.34.5) is vulnerable to limited file write via path traversal. An unauthenticated attacker can create arbitrary directories outside the cache root and write cached pages into them, leading to cache poisoning and arbitrary directory creation.

The User Profile Builder plugin for WordPress (versions up to and including 4.0.3) is vulnerable to Stored Cross-Site Scripting via the First Name field due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. This vulnerability is only exploitable when the Email Confirmation feature is enabled in Profile Builder.

The Nexter Extension plugin for WordPress (versions up to and including 4.7.11) is vulnerable to privilege escalation. The /?reset-view handler in role_switcher_to_view_admin_as() performs no nonce or capability check, and the profile_update cleanup hook does not fire during bulk role changes via wp-admin/users.php?action=promote, leaving a stale 'administrator' value in user meta.

The Klarna for WooCommerce plugin for WordPress (versions up to and including 4.13.3) is vulnerable to authorization bypass due to improper verification of user authorization. An unauthenticated attacker can access any order's secret order_key and full billing and shipping PII (name, email, phone, address, postcode, city, region, country) exposed inline as the klarna_payments_params JavaScript variable.

The Mang Board plugin for WordPress (versions up to and including 2.4.3) is vulnerable to stored Cross-Site Scripting (XSS) via the 'content' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress (versions up to and including 0.1.4.1) is vulnerable to privilege escalation. The plugin registers its admin page using a role name returned by InstaWP_Setting::get_allowed_role() as the required capability, and generate_section_field() renders the master API key as a plain-text HTML input without additional manage_options checks. An authenticated attacker with Subscriber-level access or above can read the plaintext master API key, use its SHA-256-derived secret as a bearer token in the plugin's REST API, and call POST /wp-json/instawp-connect/v2/auto-login to mint a 30-second single-use login URL that sets an administrator authentication cookie.

The Groundhogg plugin for WordPress (versions up to and including 4.9.3) is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function. An authenticated attacker with Sales Representative-level access or above can delete arbitrary files on the server, which can easily lead to remote code execution.

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress (versions up to and including 3.16.0.6) is vulnerable to authorization bypass due to improper verification of user authorization. An unauthenticated attacker can retrieve billing PII (full name, street address, email address, phone number) for any WooCommerce order by submitting an enumerable sequential order ID.

The Modula Image Gallery plugin for WordPress (versions up to and including 3.0.11) is vulnerable to sensitive information exposure via the 'id' parameter in /wp-json/wp/v2/modula-gallery/{id}. An unauthenticated attacker can extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field.

The miniOrange OTP Login plugin for WordPress (versions up to and including 5.5.8) is vulnerable to authentication bypass via the mo_by_pass_login() function. The mo_delay_otp_process() short-circuits the authentication flow before password validation, and the Delay OTP grace flag is stored in user meta without binding to the session, allowing an unauthenticated attacker to log in as any user, including administrators.

The FluentCart plugin for WordPress (versions up to and including 1.7.0) is vulnerable to Insecure Direct Object Reference (IDOR) via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user-controlled key. An unauthenticated attacker can read and exfiltrate another customer's stored billing and shipping address PII, including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID.

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (versions up to and including 7.5.5) is vulnerable to stored Cross-Site Scripting (XSS) via comment content and the yotu-wp Cookie-Blocker filter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The Backuply plugin for WordPress (versions up to and including 1.5.8) is vulnerable to second-order SQL injection via the 'Biographical Info' field. The value is exported verbatim into the backup's SQL dump, and when the backup is later restored, a crafted payload can execute arbitrary SQL with full database privileges.

Wheels CLI versions 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. This can lead to shell command execution on deploy hosts and the CI runner, deletion of unintended files, overwriting other vendor files, writing outside the project, injection of executable CFML, stored XSS, and termination of an unrelated process.

Wheels versions 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without verifying they belong to the parent being saved. A user can update, reassign, or delete another parent's hasMany or hasOne rows, and edit nested belongsTo records by posting another associated record's key.

Wheels versions 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true (default in development). In 4.1.2 the local-access restriction trusts client-supplied headers without checking the connecting peer.