CVE Vulnerability Catalog

The Tainacan plugin in versions up to and including 1.2.0 contains an SQL Injection vulnerability accessible to users with the Subscriber role. This allows injection of SQL code into database queries.

Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.

Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions.

The Calculated Fields Form plugin in versions up to and including 5.5.1.1 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script into the page.

The Core Web Vitals & PageSpeed Booster plugin in versions up to and including 1.0.31 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script into the page.

The Conekta Payment Gateway plugin in versions up to and including 6.2.4 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. The flaw involves improper access control on plugin functionality.

The WP User Frontend plugin in versions up to and including 4.3.11 contains an Arbitrary File Deletion vulnerability exploitable by a Subscriber-level user. The flaw stems from insufficient permission validation during file operations.

The WP User Frontend plugin in versions up to and including 4.3.11 contains a Bypass vulnerability exploitable by an unauthenticated attacker. The flaw allows bypassing the plugin's control mechanisms.

The WP User Frontend plugin in versions up to and including 4.3.11 contains a Bypass vulnerability exploitable by a Subscriber-level user. The flaw allows bypassing the plugin's control mechanisms.

The Easy Digital Downloads plugin in versions up to and including 3.7.0 contains an SQL Injection vulnerability accessible to users with the Shop manager role. This allows injection of malicious SQL code into database queries.

The Ninja Forms plugin in versions up to and including 3.15.3 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script into the page.

The Netgsm plugin in versions up to and including 2.10.0 contains a Bypass vulnerability exploitable by an unauthenticated attacker. The flaw allows bypassing the plugin's control mechanisms.

The Online Booking & Scheduling Calendar for WordPress by vcita plugin in versions up to and including 4.6.0 contains an unauthenticated Broken Access Control vulnerability. This allows access to functions or data that should be protected.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False positive detection.

The Podcast Importer SecondLine plugin in versions up to and including 1.5.6 contains a Cross Site Scripting (XSS) vulnerability exploitable by a Contributor-level user. The flaw allows injection of a malicious script.

The Post Grid plugin in versions up to and including 7.9.5 contains a Cross Site Scripting (XSS) vulnerability exploitable by a Contributor-level user. The flaw allows injection of a malicious script.

The Fluent Support plugin in versions up to and including 2.3.2 contains a Broken Access Control vulnerability exploitable by a Subscriber-level user. The flaw involves improper access control on plugin functionality.

The Post Grid plugin in versions up to and including 7.9.5 contains a Cross Site Scripting (XSS) vulnerability exploitable by a Contributor-level user. The flaw allows injection of a malicious script.

Cross Site Scripting (XSS) vulnerability in the ElementsKit Elementor addons Lite plugin in versions up to and including 4.0.5. The vulnerability can be exploited by a user with Contributor privileges.

Broken Access Control vulnerability in the AppMySite plugin in versions up to and including 3.15.4. The vulnerability can be exploited by an unauthenticated attacker.