CVE Vulnerability Catalog

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read. This allows users with contributor-level access and above to retrieve other authors' private, draft and trashed events, together with event detail the standard listing does not show them.

The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page. Authenticated users with the Author role and above can perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a page embedding the form, including logged-out visitors and administrators.

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's plugin-specific settings targets the requesting user's own account. Any authenticated user with subscriber-level access and above can create or overwrite the plugin's per-user settings on arbitrary users, including administrators.

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query. Authenticated users with Author-level access and above can perform SQL injection attacks by importing a feed they control.

The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler. Unauthenticated users can read the description of password-protected products.

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user. This allows someone who holds another member's in-flight payment identifier to delete that member's checkout state.

The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature. Unauthenticated users can disclose the email addresses of a shared board's members, typically including administrators.

The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box. Users with contributor-level access and above can inject arbitrary JavaScript that executes in the session of a higher-privileged user who reviews the affected post.

The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users. They can read the title, description and price of draft, pending and private products.

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration. Users with contributor-level access can delete, wipe, or modify that configuration, including the stored payment credentials.

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook. Unauthenticated attackers can write a card-token record to any user's account and enumerate registered accounts.

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request. This allows unauthenticated visitors to make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the plugin itself and can be replayed without limit.

The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, which happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions, can rewrite the saved field configuration of any form, including a live payment form.

The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several authenticated flipbook management actions. This allows users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be leveraged to store JavaScript that executes in the context of any visitor or administrator viewing the site.

The Social Commerce for WooCommerce WordPress plugin through version 2.5.4 lacks authorization checks on some of its REST API endpoints. This allows unauthenticated users to update the plugin's configuration and product synchronization state.

The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given post. This allows unauthenticated users to disclose the custom field key names of arbitrary posts, including private, draft, pending, scheduled and password-protected posts.

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an administrator's, from loading.

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions. This allows any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists.

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions. This allows any authenticated user, such as a subscriber, to read the full content of unpublished recipes.

The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute. This allows users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser of anyone who views the page, including higher-privileged users reviewing the content.