CVE Vulnerability Catalog

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to and including 7.9 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into clicking a link. Exploitation requires a validly signed 'esi' value in the GET query string and a separate attacker-controlled 'esi' payload as a POST body field, relying on PHP's default $_REQUEST merge order.

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to and including 4.5.13 due to insufficient input sanitization and output escaping. In the user_meta_save() function scalar values bypass the sanitization logic that only processes arrays, allowing the spinner field value to be stored in user meta without proper sanitization. Later, this value is rendered in an unquoted HTML attribute without escaping, enabling authenticated attackers with subscriber-level access and above to inject arbitrary web scripts.

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to and including 2.1.4 due to missing capability checks on popup management actions. This allows authenticated attackers with Subscriber-level access and above to create arbitrary popups and inject malicious JavaScript that executes when the popup is displayed, leading to Stored XSS.

The YS LeadGen plugin for WordPress in all versions up to and including 2.1.4 is vulnerable to Sensitive Information Exposure. The 'ysleadgen_get_captured_data' AJAX action is accessible to unauthenticated users, allowing retrieval of all captured form submission data, including personally identifiable information (names, email addresses, message content).

The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.4.1 due to the plugin not properly verifying that a user is authorized to perform an action. This allows unauthenticated attackers to overwrite the merchant's stored TikTok integration access token in wp_options, hijacking the site's TikTok Business and product catalog integration. Successful exploitation requires the attacker to supply a valid TikTok OAuth auth_code issued for the merchant's registered TikTok app.

The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'post_ID' parameter in all versions up to and including 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This allows authenticated attackers with contributor-level access and above to append additional SQL queries into existing ones, potentially extracting sensitive information from the database. The capability check is bypassable because WordPress internally casts $id to an integer for permission evaluation while the full unsanitized string is passed to the SQL sink.

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to and including 5.0.8. The publicly accessible `woocommerce_api_wt_stripe` webhook endpoint wraps the only call to `\Stripe\Webhook::constructEvent()` inside an `if (!empty($endpoint_secret))` guard that is never entered on default installations because the `eh_stripe_webhook_secret` option is empty after a fresh install. This causes the raw, attacker-controlled POST body to be decoded and processed as a fully trusted Stripe event without any signature verification, authentication, or authorization. This allows unauthenticated attackers to send forged Stripe webhook events to manipulate WooCommerce order statuses, including marking unpaid orders as paid or completed, forcing legitimate orders into a failed state, fabricating dispute notifications, and injecting forged refund events. The vulnerability is only exploitable when the Stripe webhook signing secret has not been configured.

The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 3.0 due to the license_activate_fleximp() and license_deactivate_fleximp() functions, hooked to AJAX actions, lacking both a capability check and nonce verification. This allows authenticated attackers with subscriber-level access and above to activate an arbitrary/fraudulent license key or deactivate the site's legitimate license, disrupting the plugin's premium functionality.

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.12.27 via the handle_customers_ajax. This allows authenticated attackers with contributor-level access and above to extract the full customer dataset from the ea_customers table, including personally identifiable information such as names, email addresses, mobile numbers, dates of birth, and physical addresses.

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to and including 4.14.0 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into clicking a link.

The ProfilePress plugin for WordPress in all versions up to and including 4.17.2 is vulnerable to arbitrary shortcode execution. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode, allowing authenticated attackers with subscriber-level access and above to execute arbitrary shortcodes.

The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress in versions up to and including 7.0.02 is vulnerable to Open Redirect due to improper validation of user input. Unauthenticated attackers can redirect users to potentially malicious sites if they trick them into clicking a specially crafted link. Exploitation requires tricking a logged-in user into clicking a crafted logout URL; the victim is fully logged out via wp_logout() before the malicious redirect is issued.

The GoPay for WooCommerce plugin for WordPress in versions up to and including 1.0.36 is vulnerable to generic SQL Injection via the 'log_table_filter' parameter due to insufficient escaping of user-supplied input and lack of sufficient preparation on the existing SQL query. Authenticated attackers with shop manager-level access and above can append additional SQL queries into existing queries, allowing extraction of sensitive information from the database.

The WP Optimizer plugin for WordPress in versions up to and including 2.5.0 is vulnerable to SQL Injection via the 's' parameter due to an unsafe subquery-detection branch in the Query::parse_key_compare_field() method. When the user-supplied value matches the regex ^[(\s]*SELECT\s+, it is wrapped in parentheses and embedded directly into the SQL string without escaping. Authenticated attackers with administrator-level access can inject arbitrary SQL subqueries, including time-based blind payloads, allowing extraction of sensitive information from the database.

The Redux Framework plugin for WordPress in versions up to and including 4.5.13 is vulnerable to Stored Cross-Site Scripting via the Media field filter values due to insufficient input sanitization of nested array values in the user_meta_save() function and unsafe output of filter CSS values in the render() function without proper escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Bread plugin for WordPress in versions up to and including 2.9.12 is vulnerable to information exposure due to the lack of authentication and authorization checks on the settings export functionality (download_settings function), which is registered on the plugins_loaded hook and explicitly allows execution on non-admin (public) pages. The function exports all plugin configuration settings including the protection_password field, which is stored in plaintext. Unauthenticated attackers can retrieve the PDF protection password by accessing the /?export-meeting-list=1 endpoint.

The Welcomizer plugin for WordPress in all versions up to and including 2.8.1 is vulnerable to Remote Code Execution (RCE). Missing authorization checks on the 'twiz_ajax_callback' AJAX action's 'savesection' handler combined with the use of eval() to execute user-supplied code allows authenticated attackers with Subscriber-level access and above to inject arbitrary PHP code.

The WP Composer – The Easiest Page Builder plugin for WordPress in versions up to and including 1.0.5 is vulnerable to Stored Cross-Site Scripting via the 'pbwp_raw_shortcode' shortcode due to the shortcode handler decoding Base64-encoded content and outputting it directly without any sanitization or escaping. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The Base64 encoding allows the payload to bypass WordPress's KSES content filtering at save time.

The VW Writer Blog theme for WordPress in versions up to and including 1.3.8 is vulnerable to unauthorized modification of data due to a missing capability check on the 'vw_writer_blog_reset_all_settings' function. Authenticated attackers with Subscriber-level access and above can reset all theme customizer settings to their defaults.

The Ibtana – Ecommerce Product Addons plugin for WordPress in versions up to and including 0.4.7.7 is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepa_use_gt_editor' AJAX action. Authenticated attackers with Subscriber-level access and above can update or delete arbitrary post meta entries via the 'iepa_builder' meta key.