CVE Vulnerability Catalog

The Wow Elements Addons for Elementor plugin in versions up to and including 1.11.2 is vulnerable to Server-Side Request Forgery due to the plugin passing user-controlled input from the 'Changelog File' setting directly to the wp_remote_get function without adequate validation or sanitization of the URL. Authenticated attackers with Contributor-level access and above can make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services.

The BlockSpare plugin for WordPress in versions up to and including 4.2.6 is vulnerable to authorization bypass due to incorrect logic in the permission callback, using an AND (&&) operator instead of an OR (||) operator. Authenticated attackers with Subscriber-level access and above can bypass authorization checks and create arbitrary posts.

The Metasync plugin for WordPress in versions up to and including 2.6.23 is vulnerable to unauthorized data modification due to a missing capability check in the save_instant_indexing_settings() function. The function is hooked to admin_init and only checks for $_POST['submit'] before writing attacker-supplied $_POST['metasync_post_types'] into the site-wide 'metasync_options_instant_indexing' option, with no current_user_can() check and no nonce verification.

The Search Atlas SEO plugin for WordPress in all versions up to and including 2.6.23 is vulnerable to authorization bypass because it does not properly verify that a user is authorized to perform an action. This allows authenticated attackers with subscriber-level access or above to overwrite the whitelabel settings password with an attacker-controlled value.

The Quill Forms plugin for WordPress in all versions up to and including 5.7.1 is vulnerable to Stored Cross-Site Scripting via the Multiple Choice 'Other' value. Insufficient input sanitization and output escaping allows unauthenticated attackers to inject arbitrary web scripts that execute in the WordPress admin results view.

The SSL Zen plugin for WordPress in all versions up to and including 4.7.42 is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter due to insufficient input sanitization and output escaping. The vulnerability is only exploitable when in the system_requirements stage.

The Real3D Flipbook Lite plugin for WordPress in versions up to and including 5.1.1 is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute and other unsanitized attributes handled by on_shortcode(). Attribute values are copied verbatim into flipbook options and emitted via wp_json_encode() inside a <script type="application/json"> block without the JSON_HEX_TAG flag, allowing a literal </script> sequence to break out of the JSON script context.

The AppMySite plugin for WordPress in all versions up to and including 3.15.3 is vulnerable to Stored Cross-Site Scripting via the save_ams_license_key AJAX handler due to insufficient input sanitization and output escaping. The handler performs no capability check and no nonce verification, meaning any authenticated user with Subscriber-level access or above can invoke it to store the malicious payload.

The Create plugin for WordPress in all versions up to and including 2.5.3 is vulnerable to generic SQL Injection via the 'order' parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. The vulnerable advanced-filter SQL branch is only entered when at least one of the following parameters is present: linked_posts, created_after, created_before, missing_fields, post_id, a comma-separated type value, or exclude_type.

The Create plugin for WordPress in all versions up to and including 2.5.3 is vulnerable to generic SQL Injection via the 'order_by' parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. The REST endpoint permission callback defaults to the publish_posts capability, meaning any Author-level user or above can reach the vulnerable code path without any additional preconditions.

The OTP Login & Register Woocommerce plugin for WordPress in all versions up to and including 2.7.3 is vulnerable to Stored Cross-Site Scripting via the 'fb-config' setting due to insufficient input sanitization and output escaping. On multisite installations where administrators do not hold the unfiltered_html capability, this vulnerability can be leveraged to target the network super administrator.

The PDF Builder for WooCommerce plugin for WordPress in all versions up to and including 2.0.11 is vulnerable to authorization bypass because it does not properly verify that a user is authorized to perform an action. This allows authenticated attackers with subscriber-level access or above to retrieve invoice numbers, formatted invoice numbers, and creation timestamps for arbitrary WooCommerce orders by supplying any OrderNumber and InvoiceId values with a garbage nonce.

The WP Customer Reviews plugin for WordPress in all versions up to and including 3.7.8 is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' parameter due to insufficient input sanitization and output escaping.

The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes. This allows unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status. This allows unauthenticated attackers to mark a pending order as paid without paying.

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations. This allows users who hold its own administrator-assigned custom role to read, modify and permanently delete other hosts' records and the WordPress user accounts linked to them.

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request. This allows authenticated users holding a Hydra Booking-assigned host role to modify other hosts' profile data and reassign ownership of another host's record to themselves.

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints. This allows a booking-provider-level user to cancel and permanently delete other providers' bookings on the same site.

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints. This allows unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site.

The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor. This allows unauthenticated users to submit against a different registered form and modify the title and content of the post that form is bound to.