CVE Vulnerability Catalog

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request. This allows unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own frontend registers them.

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions. This allows any unauthenticated visitor to read another visitor's assistant messages and to inject messages into their in-progress conversation.

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks.

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator visiting a wp-admin page.

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own.

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allows unauthenticated users to store arbitrary web scripts which are then executed on every page of the site's front end, as well as to move arbitrary posts to the trash.

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to store JavaScript that will execute when any visitor, including an administrator, views their profile.

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from the site's own origin.

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary files. The PHP handler shipped by default with the Debian and Ubuntu Apache packages maps .phar to PHP alongside .php and .phtml, so on that stack the uploaded file is executed and the issue leads to Remote Code Execution and full site takeover. Where the host routes only .php to the PHP handler, the same file is instead served from the site's own origin with its script intact, leading to Stored Cross-Site Scripting.

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage users, to create administrator accounts and to overwrite the credentials and role of existing accounts, including administrators.

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validation callback, relying on a blocklist that omits a file-deletion function, allowing users able to manage forms to cause arbitrary files on the server to be deleted. The deletion itself is carried out when the form is submitted, which requires no authentication.

The Nimble Page Builder WordPress plugin through version 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action. This allows any authenticated user (Subscriber+) to disclose the page-builder content of arbitrary non-public (draft, pending, private, scheduled) posts and pages.

The Business Name Generator WordPress plugin through version 1.3 does not sanitise and escape some of its settings. This could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

A vulnerability has been discovered in the Totolink A3002MU router (version Hh-B20211125.1046) in the formWlWds function of the /boafrm/formWlWds file. Manipulation of the submit-url argument results in a buffer overflow. The attack can be launched remotely, and a public exploit has already been released.

The Pochipp plugin for WordPress (versions up to and including 1.20.2) is vulnerable to reflected cross-site scripting via the 'keyword' parameter. Insufficient output escaping causes the $_GET['keyword'] value to be interpolated into the value attribute without esc_attr(). Unauthenticated attackers can inject arbitrary scripts that execute when a user with upload_files capability clicks a crafted link.

The Save as PDF Plugin by PDFCrowd for WordPress (versions up to and including 4.6.1) is vulnerable to arbitrary function invocation via the pdf_created_callback shortcode attribute. The eval_shortcode() function copies attributes without sanitization, which are then encrypted and passed to an unauthenticated endpoint where they are decrypted and invoked without an is_callable() check. An authenticated attacker with Contributor-level access can invoke arbitrary PHP functions.

The Forminator Forms plugin for WordPress (versions up to and including 1.57.2) is vulnerable to arbitrary shortcode execution. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

The Better Messages plugin for WordPress (versions up to and including 2.15.33) is vulnerable to authorization bypass due to improper verification of user authorization. An authenticated attacker with custom-level access can access the full message transcript, thread metadata, and user data of any chat-room thread without authorization. This is only exploitable when the chat room's only_joined_can_read setting retains its default value of '0'.

The Tutor LMS plugin for WordPress (versions up to and including 4.0.8) is vulnerable to Insecure Direct Object Reference (IDOR) via the 'student_id' parameter. Missing validation on a user-controlled key allows authenticated attackers with subscriber-level access and above to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs.