CVE Vulnerability Catalog

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments.

The TrueBooker WordPress plugin before 1.2.7 lacks proper authorization checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with associated booking items and payment records.

The TrueBooker WordPress plugin before 1.2.7 lacks proper authorization checks in some AJAX actions, allowing unauthenticated users to retrieve personal information of customers who booked an appointment, including name, email, phone number, and postal address.

The TrueBooker WordPress plugin before 1.2.7 lacks proper authorization checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments and trigger notification emails to affected customers.

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check nor validate a nonce in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each loaded on every page request.

The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve usernames and email addresses of users holding the plugin's own roles.

The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitizing file contents, allowing users with upload capability, such as Authors, to upload files containing malicious JavaScript that executes in the browser of any user who opens it (Stored XSS). On multisite, this also overrides an upload-type restriction set by the network administrator.

The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names.

The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and withdrawal histories by iterating identifiers.

The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that are executed in the browser of a higher privileged user who views the media library.

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as JavaScript in the browser of anonymous visitors.

The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores.

The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users.

A cross-site scripting (XSS) vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script in the victim's browser.

The Speed Optimizer plugin for WordPress up to version 7.8.0 is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page. This is exploitable only when the Lazy Load Media option is enabled.

A vulnerability was found in xianrendzw EasyReport up to version 2.0.17.0522_Beta in the execSqlText/previewSqlText functions in DesignerController.java (SQL Preview Endpoint). Manipulation of the sqlText argument results in improper neutralization of special elements used in a template engine, potentially allowing remote attack. The exploit has been made public, and the project has not responded.

A vulnerability was found in xianrendzw EasyReport up to version 2.0.17.0522_Beta in the DataSourceController.add function in DataSourceController.java (QueryerFactory component). Manipulation of the queryerClass argument leads to permission issues, potentially allowing remote attack. The exploit has been publicly disclosed, and the project has not responded.

The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress up to version 1.9.15 is vulnerable to unauthorized data access due to improper capability check on the can_access function. Authenticated attackers with Contributor-level access can retrieve a master-password and access any password-protected content.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media Library Assistant allows Stored XSS. This issue affects Media Library Assistant from n/a through 3.39.

Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing from n/a through 5.2.30.