CVE Vulnerability Catalog

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to and including 1.23.0 via the my_profile_update() function. The lack of nonce verification, capability checks, and meta key validation allows an authenticated attacker with Subscriber-level access to modify arbitrary user metadata.

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. Authenticated attackers with subscriber-level access or above can permanently delete arbitrary posts, pages, and custom post types (bypassing the trash) or change any published post to draft status.

The TECHIN2B Application contains an Authorization Bypass Through User-Controlled Key vulnerability that allows Privilege Abuse. The issue affects versions from V1.0.7676.13 through 18092026.

The Bar Association Website by KA Informatics Technologies Ltd. Co. is vulnerable to Reflected XSS due to improper neutralization of input during web page generation. This issue affects versions through 18092026. The vendor was contacted but did not respond.

The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.3.68 via the duplicate() function hooked on admin_init. This is due to the handler only verifying the generic 'edit_posts' capability and a plugin-wide static nonce without any object-level authorization check. Authenticated attackers with Author-level access or above can duplicate arbitrary Download Manager packages owned by other users, copying all package metadata including protected file references, role-based access restrictions, and password lock settings into an attacker-owned clone.

The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 11.8.2 via the wpbc_ajax_option_save AJAX action. An authenticated attacker with Editor-level access can write WordPress options such as default_role=administrator and create an administrator account.

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to and including 11.8.2 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into clicking a link. The nonce check is bypassed by default because the 'booking_is_nonce_at_front_end' option ships disabled.

The Divi theme for WordPress in all versions up to and including 5.11.1 is vulnerable to arbitrary shortcode execution because it does not properly validate a value before running do_shortcode. Unauthenticated attackers can execute arbitrary shortcodes, and when the 'Force Enable D4 Shortcode Framework' option is enabled, this includes invoking the et_pb_contact_form shortcode to send email to an attacker-selected recipient with attacker-controlled content.

The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty. This allows unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it.

The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler. This allows unauthenticated users to create accounts even when the site has registration disabled.

The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.1.4. An authenticated attacker with Subscriber-level access can delete arbitrary Filter Gallery records by supplying attacker-controlled gallery IDs.

The EmbedPress plugin for WordPress in all versions up to and including 4.6.5 is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute if they can trick a user into clicking a link. This is a regression: the esc_url() wrapper that remediated CVE-2023-5749 was removed in version 4.3.0 during a refactor.

The GPTranslate plugin for WordPress in all versions up to and including 2.34.6 is vulnerable to Sensitive Information Exposure via enqueue_frontend_scripts. Unauthenticated attackers can extract the plaintext third-party AI provider API key (OpenAI, DeepL, xAI/Grok, Gemini, Claude, or Google Cloud Translation) by fetching any public page and applying the inverse transformation bundled in the plugin's own public JavaScript asset. This affects the default configuration and all supported non-DeepSeek providers.

The Filter Gallery plugin for WordPress in all versions up to and including 1.1.4 is vulnerable to authorization bypass because it does not properly verify that a user is authorized to perform an action. Authenticated attackers with subscriber-level access and above can overwrite the title and content of arbitrary WordPress posts, write the _wp_attachment_image_alt meta key on arbitrary posts, and create or overwrite arbitrary ufg_gallery_* options.

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time. This allows users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PHP where a local file containing PHP code can be reached. Exploitation requires the plugin's Lightspeed subsystem to be enabled, which is not the default.

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection. The protection is dropped when the request's verification value is missing or incorrect, which any visitor can arrange, allowing unauthenticated attackers to re-expose the concealed WordPress login page location.

The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections. The mere presence of an attacker-suppliable request parameter is treated as sufficient, allowing unauthenticated attackers to disable those protections and re-expose the concealed login and admin URLs on any request.

The Custom Twitter Feeds plugin for WordPress in all versions up to and including 2.8.0 is vulnerable to Stored Cross-Site Scripting via the 'buttoncolor' shortcode attribute due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. This is exploitable on common installs where the admin has configured access tokens with zero or multiple legacy feeds.

The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.

The Magazine Blocks plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6 due to improper verification that a user is authorized to perform an action. An authenticated attacker with contributor-level access and above can demote administrator-owned published builder templates to draft status and replace them with attacker-authored block content rendered site-wide.