CVE Vulnerability Catalog

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions. Authenticated users such as subscribers can write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire admin area inaccessible to all administrators (denial of service).

The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action. Unauthenticated attackers can redirect users to arbitrary external sites and disclose a subscriber token that grants access to that subscriber record's front-end actions.

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor. Users with the Contributor role and above can store JavaScript that executes in the browser of any higher-privileged user, such as an administrator, who reviews the affected chart.

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes. Unauthenticated attackers can list courses that are not published, including draft, pending, private, scheduled and trashed ones.

The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file. Unauthenticated attackers who can determine its identifier can download customer names, purchases, amounts and guest email addresses.

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools. Unauthenticated attackers can list every enrolled student's display name and user identifier against the course they are enrolled on, and recover their email addresses through the same handler's search filter.

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers. Unauthenticated attackers can retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, which is content the LearnPress WordPress plugin before 4.4.7 otherwise keeps non-public.

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page. Unauthenticated attackers can execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only sites running a classic, non-block mode are affected.

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values. This allows unauthenticated visitors to have markup rendered in the admin entry view that would otherwise be removed, and to attribute their submission to an administrator who never made it.

The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content. This allows any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation.

The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential. This allows the holder of a read-only key to act as the administrator account that issued it.

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalize a donor's e-mail address between the value it stores and the value it later uses to look that donor up. This allows unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user account linked to one, including an administrator's.

The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to. This allows any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing their user ID.

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records. This allows attackers to make a logged in admin permanently delete arbitrary posts and pages via a crafted request.

The Eventin WordPress plugin before 4.1.24 does not properly authorize order finalisation when its offline (local) payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order. This allows unauthenticated attackers to reset any existing order and its attendees to a pending state and thereby invalidate paid tickets.

The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker. This allows users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploading files, and, by supplying an email address they control, to obtain a working login to the created account.

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute. This allows unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting.

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call. This allows users with the contributor role and above to inject and store JavaScript that executes in the browser of anyone who interacts with the affected widget.

The Schema & Structured Data for WP & AMP plugin before 1.66 fails to check user permissions to edit a specific post when generating schema, allowing users with contributor role and above to read other users' draft, pending, private and password-protected posts.

The plugin before 1.66 does not correctly verify comment ownership or moderation status before returning content, allowing unauthenticated users to read comments still awaiting moderation or marked as spam.