CVE Vulnerability Catalog

The plugin before 1.66 does not check if a post is password protected before including its content in structured data, allowing unauthenticated users to obtain password-protected post content through multiple public output routes.

The Ni WooCommerce Sales Report plugin before 4.2.0 lacks authentication/authorization checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, target individual orders, and search orders by customer name or email.

The Ni WooCommerce Sales Report plugin before 4.2.0 does not sanitise and escape a parameter before using it in SQL statement, allowing unauthenticated users to perform SQL injection attacks.

The Eventin plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.

The WP Import Export Lite plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with import capability (administrators by default) to make the site issue requests to internal hosts and services and read their responses. This is an incomplete fix for CVE-2026-11397.

The WP Import Export Lite plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the browser of a high privileged user, such as an administrator, viewing that screen.

The WP Import Export Lite plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the import permission to perform SQL injection attacks.

The WP Import Export Lite plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission (administrators by default, may also grant to lower roles) to perform SQL injection attacks.

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing users with import permission to disclose sensitive files from the server, including files outside the web root. The same code path also relaxes file-system permissions of any path it is given, whether or not the copy succeeds.

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a capability to delete arbitrary directories and every file within them, including outside the web root.

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remote code execution.

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution.

The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution.

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it.

The CVE record was rejected. Reason: the CVE ID was not needed.

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress in all versions up to and including 28.1 is vulnerable to Insecure Direct Object Reference via the 'conversation_id' parameter due to missing validation on a user-controlled key. This allows unauthenticated attackers to read the full AI booking conversation transcript of any customer — leaking names, email addresses, phone numbers, and appointment details — and inject arbitrary messages into any victim conversation. Because AI conversations are stored with no owner, user, or session identifier and conversation IDs are sequential integers, an unauthenticated attacker can enumerate all customer conversations by incrementing the conversation_id parameter.

The Bold Page Builder plugin for WordPress (all versions up to and including 5.9.6) is vulnerable to Stored Cross-Site Scripting via the 'shortcode_content' parameter of the bt_bb_shortcode shortcode. This is due to a bypassable security filter (bt_bb_save_pre) circumvented via null byte injection, combined with insufficient output sanitization of base64-decoded content in the bt_bb_raw_content shortcode handler. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts into pages that execute when users visit them.

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress (all versions up to and including 2.15.22) is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute if they can successfully trick a user into performing an action such as clicking a link.

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress in all versions up to and including 32.0.1 is vulnerable to Unauthenticated Arbitrary File Overwrite due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This allows authenticated attackers with subscriber-level access and above to overwrite known files, which may lead to remote code execution when certain preconditions are met.

The WP-Lister Lite for eBay plugin for WordPress in all versions up to and including 3.8.9 is vulnerable to Stored Cross-Site Scripting via the AJAX Cron Handler Request Parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page.