CVE Vulnerability Catalog

The WP Fast Total Search WordPress plugin in versions up to 1.82.284 contains a Broken Access Control vulnerability. An unauthenticated attacker can bypass access control mechanisms.

The WPAdverts WordPress plugin in versions up to 2.3.3 contains a Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script.

The WPCS WordPress plugin in versions up to 1.3.2 contains a Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script.

The SiteSkite plugin in versions up to 2.1.5 contains a Privilege Escalation vulnerability. An unauthenticated attacker can elevate their privileges.

The ZHBackup – Backup, Restore & Migration plugin in versions up to 2.4.2 contains a Sensitive Data Exposure vulnerability. An unauthenticated attacker can access sensitive data.

The RepairBuddy plugin in versions up to 4.1224 contains a Remote Code Execution (RCE) vulnerability. An attacker with subscriber privileges can execute code remotely.

The WP-Stateless plugin in versions up to 4.4.1 contains a Settings Change vulnerability. An attacker with subscriber privileges can change plugin settings.

The Verified Reviews (Avis Vérifiés) plugin in versions <= 2.4.6 contains an unauthenticated SQL Injection vulnerability. An attacker can inject malicious SQL into database queries.

The WP Swings Return Refund and Exchange For WooCommerce plugin through version 4.6.4 contains a missing authorization vulnerability. Incorrectly configured access control security levels can be exploited.

The WP Travel plugin for WordPress (up to version 12.0.3) contains an Authentication Bypass Using an Alternate Path or Channel vulnerability that allows password recovery exploitation. An attacker can reset a victim's password without their knowledge.

The Page Visits Counter – Lite plugin in versions up to 1.2.3 contains a Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script.

The Shirt Product Designer for WooCommerce plugin in version 1.0.4 contains a broken access control flaw that allows an unauthenticated attacker to perform operations they should not be authorized to do.

Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through 10.31.9.

Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.

The Advanced Product Fields Extended for WooCommerce plugin by Studio Wombat up to version 3.1.6 contains a path traversal vulnerability caused by improper limitation of a pathname to a restricted directory. This allows an attacker to manipulate file paths.

Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions.

Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions.

The Thank You Page Customizer for WooCommerce plugin in versions up to and including 1.2.2 contains a broken access control flaw that allows an unauthenticated attacker to perform unauthorized operations.

The BuddyForms plugin in versions up to and including 2.9.0 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. Missing proper access control allows operations that a user should not be permitted to perform.

A vulnerability in the Wise Chat plugin (versions up to 3.4.2) involves deserialization of untrusted data, allowing Object Injection. This can lead to unauthorized actions in the application.