CVE Vulnerability Catalog

The WP Statistics plugin version 14.16.11 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability.

Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer versions up to 8.7.6. An attacker can inject malicious script without authentication.

The Business Directory plugin version 6.4.26 and earlier contains an unauthenticated Insecure Direct Object References (IDOR) vulnerability.

Unauthenticated SQL Injection vulnerability in VikAppointments Services Booking Calendar versions up to 1.2.20. An attacker can inject SQL queries, potentially leading to unauthorized database access.

The BookIt plugin version 2.6.0.3 and earlier contains an unauthenticated bypass vulnerability.

The FluentBooking Pro plugin version 2.2.1 and earlier contains an unauthenticated bypass vulnerability.

Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT versions up to 7.5.1. An attacker can inject malicious script without authentication.

Unauthenticated Cross Site Scripting (XSS) in RTMKit versions up to 2.1.5. An attacker can inject malicious script without authentication.

The WP EasyPay plugin version 4.5.3 and earlier contains an unauthenticated bypass vulnerability.

Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache versions up to 7.9. An attacker can send requests from the server to internal resources without authentication.

The Business Directory plugin versions up to 6.4.26 contain an unauthenticated broken access control vulnerability. An attacker can exploit this flaw to gain unauthorized access to protected features.

Unauthenticated Settings Change in WP Compress versions up to 7.21.28. An attacker can change plugin configuration without authentication.

Subscriber Privilege Escalation in WCFM Membership versions up to 2.11.11. A user with subscriber role can gain higher privileges.

The Mail Mint plugin versions up to 1.31.0 contain an unauthenticated broken access control vulnerability. This allows unauthorized access to protected features.

The WPFunnels plugin versions up to 3.12.13 contain an unauthenticated broken access control vulnerability. This allows unauthorized access to protected features.

Unauthenticated PHP Object Injection vulnerability in Mail Mint versions up to 1.31.0. An attacker can inject malicious PHP objects, potentially leading to arbitrary code execution.

Contributor PHP Object Injection in RTMKit versions up to 2.1.5. A user with contributor role can inject malicious PHP objects.

In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLS_CERTIFICATE_VALIDATION environment variable is unset or set to false, the component configures its HTTP transport to skip TLS certificate verification. As a result, an attacker able to intercept network communications between the Federator and external services could impersonate those services and intercept sensitive information transmitted over HTTPS, including OAuth client credentials and bearer tokens. The issue has been addressed by enabling TLS certificate validation by default. The TLS_CERTIFICATE_VALIDATION environment variable is now set to true in the default configuration provided by the Helm chart and Docker Compose deployment.

Unauthenticated Broken Access Control vulnerability in YITH Request a Quote for WooCommerce Premium versions before 4.46.0. An attacker can access functions they should not have permission to.

The Timetics plugin versions up to 1.0.61 contain an unauthenticated broken access control vulnerability. This allows unauthorized access to protected features.