CVE Vulnerability Catalog

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.

The Ajaxify Comments WordPress plugin before version 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers.

The HIPAA FORMS WordPress plugin before version 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints.

The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous visitors. JavaScript execution is not possible at that role, so the impact is limited to defacement, interface redressing and forcing external resources to load.

The User Frontend WordPress plugin before version 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.

The Timetics WordPress plugin through version 1.0.61 does not enforce per-object ownership when updating appointments via its REST API, allowing users with the custom staff role to modify, disable, or take over appointments belonging to other staff members.

A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to cause the application to terminate unexpectedly, resulting in a denial-of-service. Exploitation requires a user to open a specially crafted IFC file.

The Yoast SEO Premium WordPress plugin before version 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.

The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component.

The Wp Edit Password Protected WordPress plugin before version 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API.

The Icegram Express WordPress plugin before version 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks.

The Passster WordPress plugin before version 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs.

The Passster WordPress plugin before version 4.2.24 does not properly handle input in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content.

The Auto x LINE WordPress plugin through 1.0.0 lacks authorization checks in some REST endpoints, allowing unauthenticated users to update plugin settings, clear logs, etc.

The Notification Bar WordPress plugin through version 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails.

This CVE ID is rejected because it is a duplicate of CVE-2025-13542 and was never published. Both IDs were assigned to the same unauthenticated privilege escalation vulnerability in the DesignThemes LMS WordPress plugin. All CVE users should reference CVE-2025-13542 instead of this ID.

A vulnerability in affected products allows an attacker with basic user privileges to gain access to users' projects. The attacker can modify and delete projects.

The LiveJournal Shortcode WordPress plugin through version 1.1.1 does not validate and escape some shortcode attributes before outputting them, allowing users with contributor role and above to perform Stored Cross-Site Scripting attacks.

The Weaver Show Posts WordPress plugin before version 1.8.1 unserializes the content of an imported file, which could lead to PHP object injection issues when a high privilege user imports a malicious file and a suitable gadget chain is present on the blog.

Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions from 0.0.0 to 2.0.13.