CVE Vulnerability Catalog

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given. This allows unauthenticated attackers to read arbitrary files from the server, force it to issue arbitrary requests and retrieve the responses, and write attacker-supplied content outside the uploads directory.

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code. This allows unauthenticated users to obtain a signed meeting join link for any classroom, including one protected by an access code, and to join it with moderator privileges.

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings. This allows unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions are signed with, at infrastructure of their choosing.

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes. This allows unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected BigBlueButton server.

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment. This allows unauthenticated users to have a paid appointment approved for a fraction of its price.

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media items belonging to other users.

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by default, and no POP chain is present in the plugin itself, so further impact requires a suitable gadget from another installed plugin.

The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortcode is not enabled by default.

The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side. This allows unauthenticated users to list and download the contents of folders that were never published on the site.

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods. This allows any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken.

The MStore API WordPress plugin before version 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester. This allows any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made.

The Newsletters WordPress plugin before version 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options. This allows attackers to make a logged-in administrator overwrite arbitrary plugin settings, including the credential protecting its API, via a Cross-Site Request Forgery attack.

The Newsletters WordPress plugin before version 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value. This allows unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails, when the optional API has been enabled.

The Total processing card payments for WooCommerce WordPress plugin through version 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response. This allows unauthenticated attackers to redirect that request to an arbitrary host (disclosing the merchant's payment-gateway credentials) and to forge a success response that marks arbitrary WooCommerce orders as paid.

The SmartAIPress WordPress plugin through version 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side. This allows users with subscriber-level access and above to make the site retrieve arbitrary internal or external URLs and read the response, resulting in a full-read Server-Side Request Forgery.

The Uix UserCenter WordPress plugin through version 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install. This allows unauthenticated attackers to forge a token for any user, overwrite an administrator's email and password, and take over the account.

The Rest Routes WordPress plugin through version 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query. This allows unauthenticated attackers to perform SQL injection attacks.

The MemberHero WordPress plugin through version 6.9 does not restrict which account fields can be supplied during its frontend registration process. This allows unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover. Version 6.9 is advertised as resolving this issue, but the fix is incomplete and the current version remains exploitable.

A traffic interception vulnerability in BOSH Director vCenter CPI allows an attacker positioned between BOSH Director and vCenter to impersonate the vCenter REST API and capture administrator credentials transmitted via HTTP Basic auth, leading to complete virtualization infrastructure takeover.