CVE Vulnerability Catalog

The Molongui Authorship plugin for WordPress is vulnerable to stored DOM-based XSS via the 'comment' parameter (href attribute inside comment content) in all versions up to and including 5.2.12.

The WPAdverts – Classifieds Plugin for WordPress is vulnerable to stored XSS via the 'adverts_location' parameter in all versions up to and including 2.3.4.

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to stored XSS via the 'shipping_first_name' parameter in all versions up to and including 3.16.0.5.

The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to stored XSS via the display_name user field in all versions up to and including 5.1.0.

The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to stored XSS via the comment author name in all versions up to and including 3.4.18.

The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to stored DOM-based XSS via the 'qsm_hidden_questions' parameter in all versions up to and including 11.2.6.

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to stored XSS via the 'attachments[name]' parameter in all versions up to and including 1.8.15.

The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 6.3.9. The plugin does not properly verify that a user is authorized to perform an action.

The Bookly plugin for WordPress is vulnerable to PHP Object Injection through deserialization of untrusted input via the 'value' parameter in versions up to and including 28.2. Authenticated attackers with custom-level access or above can inject a PHP object, but no known gadget chain is available.

The 10Web Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in versions up to and including 2.34.8. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses the page.

The LazyLoad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment_content' parameter in versions up to and including 2.4.0. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts, but require admin approval of the comment.

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id' parameter in versions up to and including 1.2.30. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts.

The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via comment content with the <presto-player> tag in versions up to and including 4.5.1. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts, but require initial comment approval.

The Real Estate Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in versions up to and including 7.3. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. The reCAPTCHA check can be trivially bypassed.

The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number verified during its OTP password reset. This allows unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.

The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to. This allows unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control.

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in versions up to and including 4.5.6. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. The injection is triggered by submitting a request to the webhook endpoint with a status_string other than 'Done'.

The Groundhogg plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 4.8.3. The create_support_user() function identifies the support account solely by matching against publicly hardcoded constants, allowing an attacker with an account having login 'groundhogg' and matching email to be promoted to administrator, and to super admin on multisite.

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.