CVE Vulnerability Catalog

The User Registration & Membership WordPress plugin before version 5.2.6 does not perform a capability check when saving its login settings. Authenticated users with plugin management capability but without full administrator access can change arbitrary site options and escalate their privileges to administrator.

The User Registration & Membership WordPress plugin before version 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request. Authenticated users with Subscriber-level access and above can cancel any other user's in-progress email change, including an administrator's.

The Breeze Cache WordPress plugin before version 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches. This allows unauthenticated attackers to create files at arbitrary locations on the server, outside the intended cache directory.

The Quiz and Survey Master (QSM) WordPress plugin before version 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes. Users with a role as low as Contributor can read the questions, hints and correct answer keys of quizzes belonging to other users.

SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product.

SOY CMS has an issue with deserialization of untrusted data. An attacker may execute arbitrary code with web server privileges.

SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed in the web browser of a user who is logged into the product.

The WCFM Marketplace WordPress plugin before version 3.8.2 does not correctly verify that the person requesting a refund owns the order. This allows unauthenticated users to create refund requests against any guest checkout order on the site.

The WPMU DEV Dashboard plugin for WordPress up to version 5.0.1 is vulnerable to Authentication Bypass due to inconsistent HMAC message construction between the `wdpsso_step1` and `wdpsso_step2` AJAX actions. An unauthenticated attacker can obtain a valid HMAC from step 1 and replay it to step 2, resulting in an authenticated administrator session.

SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed in the web browser of a user who is logged into the product.

The Amelia plugin for WordPress up to version 2.2 is vulnerable to Stored Cross-Site Scripting via customer name fields. An authentication bypass allows unauthenticated users to submit booking data, and in the admin calendar view, customer names are interpolated into JavaScript template literals and rendered via innerHTML without proper HTML entity encoding. An attacker can inject malicious scripts that execute when an administrator hovers over the appointment.

The wpForo Forum plugin for WordPress up to version 2.4.17 is vulnerable to SQL Injection via the 'referer' parameter. Insufficient escaping and lack of preparation on the SQL query allow unauthenticated attackers to append additional SQL queries, which can be used to extract sensitive information from the database.

The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to and including 4.10.1 due to insufficient input sanitization and output escaping. The REST endpoint at /wp-json/elementskit/v1/advanced-search uses permission_callback set to __return_true, allowing unauthenticated access. Search terms are stored in the ekit_advanced_search_popular_keyword WordPress option via update_option(). While sanitize_text_field() is applied, it does not encode double quotes, and the stored keywords are rendered in HTML attributes via sprintf without esc_attr(), allowing attribute injection. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user triggers the "no results" popular keywords view on pages using the Advanced Search widget.

A Cross-site Scripting vulnerability in the extract domain function in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM.

The Ultimate Member WordPress plugin before version 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list. This allows unauthenticated users who register through the plugin's own form to grant themselves arbitrary capabilities and reach administrator-equivalent access.

The shared-files-pro WordPress plugin before version 1.7.70 does not validate the file path supplied when creating a featured image. This allows unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL.

The User Frontend WordPress plugin before version 4.3.10 does not restrict access to its user directory search endpoint. This allows unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators.

The User Frontend WordPress plugin before version 4.3.10 does not properly validate field type definitions and deserializes user-controlled post metadata when rendering submitted posts. Users with Editor-level access and above can inject arbitrary PHP objects, which can lead to remote code execution when a suitable POP chain is present on the site.

The Shared Files WordPress plugin before 1.7.67 and Shared Files Pro before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce output on public pages. An unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.

The Shared Files WordPress plugin before 1.7.67 and Shared Files Pro before 1.7.68 do not properly sanitize a file path taken from a frontend file submission, and their single-pass traversal filter is bypassable. Unauthenticated users can store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover.