CVE Vulnerability Catalog

The Mailgun for WordPress plugin up to version 2.2.0 is vulnerable to Server-Side Request Forgery (SSRF) via path traversal. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'] and passes them through sanitize_text_field(). This allows unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.

A Missing Authorization vulnerability in the QueryEngineTask of Google Cloud Application Integration (versions from 2025-04-28 to 2026-04-04) allows an external attacker to access sensitive internal data. The issue was patched on April 4, 2026; no customer action is required.

The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators.

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user, including administrators. In the default case a session as the site's original administrator account is obtained without needing to know any account details at all.

The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's email address.

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators.

The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be executed in the context of an administrator viewing the plugin's admin area, as well as any visitor of a page embedding a slider.

The Forminator Forms WordPress plugin before version 1.57.0.7 does not consistently enforce role restrictions on registration forms. Users with form-building permissions can configure a form that assigns the administrator role to any visitor who registers through it.

The Forminator Forms WordPress plugin before version 1.57.0.5 does not restrict a network-wide setting to network administrators. An administrator of any single site on a multisite network can execute arbitrary code across the entire network.

The Tutor LMS WordPress plugin before version 4.0.6 does not validate a stored file path before using it to stream media. Users with the instructor role can read arbitrary files on the server, including files outside the web root. Readable files include the WordPress configuration file, exposing database credentials and authentication keys and salts, allowing authentication cookies to be forged.

The ManageWP Worker WordPress plugin before version 4.9.37 does not bind the account being logged in to the signature authorizing the login, nor prevent an already used login link from being replayed. Attackers who obtain such a link can gain a session as any user on the site, including an administrator.

The Conekta Payment Gateway WordPress plugin before version 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount. This allows unauthenticated attackers to mark arbitrary orders as paid without payment.

The FiboSearch WordPress plugin before version 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints. This allows unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two endpoints are affected: the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details) when queried for taxonomy details.

The Post Grid, Slider & Carousel Ultimate WordPress plugin before version 1.8.1 does not sanitize and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen. This allows users with the Contributor role and above to inject JavaScript that executes in the session of any administrator who opens the affected item.

The Tutor LMS WordPress plugin before version 4.0.6 does not enforce per-object ownership checks on its course content type. This allows any user with the instructor role to read the content of private courses belonging to other instructors.

The AutomatorWP plugin for WordPress up to version 5.8.4 is vulnerable to authorization bypass due to improper verification of user permissions. Authenticated attackers with subscriber-level access or above can retrieve the site's Campaign Monitor mailing list catalog, including list IDs and names, which should be restricted to managers.

The AutomatorWP plugin for WordPress up to version 5.8.4 is vulnerable to authorization bypass due to improper verification of user permissions. Authenticated attackers with subscriber-level access or above can retrieve all ConvertKit form data configured by the site's manager, exposing integration details intended to be restricted to managers.

The Themify Builder plugin for WordPress up to version 7.8.0 is vulnerable to authorization bypass due to improper verification of user permissions. Unauthenticated attackers can modify the stored styling data (padding and margin properties) of arbitrary posts, including private and draft posts, by supplying a post ID and JSON payload.

The WPeMatico RSS Feed Fetcher plugin for WordPress up to version 2.8.24 is vulnerable to unauthorized data modification due to a missing capability check in the wpematico_import_settings function. Authenticated attackers with subscriber-level access or above can update arbitrary options on the WordPress site, potentially leading to privilege escalation.

The Tie::Hash::Regex module for Perl before version 2.0.0 throws an exception on unparseable lookup keys. The FETCH, EXISTS, and DELETE methods throw an exception when the key is an invalid regular expression, potentially causing application termination.