CVE Vulnerability Catalog

The Forminator Forms plugin for WordPress (versions up to and including 1.58.1) allows unauthenticated attackers to execute arbitrary shortcodes because forminator_replace_quiz_form_data() invokes do_shortcode() on the notification body after the {quiz_result} merge tag is substituted, while earlier-substituted {user_agent} and {refer_url} tags carry attacker-controlled bytes that are not stripped of shortcode delimiters. Submitting a quiz whose notification template contains {quiz_result} is sufficient.

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (versions up to and including 7.5.5) is vulnerable to stored Cross-Site Scripting (XSS) via comment content and the yotu-wp Cookie-Blocker filter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The Backuply plugin for WordPress (versions up to and including 1.5.8) is vulnerable to second-order SQL injection via the 'Biographical Info' field. The value is exported verbatim into the backup's SQL dump, and when the backup is later restored, a crafted payload can execute arbitrary SQL with full database privileges.

The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress (versions up to and including 5.3.17) is vulnerable to Stored Cross-Site Scripting via the 'icon_light' shortcode attribute due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts that execute when a user visits the injected page.

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress (versions up to and including 5.2.1) is vulnerable to Insecure Direct Object Reference via the 'password' parameter due to missing validation on a user-controlled key. An authenticated attacker with vendor-level access can change the WordPress account password of any customer who has placed at least one order with that vendor, enabling account takeover.

The Cooked – Recipe Management plugin for WordPress (versions up to and including 1.16.1) is vulnerable to Stored Cross-Site Scripting via [cooked-timer] shortcode content due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts that execute when a user visits the injected page.

Wheels CLI versions 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. This can lead to shell command execution on deploy hosts and the CI runner, deletion of unintended files, overwriting other vendor files, writing outside the project, injection of executable CFML, stored XSS, and termination of an unrelated process.

Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit recipient is configured, an attacker can trigger a cold start and direct later error emails to an address under their control, disclosing error and request metadata, and in some cases configuration secrets and other users' session data. This is fixed in 4.1.2.

Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope, and if it overlaps with an unauthorized client's request that raises an error, that client can receive full exception details, including tag context or a serialized exception, and any sensitive data they contain. This is fixed in 4.1.2.

Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct sibling directory, allowing access outside the intended root, including limited file disclosure. Separately, the CLI database-dump output check can write outside the application root to an existing writable case-distinct sibling directory; that action requires the CLI POST, loopback and password gate. This is fixed in 4.2.0.

Wheels versions 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without verifying they belong to the parent being saved. A user can update, reassign, or delete another parent's hasMany or hasOne rows, and edit nested belongsTo records by posting another associated record's key.

Wheels versions 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true (default in development). In 4.1.2 the local-access restriction trusts client-supplied headers without checking the connecting peer.

Wheels versions 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=), production with error information disabled returns true for an out-of-scope key instead of throwing.

Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. This includes opt-in parameterize=false queries, IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments, and LIKE ESCAPE literals.

Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header, WHEELS_TEST_CONTEXT cookie, or a test-runner path in the URL. The alternate application uses the same configuration, environment, datasource and debug settings; this is not an authentication bypass or data/debug escalation, but it can bypass maintenance mode, provide a second set of rate-limit counters, and trigger additional startup side effects. This is fixed in 4.2.0.

Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. By uploading a crafted SVG, it is possible to execute scripting in the browser when the SVG image is viewed directly by its URL. The issue is mitigated because Backdrop embeds all uploaded SVG images within <img> tags, which prevents script execution.

The Flying Scripts plugin for WordPress (versions up to and including 1.2.4) is vulnerable to stored cross-site scripting via the 'comment' parameter due to insufficient input sanitization and output escaping. The payload uses only kses-allowed elements, and the XSS is introduced post-save by the plugin's output-buffer rewriter.

The RSS Aggregator by Feedzy plugin for WordPress (versions up to and including 5.2.11) is vulnerable to stored cross-site scripting via the 'media:thumbnail@url' parameter due to insufficient input sanitization and output escaping. The attacker must control an external RSS feed that the target site has already configured for import.

The Colibri Page Builder plugin for WordPress (versions up to and including 1.0.390) is vulnerable to stored cross-site scripting via the 'comment' parameter due to insufficient input sanitization and output escaping. The payload survives storage because the widened comment allow-list permits SVG elements, and execution occurs when colibri.js reads the stored data-target value and passes it to jQuery().

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress in versions up to and including 1.3.0 is vulnerable to Directory Traversal via the 's' parameter. An authenticated attacker with administrator-level access can read arbitrary files on the server, and when the Optimize CSS feature is enabled, an unauthenticated visitor can trigger the attack with a single crafted GET request.