CVE Vulnerability Catalog

The WPC Estimated Delivery Date for WooCommerce plugin for WordPress in versions up to and including 4.0.1 is vulnerable to Reflected Cross-Site Scripting via the 'rule_data' parameter due to insufficient input sanitization and output escaping.

The WP Ultimate Review plugin for WordPress in versions up to and including 2.4.3 is vulnerable to arbitrary shortcode execution due to improper validation of a value before running do_shortcode. The bypass relies on WordPress's strip_shortcodes() function unwrapping the [[tag]] double-bracket escape to a bare [tag] that survives wp_insert_post storage and fires when the publicly queryable xs_review post type is rendered through the_content.

The WPMobile.App – Android and iOS App Builder plugin for WordPress in versions up to and including 11.84 is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI (path segment after /android_json/search/)' parameter due to insufficient input sanitization and output escaping. Exploitation requires the app's content mode to be configured as 'webview' (i.e., the 'speed' option is not set to '1').

The WP Ultimate Review plugin for WordPress in versions up to and including 2.4.3 is vulnerable to arbitrary shortcode execution due to improper validation of a value before running do_shortcode. The nonce required to pass the only gate is emitted to unauthenticated visitors via the public review form, and submitted shortcode payloads are auto-published without admin approval by default.

The Wp Social Login and Register Social Counter plugin for WordPress in versions up to and including 3.2.1 is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute and Arbitrary User Meta Write due to insufficient input sanitization and output escaping. The attacker must chain two steps: invoking the nonce-only dismiss_ajax_call endpoint to set the xs_social_profile_image meta flag, then setting their display name to a script payload.

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page. This allows users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators.

The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read. This allows users granted the translator capability to retrieve the contents of files of certain types from anywhere on the server, including outside the web root.

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement. This allows users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce, or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data. This allows an unauthenticated attacker to modify or delete another customer's stored cart.

The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress in versions up to and including 1.10.41 is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. An authenticated attacker with subscriber-level access or higher can overwrite the post_content of any post or page with LLM-generated text, influencing SEO and consuming paid AltText.ai API credits.

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target. Users with the contributor role and above can store a payload that executes in the browser of anyone who follows the link, including an administrator previewing the unpublished submission.

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API.

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set away from its default.

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature (Administrators by default, or Editors when a non-default setting is enabled) to write arbitrary files, including executable PHP, outside the intended upload directory on servers where the PHP zip extension is unavailable, leading to Remote Code Execution.

The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter. An authenticated attacker with subscriber-level access or above can delete arbitrary ticket responses belonging to other users by supplying any stsw_responses row ID.

The Calculated Fields Form plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary' parameter in all versions up to, and including, 5.5.1.5. An unauthenticated attacker can inject arbitrary web scripts if they can trick a user into clicking a link.

The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woosq-redirect' parameter in all versions up to, and including, 4.4.0. An unauthenticated attacker can inject arbitrary web scripts if they can trick a user into clicking a link.

The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role and above to read the contents of arbitrary files on the server, with the copied file then retrievable by unauthenticated visitors.

The SEOPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'seopress_google_analytics_matomo_id' parameter in all versions up to, and including, 10.2. An authenticated attacker with subscriber-level access or above can inject arbitrary web scripts that execute when a user visits the injected page.

The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks, when author reviews are enabled.