CVE Vulnerability Catalog

The Bulk Page Generator – LPagery plugin for WordPress in versions up to and including 3.1.0 is vulnerable to authorization bypass because it does not properly verify that a user is authorized to perform an action. An authenticated attacker with subscriber-level access and above can create, modify, and delete LPagery-managed pages and bulk page-generation processes otherwise restricted to administrators. On default fresh installations where Freemius has not been opted into, the AES-256-CBC key used to validate Bearer tokens collapses to the publicly known SHA-256 hash of an empty string, making the token entirely forgeable.

The Mang Board plugin for WordPress in versions up to and including 2.4.4 is vulnerable to Stored Cross-Site Scripting via the 'content' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access and above can inject arbitrary web scripts into pages that execute whenever a user accesses the injected page. The sanitization bypass is compounded by the ability to omit the data_type parameter in a modify request, skipping the HTMLPurifier branch entirely and leaving only mbw_htmlspecialchars2 encoding — fully reversed at render.

The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress in versions up to and including 1.2.0 is vulnerable to Sensitive Information Exposure via the 'image_hub_api_keys_* (6 options)' parameter. An authenticated attacker with subscriber-level access and above can extract plaintext API credentials for six third-party services — Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash — emitted verbatim into every admin page's HTML via wp_localize_script. The leaked HTML also contains a valid image_hub_nonce AJAX nonce, which — combined with the absence of any capability check in the image_hub_update_settings AJAX handler — allows the same attacker to overwrite all six stored API credential options via update_option().

The Forminator Forms plugin for WordPress (versions up to and including 1.58.1) allows unauthenticated attackers to execute arbitrary shortcodes because a value passed to do_shortcode is not properly validated. Exploitation is possible on any block-theme install via a single unauthenticated GET request to the search results page or by submitting an anonymous comment, with no Forminator-specific content required.

The Gwolle Guestbook plugin for WordPress (versions up to and including 5.1.1) is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute if a user is tricked into clicking a crafted link.

The Forminator Forms plugin for WordPress (versions up to and including 1.58.1) allows unauthenticated attackers to execute arbitrary shortcodes because forminator_replace_quiz_form_data() invokes do_shortcode() on the notification body after the {quiz_result} merge tag is substituted, while earlier-substituted {user_agent} and {refer_url} tags carry attacker-controlled bytes that are not stripped of shortcode delimiters. Submitting a quiz whose notification template contains {quiz_result} is sufficient.

The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress (versions up to and including 5.3.17) is vulnerable to Stored Cross-Site Scripting via the 'icon_light' shortcode attribute due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts that execute when a user visits the injected page.

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress (versions up to and including 5.2.1) is vulnerable to Insecure Direct Object Reference via the 'password' parameter due to missing validation on a user-controlled key. An authenticated attacker with vendor-level access can change the WordPress account password of any customer who has placed at least one order with that vendor, enabling account takeover.

The Cooked – Recipe Management plugin for WordPress (versions up to and including 1.16.1) is vulnerable to Stored Cross-Site Scripting via [cooked-timer] shortcode content due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts that execute when a user visits the injected page.

Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit recipient is configured, an attacker can trigger a cold start and direct later error emails to an address under their control, disclosing error and request metadata, and in some cases configuration secrets and other users' session data. This is fixed in 4.1.2.

Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope, and if it overlaps with an unauthorized client's request that raises an error, that client can receive full exception details, including tag context or a serialized exception, and any sensitive data they contain. This is fixed in 4.1.2.

Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header, WHEELS_TEST_CONTEXT cookie, or a test-runner path in the URL. The alternate application uses the same configuration, environment, datasource and debug settings; this is not an authentication bypass or data/debug escalation, but it can bypass maintenance mode, provide a second set of rate-limit counters, and trigger additional startup side effects. This is fixed in 4.2.0.

Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. By uploading a crafted SVG, it is possible to execute scripting in the browser when the SVG image is viewed directly by its URL. The issue is mitigated because Backdrop embeds all uploaded SVG images within <img> tags, which prevents script execution.

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress in versions up to and including 1.3.0 is vulnerable to Directory Traversal via the 's' parameter. An authenticated attacker with administrator-level access can read arbitrary files on the server, and when the Optimize CSS feature is enabled, an unauthenticated visitor can trigger the attack with a single crafted GET request.

The FluentCart plugin for WordPress in versions up to and including 1.7.0 is vulnerable to generic SQL Injection via the 'products[*].variants[*].<attacker-chosen key>' parameter due to insufficient escaping of user input. An authenticated attacker with custom-level access can append SQL queries to extract sensitive data; on FluentCart Pro installs, the Manager shop role also holds the products/edit permission.

Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist.

Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens.

Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig to map other users' servers.

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture one-time download tokens.

Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill.