CVE Vulnerability Catalog

Insertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded Sensitive Data.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.24.

Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions.

Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.

The Gravity Booster – Styles & Layouts for Gravity Forms plugin version 6.0 and earlier has a broken access control vulnerability exploitable by Subscriber users. This means a subscriber can gain unauthorized access to functions they should not have permissions for.

The RomethemeForm For Elementor plugin version 1.2.6 and earlier has a broken access control vulnerability exploitable by Contributor users. This means a contributor can gain unauthorized access to functions they should not have permissions for.

Starter Templates by Kadence WP versions up to 2.3.3 contain an unauthenticated Denial of Service (DoS) vulnerability. An attacker can cause service unavailability without authentication.

The Masteriyo - LMS plugin for WordPress (through version 2.3.2) allows unrestricted upload of files with dangerous types. This enables an attacker to upload and execute a web shell on the web server.

The User Registration plugin version 5.2.6 and earlier has a broken authentication vulnerability exploitable by Subscriber users. This means a subscriber can gain unauthorized access to accounts or functions they should not have permissions for.

Unauthenticated Broken Access Control vulnerability in Charitable versions up to 1.8.11.3.

Trix, a what-you-see-is-what-you-get rich text editor, prior to version 2.1.17 is vulnerable to cross-site scripting via a data-trix-serialized-attributes attribute that bypasses the DOMPurify sanitizer. An attacker can craft HTML with this attribute containing a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session, potentially leading to unauthorized actions or disclosure of sensitive information.

The MasterStudy LMS plugin version 3.7.41 and earlier has a broken access control vulnerability exploitable by Subscriber users. This means a subscriber can gain unauthorized access to functions they should not have permissions for.

Unauthenticated Local File Inclusion vulnerability in Restaurant Menu by MotoPress versions up to 2.4.11.

The Flutterwave WooCommerce plugin version 3.3.0 and earlier has a broken authentication vulnerability that does not require authentication. This means an unauthenticated attacker can gain unauthorized access to functions or data.

The Piraeus Bank WooCommerce Payment Gateway plugin version 3.2.0 has a broken authentication vulnerability that does not require authentication. This means an unauthenticated attacker can gain unauthorized access to functions or data.

Unauthenticated Deserialization of untrusted data vulnerability in Youzify plugin versions up to 1.3.7. An attacker without authentication can deserialize data, potentially leading to remote code execution.

Subscriber Broken Authentication vulnerability in MWB HubSpot for WooCommerce versions up to 1.6.7.

The Booking calendar, Appointment Booking System plugin version 3.2.36 and earlier has an insecure direct object references (IDOR) vulnerability that does not require authentication. This means an unauthenticated attacker can access objects (e.g., bookings) without authorization.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Subscribe2 versions up to 10.46.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. It has been marked as a duplicate of CVE-2026-12965.

The CTX Feed plugin version 6.6.47 and earlier has an arbitrary file download vulnerability exploitable by users with the Shop manager role. This means a shop manager can download arbitrary files from the server that they should not have access to.