CVE Vulnerability Catalog

The Contest Gallery plugin for WordPress up to version 30.0.7 is vulnerable to second-order SQL injection via the cg_multiple_files_for_post and cgRealId parameters. Insufficient escaping and lack of query preparation allow authenticated attackers with author-level access to append additional SQL queries, potentially extracting sensitive information.

The Invisible Anti-Spam & CAPTCHA plugin for WordPress up to version 5.1 is vulnerable to SQL injection via JSON keys/values patterns. Insufficient escaping and lack of query preparation allow authenticated attackers with editor-level access to append additional SQL queries, potentially extracting sensitive information.

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 5.1. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page.

The Invisible Anti-Spam & CAPTCHA plugin for WordPress up to version 5.1 is vulnerable to SQL injection via the 'key' parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with editor-level access to append additional SQL queries, potentially extracting sensitive information.

The Form Maker by 10Web plugin for WordPress up to version 1.15.44 is vulnerable to blind SQL injection via the '{username}' placeholder in a dynamic-choice field. Authenticated attackers with subscriber-level access can append additional SQL queries to extract sensitive information from the database.

The Hydra Booking plugin for WordPress up to version 1.2.2 is vulnerable to stored cross-site scripting via the 'first_name' parameter. Authenticated attackers with host-level access can inject arbitrary web scripts that execute when users access affected pages.

The KiviCare plugin for WordPress up to version 4.5.1 is vulnerable to generic SQL injection via the 'searchTerm' parameter. Authenticated attackers with custom-level access can append additional SQL queries to extract sensitive information from the database.

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires the 'Support Google Consent Mode (GCM)' setting to be enabled.

The Booking calendar, Appointment Booking System plugin for WordPress up to version 3.2.36 has an authorization bypass vulnerability. Unauthenticated attackers can mark reservations as paid or completed, cancel legitimate payments, auto-approve reservations, and trigger transactional emails.

The Image Uploader for Welcart plugin for WordPress up to version 1.4.6 is vulnerable to generic SQL injection via the 'post_title' parameter. Authenticated attackers with author-level access can append additional SQL queries to extract sensitive information from the database.

The MaxUpload plugin for WordPress up to version 1.4.0 is vulnerable to arbitrary file upload via the handle_upload function. Filename validation is inconsistent – extension and MIME checks apply to the uploaded chunk's filename, not to the final assembled filename from the resumableFilename parameter. This allows unauthenticated attackers to upload executable files, potentially leading to remote code execution.

The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The synchronize_session() function performs no validation, allowing unauthenticated attackers to log in as any user, including administrators.

The Propovoice plugin for WordPress up to version 1.7.8 is vulnerable to privilege escalation. The create() function in the REST endpoint fails to validate the role parameter against an allowlist and omits the promote_users capability check, passing the value directly to WP_User::set_role(). Authenticated attackers with ndpv_manager access can create an administrator account.

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. The AJAX handler lacks verification, allowing unauthenticated attackers to log in as any existing user, including administrators.

The Object Sync for Salesforce plugin for WordPress is vulnerable to unauthenticated SQL injection via the wordpress_object_type parameter in the REST route /wp-json/object-sync-for-salesforce/push/. The can_process() function only checks the HTTP method, and the parameter value is directly concatenated into a SQL query. Attackers can inject additional SQL queries, allowing extraction of sensitive data such as password hashes.

The bLoyal plugin for WordPress up to version 3.1.611.78 is vulnerable to privilege escalation. The AJAX actions save_bloyal_configuration_data and save_bloyal_accesskeyverification_data lack capability and nonce checks, and the bloyal_customer_auto_login function unconditionally trusts the Customer.ExternalId value from the API URL. Authenticated attackers with Subscriber-level access can overwrite the API URL and log in as any user, including administrator.

The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. Unauthenticated attackers can delete arbitrary files, potentially leading to remote code execution.

The Online Booking & Scheduling Calendar for WordPress by vcita plugin up to version 4.6.0 is vulnerable to stored cross-site scripting via the business_id parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user accesses an injected page.

The Pinpoint Booking System – Version 2 plugin for WordPress up to version 2.9.9.6.8 is vulnerable to price manipulation via the 'cart_data' parameter. Unauthenticated attackers can override the WooCommerce checkout price of any bookable product to an arbitrary value, enabling purchase at a self-chosen price.

In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.