CVE Vulnerability Catalog

The GD Rating System plugin for WordPress is vulnerable to stored cross-site scripting via 'title' and 'url' render args in gdrts_live_handler AJAX in versions up to and including 3.7.1. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Although the AJAX action requires a per-item nonce, that nonce is publicly emitted in the page's JSON block on every page rendering the rating item.

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use. It authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing unauthenticated attackers to obtain a privileged POS session and thereby read customer and site-user personal data and modify store data.

The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query. This allows unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well. This allows storing markup which the plugin's own script later executes in the browser of any visitor or an administrator reviewing the still-unapproved submission.

The Welcart e-Commerce plugin for WordPress is vulnerable to stored cross-site scripting via settlement notification parameters in versions up to and including 2.12.2. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The IPN endpoint accepts 'rel' and 'option' parameters with no authentication, nonce validation, or signature verification.

The GeoDirectory plugin for WordPress is vulnerable to SQL injection via stored latitude/longitude coordinates of a listing in versions up to and including 2.8.186. Authenticated attackers with subscriber-level access and above can append SQL queries to existing queries to extract sensitive information from the database. Exploitation is possible through the public wp_ajax_nopriv_geodir_widget_listings handler with set_post and sort_by parameters.

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to stored cross-site scripting via the 'author' parameter in versions up to and including 1.0.34. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. This is possible because the plugin's esc_html filter callback decodes HTML-entity-encoded payloads back into live HTML.

The Photo Reviews for WooCommerce plugin for WordPress, up to version 1.2.30, is vulnerable to arbitrary content deletion. The plugin stores attacker-controlled post IDs in review comment meta without verifying ownership, and the deletion handler unconditionally deletes all stored IDs. This allows unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media when an administrator deletes the review or when WordPress's cron empties the comment trash after 30 days.

The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin before 2.4.4's review display settings have never been saved.

The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed content fail with a fatal error for all visitors until the review is removed (a persistent denial of service), when user reviews are enabled.

The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attacks against any user, including administrators, viewing a page displaying the review, when user reviews are enabled.

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to privilege escalation via contact identity rebinding. The create_contact function in the v3 REST endpoint is gated only by the add_contacts capability and forwards the full payload, including user_id, to the upsert path, bypassing ownership guards. This allows attackers with Sales Representative-level access and above to rebind a contact to an Administrator's user ID and then use the v4 email-test endpoint to gain an admin session.

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via comments in versions up to and including 5.3.5 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject scripts that execute when a user accesses the page. Exploitation requires comment moderation.

The ProfilePress plugin for WordPress is vulnerable to sensitive information exposure in versions up to and including 4.17.4 via the get_user_profile_structure function. Authenticated attackers with subscriber-level access and above can extract other users' email addresses, login names, and registration dates. When the users_can_register option is enabled, unauthenticated attackers can also exploit this via registration.

The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_id' parameter in versions up to and including 2.13.1 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject scripts that execute when an administrator opens the user record in the wp-admin modal.

The Ultimate Member plugin for WordPress is vulnerable to authorization bypass in versions up to and including 2.13.1. Unauthenticated attackers can view privacy-restricted member profile field values, including owner-only, members-only, or role-restricted fields, by querying the public wp_ajax_nopriv_um_get_members endpoint. The nonce required by the endpoint is available to all visitors.

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP basename on Linux to access files outside the backup directory.

Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all interfaces and send an eight-byte frame to terminate the hosting process, such as an SGLang inference server.

PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the string" is mishandled.