CVE Vulnerability Catalog

The Kali Forms plugin for WordPress is vulnerable to remote code execution via the `_save_data()` function. Insufficient validation of the `thisPermalink` field allows unauthenticated attackers to pass a controlled string to `call_user_func()`, enabling code execution on the server.

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal. Authenticated attackers with admin-level access can delete arbitrary files on the server, including wp-config.php, by manipulating a database value.

The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to stored cross-site scripting via form field values. Unauthenticated attackers can inject arbitrary scripts that execute when a user accesses the page.

The AI Engine – The Chatbot, AI Framework & MCP plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the `reauth_for_authorize` function. Unauthenticated attackers can trick an administrator into clicking a link, allowing creation of a new administrator account with attacker-supplied credentials.

The User Profile Builder WordPress plugin before version 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration.

The HUSKY WordPress plugin before version 1.4.1 does not sanitize a stored setting value against directory traversal before using it in a file inclusion path, allowing users with shop manager capability to include and execute arbitrary local files. This is triggered on every front-end request, including for unauthenticated visitors.

The Mapster WP Maps WordPress plugin before version 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished (draft, pending, private, and trashed) posts.

The Login & Register Forms WordPress plugin before version 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both the verification code and the per-source attempt counter on an unauthenticated, client-controlled value. This allows unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.

The DynamicKit for Elementor WordPress plugin before version 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an attacker-controlled host and carries a valid reset key, leading to account takeover when the victim clicks it.

The Chat On Desk Order Notifications WordPress plugin before version 1.0.9 does not verify that the one-time password (OTP) has been validated before processing a password reset request. This allows unauthenticated attackers to reset the password of any user, including administrators, and take over their accounts when SMS OTP password reset is enabled.

The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before version 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response. This allows unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS) against a victim who is induced to send a crafted request.

The Everest Toolkit WordPress plugin through 1.2.3 does not validate file types during demo-content import, allowing high-privilege users (Administrator by default) to upload executable PHP files to the uploads directory.

The Demo Import WordPress plugin through 1.1.3 does not validate file types during demo-content import, allowing high-privilege users (Administrator by default) to upload executable PHP files to the uploads directory.

The Subscriptions for WooCommerce plugin for WordPress up to version 2.0.0 has a privilege escalation vulnerability. The save_meta_boxes() function saves the user role from POST without proper validation, and the 'wps_membership_plan' post type has capability_type 'post', allowing users with Contributor-level access and above to set the role to 'administrator'. Exploitation requires the Pro plugin to be active.

The Bit integrations plugin for WordPress up to version 2.9.0 has a Directory Traversal vulnerability in the processAttachment function. Unauthenticated attackers can read arbitrary files on the server, including sensitive information.

TP-Link AXE75 V1 routers have an OS command injection vulnerability in the VPN module. An adjacent authenticated attacker can execute arbitrary commands by importing a specially crafted VPN client configuration file. The issue is due to improper filtering of special characters.

Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction – the victim must open a malicious file.

FeehiCMS version 2.1.1 contains a vulnerability in the session management module, authentication logic, and logout handler components, allowing an attacker to escalate privileges.

Coturn versions before 4.15.0 with --mobility enabled contain a vulnerability that allows an authenticated attacker to hijack another user's REFRESH session. An attacker who obtains a victim's MOBILITY-TICKET can receive and inject relayed traffic and consume the victim's quota. The issue is due to incorrect identity verification in the resume branch.

PrestaShop module totadministrativemandate versions below 1.8.1 are vulnerable to Cross-Site Request Forgery (CSRF). The payment validation controller lacks a CSRF token, allowing an attacker to confirm an order in awaiting status by hijacking a link.