CVE Vulnerability Catalog

The Events Made Easy plugin for WordPress in versions up to and including 3.3.1 is vulnerable to stored cross-site scripting via the 'width' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary scripts that execute when a user visits the injected page.

The Cool FormKit Lite plugin for Elementor in versions up to and including 2.7.9 is vulnerable to stored DOM-based cross-site scripting via the '_elementor_data.form_fields[].custom_id' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary scripts that execute when a user visits the injected page.

The Page and Post Restriction plugin for WordPress in versions up to and including 1.6.1 is vulnerable to authentication bypass. The papr_restrict_page_post_rest_api() function re-authenticates the user from the wordpress_logged_in cookie without verifying a REST nonce, which combined with permissive REST CORS allows an unauthenticated attacker to read REST API responses as a logged-in victim.

The Firelight Lightbox plugin for WordPress before 2.3.23 does not escape the URL of links opened in its Classic lightbox before inserting them into the page as HTML. This allows users with a role as low as Contributor to perform stored cross-site scripting attacks against users who click a crafted link.

The BuddyForms plugin for WordPress before 2.10.1 does not verify that a user editing an existing entry is the author of the target post. This allows users with edit access to a form, as low as Subscriber, to overwrite the title, content, and status of any other user's posts or pages, including those of administrators.

The BuddyForms plugin for WordPress before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration. This allows unauthenticated users to download any form's stored settings, including notification recipient email addresses and reCAPTCHA secret keys.

The Fraud Prevention For WooCommerce and EDD plugin for WordPress before 2.3.6 does not check that a user is allowed to manage orders before letting them add an order's customer details to the store's fraud blacklist. This allows users with the Subscriber role and above to prevent arbitrary legitimate customers from placing orders.

The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end. This could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including administrators.

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement. This allows high-privilege users such as administrators to perform SQL injection attacks.

The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The affected action is gated by an anonymous nonce that only validates for logged-out requests, so the payload executes against logged-out visitors rather than authenticated users.

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks. This allows a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials.

The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. The plugin accepts arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete files when a subsequent draft references the poisoned draft via the previous_draft_id parameter, allowing unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory.

The Xray Audit module for Drupal contains a missing authorization vulnerability that allows forceful browsing of restricted resources. This issue affects versions from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, and from 3.0.0 to 3.1.1.

A Missing Authorization vulnerability in the Drupal Commerce Core module allows Forceful Browsing. The issue affects versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.

The vulnerability in the Drupal Domain Login Restrict module allows authentication bypass using an alternate path or channel. This issue affects versions from 0.0.0 to 1.5.0.

The Drupal Examples for Developers module contains an Allocation of Resources Without Limits or Throttling vulnerability that allows excessive allocation. This issue affects Examples for Developers versions from 0.0.0 to 4.0.7.

The Drupal Freelinking module contains a Server-Side Request Forgery (SSRF) vulnerability that allows server-side request forgery. This issue affects Freelinking versions from 0.0.0 to 4.0.3.

The SmartLinker AI module for Drupal contains an incorrect authorization vulnerability that allows forceful browsing. This issue affects versions from 0.0.0 to 1.0.3.

The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability involving insertion of sensitive information into sent data, allowing forceful browsing. This issue affects versions from 0.0.0 to 5.4.1 and from 5.5.0 to 5.5.2.

The DKAN module for Drupal contains a missing authorization vulnerability that allows forceful browsing. This issue affects versions from 0.0.0 to 4.0.4 and from 4.1.0 to 4.1.5.