CVE Vulnerability Catalog

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives initial storage because WooCommerce's sanitize_text_field() and wc_clean() do not strip entity-encoded strings containing no literal '<' character, allowing unauthenticated guest-checkout orders to plant the malicious content.

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to open the stored submission entry in the Forminator Entries view and interact with the planted link, at which point WordPress core's jQuery-based click handler on '.contextual-help-tabs a' evaluates the entity-decoded href as HTML, firing the attacker's payload in the administrator's authenticated wp-admin session.

The Super Forms – Drag & Drop Form Builder plugin for WordPress up to version 6.3.316 is vulnerable to arbitrary file and directory deletion. The vulnerability stems from a missing capability check in the `super_save_form` AJAX handler, allowing Subscriber-level users to create or modify forms and enable the `file_upload_submission_delete` setting, combined with the `submit_form` function passing the attacker-controlled `files[].subdir` value directly to `SUPER_Common::delete_dir()` without sanitization. The `ABSPATH` guard can be trivially bypassed by using a `subdir` value of `wp-config.php`, enabling recursive deletion of files and directories on the server, up to the entire WordPress installation.

The Autoptimize plugin for WordPress up to version 3.1.15.1 is vulnerable to Stored Cross-Site Scripting via the REQUEST_URI path. The vulnerability is due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires the Critical CSS feature to be active with a valid API key configured.

MISP contains an authorization bypass in the event flattening feature. When requesting an event with the flatten option, object-level access control is not re-applied to attributes, allowing unauthorized access. The initial fix introduced an issue with deleted attributes, which was resolved in the final version.

colmux in collectl before version 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it. This allows a local user on a monitored host to inject escape sequences into the terminal of an operator running colmux, via a crafted process name (argv[0]).

The LearnPress – WordPress LMS Plugin for WordPress up to version 4.4.8 is vulnerable to Insecure Direct Object Reference (IDOR) via the `CourseMaterialTemplate::render_material_items()` callback exposed on the public `lp-ajax-handle` (load_content_via_ajax) endpoint. The endpoint is explicitly listed in the no-nonce allowlist and performs no capability check, and the handler decides authorization against one attacker-supplied identifier (course_id) while fetching material rows via a second, independently attacker-supplied identifier (item_id) with no check that the lesson belongs to the authorized course. This allows unauthenticated attackers to read and download course-material files (uploaded and external file paths/URLs) belonging to lessons in paid or enrollment-required courses, provided any single course on the site has 'No Required Enroll' enabled and owns at least one material file.

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress up to version 1.2.3 is vulnerable to privilege escalation. The vulnerability stems from the `wp_update_user_meta` MCP tool in `execute_tool` gating writes solely with `current_user_can('edit_user', $uid)` – which WordPress core's `map_meta_cap` resolves to the `read` primitive when the target user ID matches the caller's own – while enforcing an incomplete meta key blocklist that covers only `user_pass`, `user_activation_key`, and `session_tokens`, leaving the `wp_capabilities` and `wp_user_level` meta keys entirely unprotected. This allows authenticated attackers with Subscriber-level access and above to elevate their privileges to Administrator by issuing a `wp_update_user_meta` call over the MCP JSON-RPC endpoint with `key=wp_capabilities` and an arbitrary role array such as `{'administrator': true}` targeting their own user ID.

MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token counter. The HOTP verification logic compared the submitted token against a counter value cached in the user's session at the time the password was entered, rather than against the authoritative counter stored in the database. Because the session-cached counter is not updated after a token is successfully consumed, an attacker who holds a valid session (password already submitted) can reuse a previously burned HOTP token. Preconditions: the target user has HOTP (paper token) second-factor authentication enabled; the attacker possesses a valid session in which the password step has already been completed (the OTP step is pending); the attacker has access to at least one HOTP token value (e.g., a paper token list). Security impact: bypass of the second authentication factor, allowing unauthorized access to a user's MISP account; corruption of the HOTP counter state, potentially invalidating subsequent legitimate tokens or enabling further replays. Affected versions: <2.5.48.

The Payments for Hubtel WordPress plugin before version 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials.

The Five Star Restaurant Reviews WordPress plugin before version 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a crafted request, including a logged-in administrator.

The Pro Like Button WordPress plugin before version 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

The Extendify plugin for WordPress up to version 3.1.6 is vulnerable to Stored Cross-Site Scripting via the 'styles.blocks' Block Type Key. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. The vulnerability is triggered because registerIncoming() is hooked on rest_request_before_callbacks and runs before WordPress evaluates the route's permission_callback, allowing unauthenticated POST, PUT, or PATCH requests to /wp/v2/global-styles routes to reach the vulnerable code path.

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement. The integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perform SQL injection attacks.

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page. The integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to store scripts that will run in the session of a store administrator.

Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface that does not require authentication. Through this interface, sensitive device configuration data - including the Remote Configuration Password - can be read in cleartext by a remote, unauthenticated attacker.

Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer (administrator) account password.

The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory. This allows unauthenticated users to delete arbitrary files and directories on sites where another installed Cache Enabler plugin before 1.8.17 passes a request-derived URL to its public cache-clearing hook.

The Featured Image from URL (FIFU) WordPress plugin before 6.0.8 and FIFU Premium before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used. This could allow attackers to make a logged-in administrator perform any REST API action, such as creating a new administrator account, via a CSRF attack.

Hitachi Coding Software Suite up to version 3.3.0 contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations.