CVE Vulnerability Catalog

The All in One SEO plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2. An unauthenticated attacker can execute arbitrary shortcodes, which requires the AIOSEO breadcrumb to be rendered on the search results page.

The WPZOOM Connect plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the 'x-yamidoo-signature' parameter. An unauthenticated attacker can extract the full customer card, including name, user ID, order history, license keys, and more, for any arbitrary victim email address.

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reviews[].text' parameter in all versions up to, and including, 7.1.3. An authenticated attacker with subscriber-level access or above can inject arbitrary web scripts that execute when a user visits the injected page.

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary web scripts that execute when a user visits the injected page.

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Parameter Key in versions up to and including 8.7.7 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject scripts that execute if they can trick a user into clicking a link. Successful exploitation requires the enable_help option to be active.

The EmbedPress plugin for WordPress up to version 4.6.6 is vulnerable to stored XSS via the 'slidesShow' block attribute. Authenticated attackers with contributor-level access can inject scripts that execute when a user visits the page.

The ProfilePress plugin for WordPress up to version 4.17.4 is vulnerable to reflected XSS via the 'ppress_billing_address' parameter. Unauthenticated attackers can inject scripts that execute when a user clicks a crafted link.

The LearnPress plugin for WordPress up to version 4.4.7 is vulnerable to reflected DOM-based XSS via the 'orderby' parameter. Unauthenticated attackers can inject scripts that execute when a user clicks a crafted link.

The Beaver Builder plugin for WordPress up to version 2.11.0.5 is vulnerable to blind SQL injection via the 'fields[][value]' parameter. Authenticated attackers with contributor-level access can modify SQL queries and extract sensitive data from the database.

The SupportCandy plugin for WordPress up to version 3.5.3 is vulnerable to time-based SQL injection via the 'sort_by' parameter. Authenticated attackers with appropriate permissions can modify SQL queries and extract sensitive data from the database.

The SupportCandy plugin for WordPress up to version 3.5.3 is vulnerable to stored XSS via the 'name' parameter. Authenticated attackers with subscriber-level access can inject scripts that execute when a user visits the page.

The Ivory Search plugin for WordPress up to version 5.5.18 is vulnerable to reflected XSS via the 's' parameter. Unauthenticated attackers can inject scripts that execute when a user accesses a page with search results.

The Jeg Kit for Elementor plugin for WordPress up to version 3.2.19 is vulnerable to stored XSS via comments. Unauthenticated attackers can inject scripts that execute when a user accesses a page with the comment.

Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The Custom Head Scripts feature did not enforce the Manage permission boundary, allowing members with readWrite permission to configure scripts that execute in the session of higher-privileged users.

OpenAPV before 1.1.1.0 has a heap-based buffer overflow in read_bitstream, which could lead to crashes or potentially arbitrary code execution.

Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve hidden or inactive monitor data by querying dashboard API handlers lacking visibility filters. Attackers can supply a known or guessed monitor tag to endpoints such as monitor-bar and monitor-latency-chart to obtain names, descriptions, status, uptime history and latency.

UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controller/Ticket.php that allows authenticated customers to rate other customers' tickets. Attackers can supply arbitrary ticket IDs, which are loaded without an ownership check, to submit or change satisfaction ratings on tickets owned by other customers.

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping, causing it to execute in the site origin for any visitor viewing the listing.

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or onmouseover handlers to execute script when victims view rendered HTML.

Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obtain the full site configuration, including sensitive settings.