CVE Vulnerability Catalog

The Simple Newsletter Plugin – Noptin for WordPress up to version 4.3.10 is vulnerable to stored XSS via the 'noptin_fields[<custom_field_merge_tag>]' parameter. The attack requires a published campaign with a [[subscriber.*]] merge tag and uses the manage_preferences form.

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'not_found' parameter in all versions up to and including 3.3.58 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page.

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unquoted popup shortcode attribute in all versions up to and including 7.5.54.7212 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. Successful exploitation requires the profile_videos_enable_bio option to be enabled, as script execution occurs on the author bio/archive page where the profile-video shortcode is rendered.

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell 'data' Value in the updateRows Action in all versions up to and including 1.15.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. This is only exploitable by Subscriber-level users when an administrator has added their role to the plugin's 'access_roles' setting, which is a documented and explicitly supported plugin feature.

The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to and including 1.9.6 due to insufficient input sanitization and output escaping in the flrt_elementor_load_more_anchor() function. The function reads query parameters from $_SERVER['REQUEST_URI'] via getFormActionOrFullPageUrl(true), which URL-decodes them through parse_str() and re-assembles them using build_query() — a WordPress core function that does NOT re-encode values ($urlencode=false). The resulting URL, containing unescaped special characters, is injected into a data-next-page HTML attribute via preg_replace() without esc_attr() or esc_url(). This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into clicking a specially crafted link.

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to and including 1.6.11.11 due to the appointment update REST API endpoint not restricting which fields can be modified by token-authenticated customers. This allows unauthenticated attackers to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type.

The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.7.7 due to the plugin not properly verifying that a user is authorized to perform an action. This allows authenticated attackers with Contributor-level access and above to publish their own Hello+ header/footer templates and draft currently active templates owned by higher-privileged users.

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email (Contact Email custom field htmlvar_name)' parameter in all versions up to and including 2.8.188 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. Successful exploitation requires that an administrator has added and configured the Contact Email custom field to render on the public single-listing output page, and that the administrator subsequently approves the attacker's submitted listing.

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title> in all versions up to and including 5.2.10 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. The payload is not neutralized at save time because post_content stores only a benign block reference to an external feed URL; the malicious HTML is injected at render time from the attacker-controlled RSS feed title, bypassing any save-time wp_kses filtering.

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to and including 3.1.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This allows authenticated attackers with author-level access and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On fresh installations of version 3.1.10 and later, exploitation requires administrator-level access; however, on sites upgraded from a version prior to 3.1.10, the preserveCampaignRoleAccess() migration grants the edit_fireboxes capability to any role that previously held edit_posts, reducing the minimum required privilege to Author-level.

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'inputs (array key)' parameter in all versions up to and including 1.15.48 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action such as clicking on a link.

The Download Manager plugin for WordPress up to version 3.3.71 is vulnerable to sensitive information exposure via the 'first_name' parameter. Authenticated attackers with subscriber-level access can extract the administrator's full Cookie header, including wordpress_logged_in_* session cookies, from the suspension email sent during the administrator's authenticated request. This enables full session hijack and account takeover.

The Anti-Spam by CleanTalk plugin for WordPress up to version 6.88 is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The vulnerability is exploitable once a comment from the attacker's email is approved; on default WordPress installations, only the first comment from a given email is moderated, and subsequent comments auto-approve.

The Download Manager plugin for WordPress up to version 3.3.71 is vulnerable to Stored Cross-Site Scripting via the 'regurl' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page. The injected payload only fires for logged-out visitors, as the vulnerable login-form.php template branch is gated on !is_user_logged_in().

The Fluent Forms plugin for WordPress up to version 6.2.14 is vulnerable to Reflected Cross-Site Scripting via the 'any attacker-chosen name matching the {get.NAME} placeholder' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into clicking a link. Exploitation requires a site administrator to have configured a Custom HTML field on a published form containing a {get.*} SmartCode inside a URL-accepting attribute such as iframe src or a href.

The Table Field Add-on for ACF and SCF plugin for WordPress up to version 1.4.1-RC2 is vulnerable to Stored Cross-Site Scripting via Table Field Value due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access can inject arbitrary web scripts that execute when a user accesses an injected page.

The ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information can be read by reflectively invoking the interface.

The Bookly plugin for WordPress up to version 28.4 is vulnerable to Insecure Direct Object Reference via the 'id, wp_user_id' parameter due to missing validation on a user-controlled key. Authenticated attackers with subscriber-level access can overwrite the WordPress account binding of any Bookly staff record, including those owned by administrators, effectively hijacking a higher-privileged staff member's account association and escalating privileges.

The Bookly plugin for WordPress up to version 28.4 is vulnerable to sensitive information exposure via the classic booking form's Details step. The endpoint bookly_render_details is registered for both wp_ajax and wp_ajax_nopriv, the module overrides csrfTokenValid() to always return true, and getCodes() loads the persisted Customer entity keyed solely by the attacker-supplied phone (or email) with no invocation of customerIdentityConfirmed(). When placeholders like {client_name}, {client_email}, {client_phone}, or {client_note} are placed in the Details step's information text, the matched customer's stored data is substituted into the returned HTML.

The Advanced Classifieds & Directory Pro plugin for WordPress up to version 3.4.4 is vulnerable to Stored Cross-Site Scripting via the 'phone' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with custom-level access can inject arbitrary web scripts that execute when a user accesses an injected page. The vulnerability is only exploitable on sites where the 'Force Bootstrap' setting is enabled and the 'ACADP Listing Address' widget is placed on a sidebar displayed on single listing pages; both conditions are non-default.