CVE Vulnerability Catalog

A vulnerability in Apache Qpid Broker-J (through 10.1.0) allows a pre-authentication attacker to leverage type size/count handling to cause excessive allocation. This can lead to a potential denial of service.

A vulnerability in Apache Qpid Broker-J (through 10.1.0) allows a pre-authentication attacker to leverage type size/count handling to cause excessive allocation. This can lead to a potential denial of service.

The Zero Spam for WordPress plugin (up to and including 5.7.10) is vulnerable to Stored Cross-Site Scripting (XSS) via Nested POST Array Keys through its Contact Form 7 integration due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when a user visits the injected page. The payload is delivered by submitting a Contact Form 7 request with a nested POST array key containing arbitrary HTML or JavaScript — PHP parses the field name into a nested array key, which is stored verbatim in the zerospam_log.submission_data column when Zero Spam flags the submission as spam due to the absence of the zerospam_david_walsh_key field.

The Restaurant Menu and Food Ordering plugin for WordPress (up to and including 2.4.14) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'phone_number' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when a user visits the injected page.

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress (up to and including 4.0.2) is vulnerable to Stored Cross-Site Scripting (XSS) via the Avatar Field due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when a user visits the injected page. The zero-length multipart file branch in wppb_save_avatar_value() writes the raw request value directly to user meta, bypassing the wppb_save_attachment_id()/wppb_verify_attachment_id() validation path; the stored payload is later adopted as a WordPress attachment URL and rendered unescaped by wppb_default_fields_make_upload_button() when an administrator views the affected account.

The Themify Builder plugin for WordPress (up to and including 7.8.1) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'css[fonts]' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when a user visits the injected page. The nonce required to reach the vulnerable endpoint is embedded in plain sight within the front-end page markup for all visitors, reducing access control to a CSRF token rather than an authentication barrier and making the endpoint fully exploitable by unauthenticated attackers.

The Repeater Fields for Elementor Forms plugin for WordPress (up to and including 2.2.7) is vulnerable to Stored Cross-Site Scripting (XSS) via Repeater Field Value due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when a user visits the injected page.

The Optima Express IDX plugin for WordPress (versions up to and including 8.7.5) is vulnerable to privilege escalation. The provisionBlogCredentials() function is reachable via the wp_ajax_nopriv_ihf_clear_cache AJAX action without capability checks, nonce verification, or ownership validation, and unconditionally sets the 'author' role for the account with login 'optima-express'. An unauthenticated attacker can register that username (if open registration is enabled) and gain author privileges.

The Premium Packages – Sell Digital Products Securely plugin for WordPress (versions up to and including 7.2.1) is vulnerable to stored cross-site scripting via the 'cart_items[][product_name]' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when a user visits an injected page. The checkout REST route uses permission_callback set to __return_true and the invoice loader performs no order ownership check, allowing an unauthenticated attacker to persist the payload and make it renderable to any logged-in user.

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress (versions up to and including 3.0.2) is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_image function. An authenticated attacker with author-level access or higher can delete arbitrary files on the server. The path restriction to wp-content/uploads is not an effective ownership boundary, as all user attachment files reside within that tree, and authors trivially satisfy the edit_post check on their own galleries.

Improper handling of property-encoding exceptions during AMQP 1.0-to-AMQP 0-10 message conversion in Apache Qpid Broker-J (through 10.1.0) allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers. This occurs via message properties that the target encoder does not handle correctly.

The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress (versions up to and including 9.6.1.0) is vulnerable to privilege escalation. The maybe_update_user_role() function reads the target role directly from an attacker-controlled Gravity Forms entry field and passes it to WP_User::set_role() without validating against an allowlist of permitted roles. An authenticated attacker with Subscriber-level access can elevate privileges to administrator by tampering with the hidden role field at form submission. Exploitation is enabled by $0 orders being synchronously marked as SUCCESS without a real payment, and when no GF User Registration user can be resolved, the role assignment target falls back to $lead['created_by'] – the currently authenticated submitter's own user ID.

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress (versions up to and including 3.0.1) is vulnerable to unauthorized disclosure of private gallery contents. The Modula_Meta::add_metas() function is hooked to wp_head on every frontend request and looks up any post via get_post($_GET['modula_gallery_id']) without verifying the gallery's post_status or the requester's capability to read it. An unauthenticated attacker can enumerate private modula-gallery posts and their member attachments and recover the image's title, description, dimensions, and original upload URL via Open Graph/Twitter meta tags, allowing direct unauthenticated download of the original private image bytes.

The Fancy Product Designer plugin for WordPress (versions up to and including 6.5.2) is vulnerable to stored cross-site scripting via the 'elements[].title' parameter in shortcode orders due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when a user visits an injected page. The injected payload is written to the DOM via innerHTML within the beforeElementAdd JavaScript event handler when processing the elements[].title field from the stored order JSON, meaning execution occurs specifically when an administrator reviews shortcode orders in the WordPress admin panel.

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress (versions up to and including 260814) is vulnerable to remote code execution via the 'first_name' parameter. This is due to insufficient sanitization of the first_name parameter via esc_refs(), which strips only regex backreferences and not PHP tags, before substitution into the eval'd Signup Tracking Codes template, combined with disclosure of the site-global proxy verification key that allows PayPal postback verification to be bypassed. An unauthenticated attacker can execute code on the server. Successful exploitation requires that the site administrator has configured a Signup Tracking Codes template containing the %%first_name%% placeholder (a documented, GUI-supported feature) and that the attacker has obtained the site-global proxy verification key, which is exposed in plaintext in the JSON response of any PayPal Checkout AJAX request on the target site.

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress (versions up to and including 4.9.8) is vulnerable to local file inclusion via the 'page' parameter. An authenticated attacker with subscriber-level access or higher can include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

The BA Book Everything plugin for WordPress (versions up to and including 1.8.27) is vulnerable to stored cross-site scripting via the first_name parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when a user visits an injected page. An unauthenticated attacker can obtain the valid order_id, order_num, and order_hash credentials required to reach the vulnerable action_to_pay() handler simply by placing a guest booking through the public [babe-booking-form] shortcode, making the full exploit chain reachable without any account.

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin (versions up to and including 2.10.1) is vulnerable to stored DOM-based cross-site scripting via the 'form_data' Rich Text Field during Draft Save/Resume due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when a user visits an injected page. Exploitation requires tricking a user into clicking an attacker-supplied draft resume URL, which the attacker constructs using the draft_key and access_token returned directly in the save response.

The Fancy Product Designer plugin for WordPress (versions up to and including 6.5.2) is vulnerable to Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta. The fpd_save_order AJAX action is registered for unauthenticated users without nonce or capability checks, and the strip_tags() sanitization is bypassed using JSON unicode escape sequences that json_decode() converts back to angle brackets when the order is rendered in the admin view.

The Fancy Product Designer plugin for WordPress (versions up to and including 6.5.2) is vulnerable to Stored Cross-Site Scripting via the 'output_format' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. This requires the Pro Export/Genius feature to be enabled, as the vulnerable fpd_pr_export AJAX action is only registered when that feature is active.