CVE Vulnerability Catalog

The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks.

The Smart Popup by Supsystic plugin for WordPress up to version 1.13.2 is vulnerable to SQL Injection via the 'sidx' parameter due to insufficient escaping and lack of query preparation.

The JetFormBuilder plugin for WordPress up to version 3.6.6 is vulnerable to Reflected DOM-Based XSS via a query parameter matching the preset's query_var setting. Exploitation requires a form with a text field configured with a query_var Dynamic Preset and a macro reference.

The HivePress plugin for WordPress up to version 1.7.31 is vulnerable to stored XSS via the 'custom text attribute' parameter. Exploitation requires an administrator to configure a Text attribute with a display format placing %value% inside an HTML attribute.

The Simple Newsletter Plugin – Noptin for WordPress up to version 4.3.10 is vulnerable to stored XSS via the 'noptin_fields[<custom_field_merge_tag>]' parameter. The attack requires a published campaign with a [[subscriber.*]] merge tag and uses the manage_preferences form.

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'not_found' parameter in all versions up to and including 3.3.58 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page.

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unquoted popup shortcode attribute in all versions up to and including 7.5.54.7212 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. Successful exploitation requires the profile_videos_enable_bio option to be enabled, as script execution occurs on the author bio/archive page where the profile-video shortcode is rendered.

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell 'data' Value in the updateRows Action in all versions up to and including 1.15.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. This is only exploitable by Subscriber-level users when an administrator has added their role to the plugin's 'access_roles' setting, which is a documented and explicitly supported plugin feature.

The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to and including 1.9.6 due to insufficient input sanitization and output escaping in the flrt_elementor_load_more_anchor() function. The function reads query parameters from $_SERVER['REQUEST_URI'] via getFormActionOrFullPageUrl(true), which URL-decodes them through parse_str() and re-assembles them using build_query() — a WordPress core function that does NOT re-encode values ($urlencode=false). The resulting URL, containing unescaped special characters, is injected into a data-next-page HTML attribute via preg_replace() without esc_attr() or esc_url(). This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into clicking a specially crafted link.

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to and including 1.6.11.11 due to the appointment update REST API endpoint not restricting which fields can be modified by token-authenticated customers. This allows unauthenticated attackers to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type.

The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.7.7 due to the plugin not properly verifying that a user is authorized to perform an action. This allows authenticated attackers with Contributor-level access and above to publish their own Hello+ header/footer templates and draft currently active templates owned by higher-privileged users.

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email (Contact Email custom field htmlvar_name)' parameter in all versions up to and including 2.8.188 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. Successful exploitation requires that an administrator has added and configured the Contact Email custom field to render on the public single-listing output page, and that the administrator subsequently approves the attacker's submitted listing.

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title> in all versions up to and including 5.2.10 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. The payload is not neutralized at save time because post_content stores only a benign block reference to an external feed URL; the malicious HTML is injected at render time from the attacker-controlled RSS feed title, bypassing any save-time wp_kses filtering.

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to and including 3.1.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This allows authenticated attackers with author-level access and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On fresh installations of version 3.1.10 and later, exploitation requires administrator-level access; however, on sites upgraded from a version prior to 3.1.10, the preserveCampaignRoleAccess() migration grants the edit_fireboxes capability to any role that previously held edit_posts, reducing the minimum required privilege to Author-level.

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'inputs (array key)' parameter in all versions up to and including 1.15.48 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action such as clicking on a link.

The Download Manager plugin for WordPress up to version 3.3.71 is vulnerable to sensitive information exposure via the 'first_name' parameter. Authenticated attackers with subscriber-level access can extract the administrator's full Cookie header, including wordpress_logged_in_* session cookies, from the suspension email sent during the administrator's authenticated request. This enables full session hijack and account takeover.

The Anti-Spam by CleanTalk plugin for WordPress up to version 6.88 is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The vulnerability is exploitable once a comment from the attacker's email is approved; on default WordPress installations, only the first comment from a given email is moderated, and subsequent comments auto-approve.

The Download Manager plugin for WordPress up to version 3.3.71 is vulnerable to Stored Cross-Site Scripting via the 'regurl' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page. The injected payload only fires for logged-out visitors, as the vulnerable login-form.php template branch is gated on !is_user_logged_in().

The Fluent Forms plugin for WordPress up to version 6.2.14 is vulnerable to Reflected Cross-Site Scripting via the 'any attacker-chosen name matching the {get.NAME} placeholder' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into clicking a link. Exploitation requires a site administrator to have configured a Custom HTML field on a published form containing a {get.*} SmartCode inside a URL-accepting attribute such as iframe src or a href.

The Table Field Add-on for ACF and SCF plugin for WordPress up to version 1.4.1-RC2 is vulnerable to Stored Cross-Site Scripting via Table Field Value due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access can inject arbitrary web scripts that execute when a user accesses an injected page.