CVE Vulnerability Catalog

Wtyczka Simple User Registration dla WordPressa jest podatna na przechowywane ataki Cross-Site Scripting (XSS) poprzez parametr 'wpr_admin_msg' we wszystkich wersjach do 6.6 włącznie, z powodu niewystarczającej sanitizacji wejścia i ucieczki wyjścia. Umożliwia to nieautoryzowanym atakującym wstrzykiwanie dowolnych skryptów webowych na stronach, które będą wykonywane, gdy użytkownik uzyska dostęp do zainfekowanej strony.

The WP Delete Post Copies plugin for WordPress (all versions up to and including 6.0.2) is vulnerable to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. An authenticated attacker with administrator-level permissions or above can inject arbitrary web scripts into pages that execute whenever a user accesses the injected page; this only affects multi-site installations and installations where unfiltered_html has been disabled.

Wtyczka Vitepos – Point of Sale (POS) dla WooCommerce w WordPressie jest podatna na nieautoryzowane przesyłanie plików z powodu braku walidacji typów plików w funkcji insert_media_attachment() w wersjach do 3.3.0 włącznie. Funkcja save_update_category_img() akceptuje typy plików dostarczane przez użytkowników bez walidacji, co umożliwia atakującym z poziomem dostępu subskrybenta i wyżej przesyłanie dowolnych plików na serwer dotkniętej witryny.

The Schedule Post Changes With PublishPress Future plugin for WordPress in versions up to and including 4.9.1 is vulnerable to unauthorized modification of data due to a missing authorization check on the saveFutureActionData function. An authenticated attacker with author-level access or higher can change the status of arbitrary posts and pages via the REST API endpoint.

The HT Mega – Absolute Addons For Elementor plugin for WordPress up to version 3.0.0 is vulnerable to Stored Cross-Site Scripting (XSS) in Gutenberg blocks. The vulnerability is due to insufficient input validation on user-supplied HTML tag names, allowing dangerous tags like 'script', 'iframe', and 'object' to be injected.

The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 2.0.5 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to retrieve the output of phpinfo().

The 简数采集器 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.6.3 via the __kds_flag functionality that imports featured images. This allows authenticated attackers with Administrator-level access and above to read the contents of arbitrary files on the server.

The WP Company Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the 'social-networks' shortcode in all versions up to, and including, 1.9.0. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an injected page.

The Shortcode for Google Street View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'streetview' shortcode in all versions up to, and including, 0.5.7. This is due to insufficient input sanitization and output escaping on the 'id' attribute, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts.

The WPSite Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'format' shortcode attribute in the wpsite_y shortcode and the 'before' attribute in the wpsite_postauthor shortcode in all versions up to and including 1.2. This is due to insufficient input sanitization and output escaping in error messages. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.

Wtyczka WP AUDIO GALLERY dla WordPressa jest podatna na nieautoryzowane usuwanie plików z powodu niewystarczającej walidacji ścieżek plików we wszystkich wersjach do 2.0 włącznie. Problem wynika z nieprawidłowej walidacji ścieżek plików dostarczanych przez użytkowników w parametrze `audio_upload` przez handler AJAX `wpag_uploadaudio_callback()`.

Wtyczka Flo Forms – Easy Drag & Drop Form Builder dla WordPressa jest podatna na przechowywane ataki Cross-Site Scripting poprzez przesyłanie plików SVG we wszystkich wersjach do 1.0.43 włącznie. Problem wynika z braku odpowiedniej walidacji zawartości plików przy przesyłaniu przez nieautoryzowany punkt końcowy AJAX (`flo_form_submit`).

The Custom Post Type plugin for WordPress (all versions up to and including 1.0) is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce validation on the custom post type deletion functionality. This makes it possible for unauthenticated attackers to delete custom post types via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The HotelRunner Booking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hotelrunner' shortcode in all versions up to, and including, 5.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The AuthorSure plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.3. Missing nonce validation on the 'authorsure' page allows unauthenticated attackers to update settings and inject malicious scripts via a forged request if an admin clicks a link.

The Import WP – Export and Import CSV and XML files plugin for WordPress up to version 2.14.17 is vulnerable to sensitive information exposure due to a lack of .htaccess protection. Unauthenticated attackers can extract sensitive data from exports stored in /exportwp and import data stored in /importwp.

The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the wps_rma_fetch_order_msgs() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read other user's order messages.

The Pollcaster Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter in the 'pollcaster' shortcode in all versions up to and including 1.0. Insufficient input sanitization and output escaping allows authenticated attackers with contributor-level access to inject arbitrary web scripts.

The Padlet Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'key' parameter in the 'wallwisher' shortcode in all versions up to and including 1.3. Insufficient input sanitization and output escaping allows authenticated attackers with contributor-level access to inject arbitrary web scripts.

The Checkbox plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'wp_ajax_nopriv_checkbox_clean_log' AJAX endpoint in all versions up to and including 2.8.10. This allows unauthenticated attackers to clear log files.