CVE Vulnerability Catalog

Wtyczka URL Image Importer dla WordPressa jest podatna na nieautoryzowane przesyłanie plików z powodu niewystarczającej walidacji typu pliku we wszystkich wersjach do i włącznie z 1.0.6. Problem wynika z polegania wtyczki na nagłówku Content-Type HTTP kontrolowanym przez użytkownika do walidacji przesyłanych plików.

Wtyczka WPBookit dla WordPressa jest podatna na przechowywane ataki Cross-Site Scripting (XSS) poprzez parametr 'css_code' we wszystkich wersjach do i włącznie z 1.0.6, z powodu braku sprawdzenia uprawnień w funkcji save_custome_code(). Umożliwia to nieautoryzowanym atakującym wstrzykiwanie dowolnych skryptów webowych na stronach, które będą wykonywane przy każdym dostępie użytkownika do zainfekowanej strony.

The Return Refund and Exchange For WooCommerce plugin for WordPress up to version 4.5.5 is vulnerable to Insecure Direct Object Reference in the AJAX endpoint 'wps_rma_cancel_return_request' due to missing validation on a user controlled key. This makes it possible for authenticated attackers with Subscriber-level access and above to delete other users' refund requests.

Wtyczka Realty Portal dla WordPressa jest podatna na nieautoryzowaną modyfikację danych, co może prowadzić do eskalacji uprawnień z powodu braku sprawdzenia uprawnień w funkcji 'rp_save_property_settings' w wersjach od 0.1 do 0.4.1. Umożliwia to uwierzytelnionym atakującym, posiadającym dostęp na poziomie Subskrybenta i wyżej, aktualizację dowolnych opcji na stronie WordPress.

The EchBay Admin Security plugin for WordPress (all versions up to and including 1.3.0) is vulnerable to reflected XSS via the '_ebnonce' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute if a user clicks a crafted link.

The UiPress lite plugin for WordPress (versions up to and including 3.5.08) lacks a capability check in the uip_save_site_option() function. An authenticated attacker with Subscriber-level access or above can change arbitrary plugin settings, and other AJAX actions are also affected.

The Bulma Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' shortcode attribute in the bulma-notification shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The AudioTube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' shortcode attribute of the 'audiotube' shortcode in all versions up to, and including, 0.0.3. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Surbma | MiniCRM Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the 'minicrm' shortcode in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Affiliate AI Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'asin' shortcode attribute in the affiai_img shortcode in all versions up to and including 1.0.1. This is due to insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts.

The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress (versions up to and including 2.4.7) lacks a capability check in the saveDeployedContract function. An authenticated attacker with Subscriber-level access or above can overwrite the tokenico_deployed_contracts option and poison displayed smart contract addresses.

The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'createSaleRecord' function in all versions up to, and including, 2.4.7. This makes it possible for unauthenticated attackers to manipulate presales counters.

The BrightTALK WordPress Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'format' shortcode attribute in the brighttalk-time shortcode in all versions up to, and including, 2.4.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Islamic Phrases plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phrases' shortcode attribute in all versions up to, and including, 2.12.2015. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Tips Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tip' shortcode in all versions up to, and including, 0.2.1. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Stock Tools plugin for WordPress (all versions up to and including 1.1) is vulnerable to stored Cross-Site Scripting via the image_height and image_width shortcode attributes. This is due to insufficient input sanitization and output escaping.

The Shortcodes Bootstrap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in the [notification] shortcode in all versions up to, and including, 1.1. This is due to missing input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Display Pages Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'column_count' parameter in the [display-pages] shortcode in all versions up to and including 1.1. This is due to insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts.

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the eh_crm_new_ticket_post() function in all versions up to, and including, 3.3.1. This allows unauthenticated attackers to upload arbitrary files on the server, potentially leading to remote code execution.

The UiPress lite plugin for WordPress in all versions up to and including 3.5.09 is vulnerable to unauthorized modification of data due to a missing capability check on the 'uip_save_ui_template' function. An authenticated attacker with Subscriber-level access or above can save templates containing custom JavaScript.