CVE Vulnerability Catalog

Wtyczka Academy LMS dla WordPressa jest podatna na wstrzyknięcie obiektów PHP we wszystkich wersjach do 3.3.8 włącznie, poprzez deserializację niezaufanych danych w funkcji 'import_all_courses'. Umożliwia to uwierzytelnionym atakującym z dostępem na poziomie Administratora wstrzyknięcie obiektu PHP.

The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution up to version 3.3.8 is vulnerable to sensitive information exposure via the 'enqueue_social_login_script' function. Unauthenticated attackers can extract sensitive data including the Facebook App Secret if Facebook Social Login is enabled.

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'create_refund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, with Contributor-level access and above, to update the status of refund requests, including approving and refusing refunds.

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized booking note creation due to a missing capability check on the 'booking_add_notes' function in all versions up to, and including, 4.2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add a note to the backend view of any booking.

Wtyczka Better Find and Replace – AI-Powered Suggestions dla WordPressa jest podatna na ograniczoną iniekcję kodu we wszystkich wersjach do i włącznie z 1.7.7. Problem wynika z niewystarczającej walidacji danych wejściowych oraz ograniczeń w funkcji 'rtafar_ajax'.

The Ovatheme Events Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the /class-ovaem-ajax.php file in all versions up to, and including, 1.8.6. This makes it possible for unauthenticated attackers to delete ticket files, download tickets, and more.

The WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 3.6.2. This is due to the plugin relying on a user controlled value 'optin_allow_registration' to determine if user registration is allowed, instead of the site-specific setting. This makes it possible for unauthenticated attackers to register new user accounts, even when user registration is disabled.

The Mang Board WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mp' parameter up to version 2.3.1. This is due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they trick a user into clicking a link.

The Download Manager plugin for WordPress is vulnerable to unauthorized access due to a hardcoded Cron key used in the deleteExpired() and clearTempDataCPCron() functions in all versions up to, and including, 3.3.30. This makes it possible for unauthenticated attackers to trigger these cron jobs leading to deletion of expired posts and clearing cache.

The Contact Form 7 AWeber Extension plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_aweber_logreset' AJAX endpoint in all versions up to, and including, 0.1.42. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the AWeber logs.

Wtyczka Smart Auto Upload Images dla WordPressa jest podatna na nieautoryzowane przesyłanie plików z powodu braku walidacji typu pliku w funkcjonalności automatycznego tworzenia obrazów we wszystkich wersjach do i włącznie z 1.2.0. Umożliwia to uwierzytelnionym atakującym, posiadającym dostęp na poziomie Contributor i wyżej, przesyłanie dowolnych plików na serwer dotkniętej witryny.

The HTML Forms – Simple WordPress Forms Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 1.5.5 due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adding scripts in all versions up to, and including, 1.1.6 due to insufficient capability checks. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The WP2Social Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage up to version 2.4.7. This is due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they trick a user into clicking a link.

The Course Booking System plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check in the csv-export.php file in all versions up to and including 6.1.5. This allows unauthenticated attackers to directly access the file and obtain an export of all booking data.

The WPFunnels plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpfnl_delete_log() function in all versions up to, and including, 3.6.2. This makes it possible for authenticated attackers with Administrator-level access and above to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to SQL Injection via the 'post_types' parameter in all versions up to and including 3.40.0 due to insufficient escaping and lack of preparation on the SQL query. This allows authenticated attackers with Editor-level access and above to append additional SQL queries to extract sensitive information from the database.

The Groups plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.0 via the 'group_id' parameter of the group_join function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to register for groups other than ones set in the shortcode.

The Simple Downloads List plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the 'wp_ajax_neofix_sdl_edit' AJAX endpoint and many others in all versions up to and including 1.4.3. This allows authenticated attackers with Subscriber-level access and above to alter many plugin settings/downloads and inject malicious web scripts.

Wtyczka Asgaros Forum dla WordPressa jest podatna na atak typu SQL Injection poprzez ciasteczko '$_COOKIE['asgarosforum_unread_exclude']' we wszystkich wersjach do 3.1.0 włącznie, z powodu niewystarczającego zabezpieczenia parametru dostarczonego przez użytkownika oraz braku odpowiedniego przygotowania istniejącego zapytania SQL. Umożliwia to nieautoryzowanym atakującym dodawanie dodatkowych zapytań SQL do już istniejących zapytań, co może prowadzić do wyciągania wrażliwych informacji z bazy danych.