CVE Vulnerability Catalog

The Listeo theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'soundcloud' shortcode in version less than, or equal to, 2.0.8. Insufficient input sanitization and output escaping on user supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts.

The Tutor LMS plugin for WordPress in versions up to and including 3.8.3 is vulnerable to Sensitive Information Exposure. An authenticated attacker with tutor-level access or above can view assignments for courses they do not teach, which may contain sensitive information.

The Tutor LMS Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 3.8.3 due to missing validation on a user-controlled key in the tutor_assignment_submit() function. An authenticated attacker with Subscriber-level access or above can view and edit assignment submissions of other students.

Wtyczka Simple Registration dla WooCommerce w WordPressie jest podatna na atak Cross-Site Request Forgery we wszystkich wersjach do i włącznie z 1.5.8. Problem wynika z braku walidacji nonce w obsłudze żądań ról na stronie administracyjnej.

The WP VR – 360 Panorama and Free Virtual Tour Builder plugin for WordPress is vulnerable to unauthorized data access in all versions up to and including 8.5.41. This is due to improper verification of user authorization, allowing authenticated attackers with contributor-level access or higher to modify sensitive plugin options.

The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress up to version 4.8.4 is vulnerable to unauthorized data modification due to insufficient capability checks in the post_deactive() and post_activate() functions. This allows authenticated attackers with Editor-level access or above to activate and deactivate licenses.

The GenerateBlocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_option_rest' function in all versions up to, and including, 2.1.1. This makes it possible for authenticated attackers, with contributor level access and above, to read arbitrary WordPress options, including sensitive information such as SMTP credentials, API keys, and other data stored by other plugins.

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'.

The Product Filter by WBW plugin for WordPress (all versions up to and including 3.0.0) is vulnerable to unauthorized data modification due to a missing capability check on the 'approveNotice' action. An unauthenticated attacker can update the plugin's settings.

The Password Protected plugin for WordPress is vulnerable to authorization bypass via IP address spoofing in all versions up to and including 2.7.11. This is due to trusting client-controlled HTTP headers in the pp_get_ip_address() function when the "Use transients" feature is enabled. Attackers can bypass authorization by spoofing these headers with the IP of an authenticated user.

Wtyczka Watu Quiz dla WordPressa jest podatna na przechowywane ataki Cross-Site Scripting (XSS) poprzez nagłówek HTTP Referer w wersjach mniejszych lub równych 3.4.4. Problem wynika z niewystarczającej sanitizacji danych wejściowych i ucieczki danych wyjściowych, gdy opcja 'Zapisz adres URL źródła' jest włączona.

The Open Source Genesis Framework theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's shortcodes in all versions up to, and including, 3.6.0. Insufficient input sanitization and output escaping on user supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts.

A vulnerability in the User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin up to version 1.8.0. Missing capability check on the maybe_load_onboarding_wizard function allows unauthorized access to data, including the administrator email address.

The ShopLentor plugin for WordPress in versions up to and including 3.2.4 is vulnerable to Stored Cross-Site Scripting via the 'button_exist_text' parameter in the 'wishsuite_button' shortcode due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts into pages.

The BackWPup – WordPress Backup & Restore Plugin (versions up to and including 5.5.0) is vulnerable to unauthorized access of data due to a missing capability check on the 'backwpup_working' AJAX action. An authenticated attacker with Subscriber-level access or above can retrieve a backup's filename while a backup is running.

The eRoom – Webinar & Meeting Plugin for WordPress up to version 1.5.6 exposes sensitive information, including Zoom SDK secret keys, in client-side JavaScript. This allows unauthenticated attackers to extract the sdk_secret value and generate valid JWT signatures for unauthorized meeting access.

Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to run arbitrary code that persists across reboots.

Deck Mate 2 lacks a verified secure-boot chain and runtime integrity validation for its controller and display modules. Without cryptographic boot verification, an attacker with physical access can modify or replace the bootloader, kernel, or filesystem and gain persistent code execution on reboot. This weakness allows long-term firmware tampering that survives power cycles. The vendor indicates that more recent firmware updates strengthen update-chain integrity and disable physical update ports to mitigate related attack avenues.

Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. An attacker with access to the update interface (typically via the USB update port) can craft or modify firmware packages to execute arbitrary code as root, persistently compromising the device's integrity and deck randomization process.

Wasmtime, a runtime for WebAssembly, contains a vulnerability in versions from 38.0.0 to before 38.0.3. A bug in the implementation of component-model related host-to-wasm trampolines allows carefully crafting a component that, when called in a specific way, would crash the host with a segfault or assert failure. Wasmtime 38.0.3 has been released and is patched. There are no workarounds.