CVE Vulnerability Catalog

The vulnerability allows a subscriber-level user to perform a Denial of Service (DoS) attack in the WPBase Cache plugin in versions up to and including 5.5.6.

The Missing Authorization vulnerability in the Autoship Cloud for WooCommerce Subscription Products (autoship-cloud) plugin allows exploiting incorrectly configured access control security levels. This issue affects versions from n/a through 2.17.1.

The Wappointment plugin in versions up to and including 2.7.7 contains an Insecure Direct Object References (IDOR) vulnerability that allows an unauthenticated attacker to access resources they should not have permission to.

The Piotnet Addons For Elementor plugin in versions up to and including 7.1.71 allows a user with the Contributor role to download arbitrary files from the server.

The App for Cloudflare® plugin in versions up to and including 1.10.1 contains a Broken Access Control vulnerability that allows a user with the Subscriber role to perform actions beyond their permissions.

The WC Fields Factory plugin in versions up to and including 4.1.12 contains a Cross Site Scripting (XSS) vulnerability that allows a user with the Subscriber role to inject malicious script.

The Ohio Extra plugin in versions up to and including 3.6.8 contains a Cross Site Scripting (XSS) vulnerability that allows a user with the Subscriber role to inject malicious script.

The JetElements For Elementor plugin in versions up to and including 2.9.2.2 contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation.

A vulnerability was identified in SourceCodester Simple Student Information System 1.0 affecting some unknown processing of the file /register.php in the Profile Field Handler component. Manipulation of the firstname/lastname arguments leads to cross site scripting, and the attack may be initiated remotely.

The Delete All Comments of wordpress plugin in versions up to 7.1 contains a missing authorization vulnerability due to incorrectly configured access control security levels. This allows attackers to exploit the misconfigured access control.

The Zero Spam plugin in versions up to and including 5.7.11 contains a Bypass vulnerability that allows an unauthenticated attacker to circumvent protection mechanisms.

The Motors plugin by StylemixThemes in versions up to and including 1.4.124 contains an Insertion of Sensitive Information Into Sent Data vulnerability that allows retrieval of embedded sensitive data.

The Advanced Google reCAPTCHA plugin version 5.40 and earlier contains a vulnerability of unauthenticated broken authentication. This means an attacker can bypass the login process without providing valid credentials.

In the OIDC implementation of Keycloak, specifically in the Device Authorization Grant flow, the minimum authentication level required by a client configuration is not checked. This allows an attacker who has stolen a user's password to bypass mandatory multi-factor authentication and gain unauthorized access to the Keycloak Admin REST API.

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where that secret has been left at its default empty value.

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored site data that referenced the old file path.

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being taken.

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order.

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id.

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as well as post revisions and media metadata.