CVE Vulnerability Catalog

The Yo WordPress plugin from version 1.1 to 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping. This allows unauthenticated attackers to perform SQL injection and read arbitrary database contents including administrator password hashes.

The To Do List Member WordPress plugin from version 1.4 to 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content. This allows unauthenticated users to store active content served from the site's own origin, and to list and delete the files already staged there.

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page. This allows unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into following a crafted link (reflected XSS).

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself. This allows any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby escalate their privileges.

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries. This allows unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.

The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script. This allows unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order.

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated users to run arbitrary JavaScript in the session of an administrator who interacts with the logged entry. Only multisite installations are affected.

The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any role, including administrator, and to be granted it once the request is approved. Exploitation requires the plugin's role selection feature and public account registration to both be enabled.

The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request.

The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to and including 3.15 via the admin_request_handler function. This is due to missing authorization and file type validation in the admin_request_handler function, which is reachable unauthenticated via is_admin() returning true for /wp-admin/admin-post.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. On Apache servers where AllowOverride is enabled, an .htaccess file placed in the upload directory may block direct HTTP retrieval of uploaded files, limiting exploitability to stacks that do not honor .htaccess directives such as nginx, LiteSpeed, and Apache with AllowOverride None.

Transient DOS while parsing frame during channel usage.

Memory Corruption when validating large data buffers from external sources using addition to check buffer length.

Information Disclosure when a pointer is reused after being deallocated.

Memory Corruption when copying unverified data from an external source exceeds the allocated buffer size.

Transient DOS when processing unverified data from a neighboring system causes out of bound memory access.

Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation.

Memory corruption when processing escape handling flow with insufficient user buffer sizes.

Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying.

Transient DOS when processing authentication frames with invalid FILS information element header lengths.

Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.