CVE Vulnerability Catalog

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target. Users with the contributor role and above can store a payload that executes in the browser of anyone who follows the link, including an administrator previewing the unpublished submission.

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API.

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set away from its default.

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature (Administrators by default, or Editors when a non-default setting is enabled) to write arbitrary files, including executable PHP, outside the intended upload directory on servers where the PHP zip extension is unavailable, leading to Remote Code Execution.

The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter. An authenticated attacker with subscriber-level access or above can delete arbitrary ticket responses belonging to other users by supplying any stsw_responses row ID.

The Calculated Fields Form plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary' parameter in all versions up to, and including, 5.5.1.5. An unauthenticated attacker can inject arbitrary web scripts if they can trick a user into clicking a link.

The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woosq-redirect' parameter in all versions up to, and including, 4.4.0. An unauthenticated attacker can inject arbitrary web scripts if they can trick a user into clicking a link.

The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role and above to read the contents of arbitrary files on the server, with the copied file then retrievable by unauthenticated visitors.

The SEOPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'seopress_google_analytics_matomo_id' parameter in all versions up to, and including, 10.2. An authenticated attacker with subscriber-level access or above can inject arbitrary web scripts that execute when a user visits the injected page.

The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks, when author reviews are enabled.

The All in One SEO plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2. An unauthenticated attacker can execute arbitrary shortcodes, which requires the AIOSEO breadcrumb to be rendered on the search results page.

The WPZOOM Connect plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the 'x-yamidoo-signature' parameter. An unauthenticated attacker can extract the full customer card, including name, user ID, order history, license keys, and more, for any arbitrary victim email address.

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reviews[].text' parameter in all versions up to, and including, 7.1.3. An authenticated attacker with subscriber-level access or above can inject arbitrary web scripts that execute when a user visits the injected page.

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary web scripts that execute when a user visits the injected page.

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Parameter Key in versions up to and including 8.7.7 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject scripts that execute if they can trick a user into clicking a link. Successful exploitation requires the enable_help option to be active.

The EmbedPress plugin for WordPress up to version 4.6.6 is vulnerable to stored XSS via the 'slidesShow' block attribute. Authenticated attackers with contributor-level access can inject scripts that execute when a user visits the page.

The ProfilePress plugin for WordPress up to version 4.17.4 is vulnerable to reflected XSS via the 'ppress_billing_address' parameter. Unauthenticated attackers can inject scripts that execute when a user clicks a crafted link.

The LearnPress plugin for WordPress up to version 4.4.7 is vulnerable to reflected DOM-based XSS via the 'orderby' parameter. Unauthenticated attackers can inject scripts that execute when a user clicks a crafted link.

The Beaver Builder plugin for WordPress up to version 2.11.0.5 is vulnerable to blind SQL injection via the 'fields[][value]' parameter. Authenticated attackers with contributor-level access can modify SQL queries and extract sensitive data from the database.

The SupportCandy plugin for WordPress up to version 3.5.3 is vulnerable to time-based SQL injection via the 'sort_by' parameter. Authenticated attackers with appropriate permissions can modify SQL queries and extract sensitive data from the database.