CVE Vulnerability Catalog

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the [wpdm_edit_profile] shortcode to be present on a front-end page accessible to Subscriber-level users, who can then submit a multiply entity-encoded payload via the display name field to bypass sanitization.

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lsd[remark]' parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users because the listing-creation branch of the AJAX handler omits a capability check, and the required nonce is publicly emitted on any page containing the [listdom-dashboard] shortcode.

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (versions up to and including 5.7.1) is vulnerable to Insecure Direct Object Reference. A public, unauthenticated AJAX endpoint loads an invoice by a sequential invoice_id without ownership or access-key verification, allowing attackers to enumerate invoices and create or overwrite transaction intents.

The Greenshift – animation and page builder blocks plugin for WordPress (versions up to and including 13.2.0) is vulnerable to Reflected Cross-Site Scripting via the '{{GET:}}' Dynamic Placeholder. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject arbitrary scripts that execute when a user is tricked into clicking a crafted link.

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could reject it. The affected paths are the RFC 9579 PBMAC1 MAC calculator builders, the scrypt parallelization parameter p in the PKCS#8 and PKCS#12 cost guards, the raw JCA PBKDF2 provider, and the bcrypt round count read from an encrypted OpenSSH v1 private key's own kdfoptions. Each now bounds the parameter before deriving, in line with the caps already applied elsewhere in the tree, with the OpenSSH round count configurable through the new org.bouncycastle.openssh.max_rounds property. This completes the bounding begun in 1.85 for the PKCS#8 / PBES2 decryptors (CVE-2026-15055). This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

The Dc Woocommerce Multi Vendor plugin for WordPress (versions up to and including 5.0.18) is vulnerable to SQL Injection via the 'order_by' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint. The value is concatenated directly into an ORDER BY clause and esc_sql() provides no protection, allowing authenticated attackers with vendor-level access (edit_stores capability) to append additional SQL queries.

Improper certificate validation in PkixNameConstraintValidator in Bouncy Castle for .NET (bc-csharp) before 2.7.0 allows an attacker who controls or can obtain certificates from a name-constrained intermediate CA to have certificates accepted for email addresses, DNS names, or URI hosts within excluded subtrees, via names ending with a dot (e.g., rfc822Name, dNSName, uniformResourceIdentifier), because comparison does not remove the trailing root-label dot per RFC 1034.

The MStore API WordPress plugin before 4.22.1 does not restrict which order fields a customer may update. Any authenticated user with a self-registerable account can change the status of their own unpaid order to a paid or fulfilled state and receive goods without paying.

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it. This allows users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site; from version 2.0.18 onward the issue requires a Contributor role or above.

The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it as the cart-item price and store-credit coupon value. This allows unauthenticated users to submit an arbitrary or negative amount, bypassing configured denominations and manipulating the order total to obtain products without paying.

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field. An unauthenticated attacker can set an arbitrary lower price for a purchase.

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API. This allows unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide.

The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user. This allows users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as zero-argument PHP callables on public page loads, leading to sensitive information disclosure and denial of service.

The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.

Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defeating the key authentication MTI/A0 is meant to provide. It also allows a malicious peer to learn the local static private key modulo the small factors of p-1, and to recover it entirely in groups with many such factors.

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an administrator viewing the log and send their browser to an attacker-controlled page.

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing unauthenticated visitors to bypass the coming-soon page and reach the otherwise hidden site, including hidden published pages, by shaping the request so it is mistaken for a login request.

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect visitors to an arbitrary external site.

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages, allowing unauthenticated visitors to retrieve the secret key of any active giveaway that has reCAPTCHA configured.