CVE Vulnerability Catalog

The Tribal WordPress plugin inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions up to and including 1.3.4.

The UiCore Elements plugin for WordPress (versions up to and including 1.3.14) contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject a malicious script that executes in other users' browsers.

The Accept PayPal Payments using Contact Form 7 extension for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 4.0.4.

Missing authorization in the Make My Trivia plugin allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.1.0.

The MIPL WC Multisite Sync plugin for WordPress up to version 1.4.4 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.

Missing authorization in the Precious Metals Automated Product Pricing – Pro plugin allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 4.0.5.

The WPBITS Addons For Elementor Page Builder plugin for WordPress (versions up to and including 1.8.1) contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject a malicious script that executes in other users' browsers.

The Animation Addons for Elementor plugin for WordPress (versions up to and including 2.6.1) contains a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject a malicious script that executes in the victim's browser.

The WordPress plugin ShopWP (wpshopify) has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects versions up to and including 5.2.4.

Missing authorization in the WowOptin plugin allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.4.32.

The AI Workflow Automation plugin for WordPress up to version 1.4.2 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.

Missing authorization in the The Publisher Desk ads.txt plugin allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.5.0.

The MAIO – The new AI GEO / SEO tool plugin for WordPress up to version 6.2.8 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.

The Elfsight WhatsApp Chat CC plugin for WordPress (versions up to and including 1.2.0) contains a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject a malicious script that executes in the victim's browser.

Server-Side Request Forgery (SSRF) vulnerability in podigee Podigee podigee allows Server Side Request Forgery. This issue affects Podigee: from n/a through <= 1.4.0.

Missing authorization in the Simply Schedule Appointments plugin allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.6.10.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fesomia FSM Custom Featured Image Caption fsm-custom-featured-image-caption allows DOM-Based XSS. This issue affects FSM Custom Featured Image Caption: from n/a through <= 1.25.1.

The tagDiv Composer plugin for WordPress (versions up to and including 5.4.3) contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject a malicious script that executes in other users' browsers.

Missing Authorization vulnerability in Cryptocurrency Donation Box – Bitcoin & Crypto Donations up to version 2.2.13 allows exploiting incorrectly configured access control security levels.

The Author Avatars List/Block plugin for WordPress (versions up to 2.1.25) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.