CVE Vulnerability Catalog

The Qubely plugin for WordPress is vulnerable to Stored XSS. An attacker can inject a malicious script that executes in other users' browsers.

The Mogi plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects all versions from n/a through 1.2.3.

The Livemesh Addons for Elementor plugin for WordPress up to version 9.0 contains a stored XSS vulnerability. Improper input neutralization during page generation allows an attacker to inject malicious scripts.

The Grand Magazine WordPress plugin contains a CSRF vulnerability that allows an attacker to perform unauthorized actions in the context of a logged-in administrator. The flaw affects all versions up to and including 3.5.5.

CSRF vulnerability in Grand Portfolio (grandportfolio) theme up to version 3.3 inclusive. Allows Cross-Site Request Forgery.

CSRF vulnerability in Grand Car Rental (grandcarrental) theme up to version 3.6.9 inclusive. Allows Cross-Site Request Forgery.

The Grand Blog plugin by ThemeGoods for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in versions up to 3.1. An attacker can exploit CSRF to perform unauthorized actions on behalf of an administrator.

The WPSchoolPress plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 2.2.35.

The Getty Images plugin for WordPress is vulnerable to SSRF. An attacker can force the server to send requests to internal network resources.

The WordPress theme Uminex (uminex) by kutethemes has a basic XSS vulnerability due to improper neutralization of script-related HTML tags. This allows code injection and affects versions up to and including 1.0.9.

The DukaMarket theme by kutethemes up to version 1.3.0 has a basic XSS vulnerability, allowing code injection due to improper neutralization of script-related HTML tags.

Missing Authorization vulnerability in wproyal Ashe allows exploiting incorrectly configured access control security levels. This issue affects Ashe from n/a through <= 2.266.

The Armania theme for WordPress has a basic XSS vulnerability due to improper neutralization of script-related HTML tags. This affects versions up to and including 1.4.8.

The WordPress theme TechOne (techone) by kutethemes has a basic XSS vulnerability due to improper neutralization of script-related HTML tags. This allows code injection and affects versions up to and including 3.0.3.

The Biolife WordPress theme has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.2.3.

The Education Base theme for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.0.8.

The NewsExo theme (themearile) contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can trick an administrator into performing unwanted actions.

The Download Attachments plugin for WordPress has an authorization bypass vulnerability through a user-controlled key, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.4.0.

The Download Manager plugin for WordPress is vulnerable to Stored XSS. An attacker can inject a malicious script that executes in other users' browsers.

The JW Player for WordPress plugin lacks authorization, allowing an attacker to exploit incorrectly configured access control security levels.