CVE Vulnerability Catalog

The WpStream plugin contains an authorization bypass vulnerability through a user-controlled key, allowing exploitation of incorrectly configured access control security levels. This issue affects all versions from n/a through 4.11.2 (excluding 4.11.2).

Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content allows Server Side Request Forgery. This issue affects Nelio Content from n/a through <= 4.3.1.

The weDocs plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The Blog Filter plugin for WordPress up to version 1.7.6 contains a DOM-based XSS vulnerability. Improper input neutralization during page generation allows an attacker to inject malicious scripts in the DOM context.

The Nexter Blocks WordPress plugin exposes sensitive system information to unauthorized entities. The vulnerability allows retrieval of embedded sensitive data.

The Directorist plugin for WordPress has an authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 8.5.10.

The Advanced Coupons for WooCommerce Coupons plugin for WordPress up to version 4.7.1.1 contains a DOM-based XSS vulnerability. Improper input neutralization during page generation allows an attacker to inject malicious scripts in the DOM context.

The AI Engine (Pro) plugin for WordPress lacks authorization, allowing an attacker to exploit incorrectly configured access control security levels.

The WordPress plugin Seriously Simple Podcasting up to version 3.14.2 suffers from a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The InstaWP Connect plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 0.1.2.5.

The FOX woocommerce-currency-switcher plugin for WordPress up to version 1.4.5 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The themesflat-addons-for-elementor plugin for WordPress up to version 2.3.2 contains a stored XSS vulnerability. Improper input neutralization during page generation allows an attacker to inject malicious scripts.

The SureCart plugin for WordPress up to version 4.0.2 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.

The Youtube Embed Plus plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 14.2.4.

The Hide My WP Ghost plugin for WordPress has an open redirect vulnerability to untrusted sites, enabling phishing attacks. This affects versions below 7.0.00.

The VK All in One Expansion Unit plugin for WordPress up to version 9.113.3 contains a stored XSS vulnerability. Improper input neutralization during page generation allows an attacker to inject malicious scripts.

The Post Expirator plugin for WordPress up to version 4.9.4 contains a DOM-based XSS vulnerability. Improper input neutralization during page generation allows an attacker to inject malicious scripts in the DOM context.

The CartFlows WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 2.2.3.

The User Feedback plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.10.1.

The Simple History WordPress plugin inserts sensitive information into sent data. The vulnerability allows retrieval of embedded sensitive data.