CVE Vulnerability Catalog

OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects.

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream(). These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.

The Partial Shipment for Woocommerce plugin for WordPress in versions up to and including 3.4 is vulnerable to Missing Authorization via the 'wxp_order_shipment', 'wxp_order_item_shipment', and 'wxp_order_set_shipped' AJAX actions. Lack of capability checks, nonce verification, and order ownership validation allows authenticated attackers with Subscriber-level access and above to read arbitrary order item details and modify shipment status of any order.

The Empik for Woocommerce plugin for WordPress in all versions up to and including 1.5.1 is vulnerable to authorization bypass. The plugin does not properly verify that a user is authorized to perform an action, allowing authenticated attackers with subscriber-level access and above to modify arbitrary WooCommerce product metadata, including Empik logistic class, product state, and export/offer flags.

The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress in all versions up to and including 2.6.65 is vulnerable to authorization bypass. The plugin does not properly verify that a user is authorized to perform an action, allowing authenticated attackers with subscriber-level access and above to create and cancel real shipping orders via the external logistics API, modify arbitrary WooCommerce order post meta, overwrite the plugin's stored API token, and trigger shipping notification emails.

The WordLift – AI powered SEO – Schema plugin for WordPress in all versions up to and including 3.54.10 is vulnerable to Sensitive Information Exposure via the JSON-LD REST API endpoints. The /wordlift/v1/jsonld/ routes are registered with a permission_callback of '__return_true', and the converter retrieves posts via get_post() without verifying post status or user capabilities, allowing unauthenticated attackers to read metadata of private, draft, and pending posts.

The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pop_tag' parameter in all versions up to and including 1.3.15 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to and including 7.9 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into clicking a link. Exploitation requires a validly signed 'esi' value in the GET query string and a separate attacker-controlled 'esi' payload as a POST body field, relying on PHP's default $_REQUEST merge order.

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to and including 4.5.13 due to insufficient input sanitization and output escaping. In the user_meta_save() function scalar values bypass the sanitization logic that only processes arrays, allowing the spinner field value to be stored in user meta without proper sanitization. Later, this value is rendered in an unquoted HTML attribute without escaping, enabling authenticated attackers with subscriber-level access and above to inject arbitrary web scripts.

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to and including 2.1.4 due to missing capability checks on popup management actions. This allows authenticated attackers with Subscriber-level access and above to create arbitrary popups and inject malicious JavaScript that executes when the popup is displayed, leading to Stored XSS.

The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.4.1 due to the plugin not properly verifying that a user is authorized to perform an action. This allows unauthenticated attackers to overwrite the merchant's stored TikTok integration access token in wp_options, hijacking the site's TikTok Business and product catalog integration. Successful exploitation requires the attacker to supply a valid TikTok OAuth auth_code issued for the merchant's registered TikTok app.

The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'post_ID' parameter in all versions up to and including 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This allows authenticated attackers with contributor-level access and above to append additional SQL queries into existing ones, potentially extracting sensitive information from the database. The capability check is bypassable because WordPress internally casts $id to an integer for permission evaluation while the full unsanitized string is passed to the SQL sink.

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to and including 5.0.8. The publicly accessible `woocommerce_api_wt_stripe` webhook endpoint wraps the only call to `\Stripe\Webhook::constructEvent()` inside an `if (!empty($endpoint_secret))` guard that is never entered on default installations because the `eh_stripe_webhook_secret` option is empty after a fresh install. This causes the raw, attacker-controlled POST body to be decoded and processed as a fully trusted Stripe event without any signature verification, authentication, or authorization. This allows unauthenticated attackers to send forged Stripe webhook events to manipulate WooCommerce order statuses, including marking unpaid orders as paid or completed, forcing legitimate orders into a failed state, fabricating dispute notifications, and injecting forged refund events. The vulnerability is only exploitable when the Stripe webhook signing secret has not been configured.

The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 3.0 due to the license_activate_fleximp() and license_deactivate_fleximp() functions, hooked to AJAX actions, lacking both a capability check and nonce verification. This allows authenticated attackers with subscriber-level access and above to activate an arbitrary/fraudulent license key or deactivate the site's legitimate license, disrupting the plugin's premium functionality.

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.12.27 via the handle_customers_ajax. This allows authenticated attackers with contributor-level access and above to extract the full customer dataset from the ea_customers table, including personally identifiable information such as names, email addresses, mobile numbers, dates of birth, and physical addresses.

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to and including 4.14.0 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into clicking a link.

The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress in versions up to and including 7.0.02 is vulnerable to Open Redirect due to improper validation of user input. Unauthenticated attackers can redirect users to potentially malicious sites if they trick them into clicking a specially crafted link. Exploitation requires tricking a logged-in user into clicking a crafted logout URL; the victim is fully logged out via wp_logout() before the malicious redirect is issued.

The GoPay for WooCommerce plugin for WordPress in versions up to and including 1.0.36 is vulnerable to generic SQL Injection via the 'log_table_filter' parameter due to insufficient escaping of user-supplied input and lack of sufficient preparation on the existing SQL query. Authenticated attackers with shop manager-level access and above can append additional SQL queries into existing queries, allowing extraction of sensitive information from the database.

The WP Optimizer plugin for WordPress in versions up to and including 2.5.0 is vulnerable to SQL Injection via the 's' parameter due to an unsafe subquery-detection branch in the Query::parse_key_compare_field() method. When the user-supplied value matches the regex ^[(\s]*SELECT\s+, it is wrapped in parentheses and embedded directly into the SQL string without escaping. Authenticated attackers with administrator-level access can inject arbitrary SQL subqueries, including time-based blind payloads, allowing extraction of sensitive information from the database.

The Redux Framework plugin for WordPress in versions up to and including 4.5.13 is vulnerable to Stored Cross-Site Scripting via the Media field filter values due to insufficient input sanitization of nested array values in the user_meta_save() function and unsafe output of filter CSS values in the render() function without proper escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.