CVE Vulnerability Catalog

The Bread plugin for WordPress in versions up to and including 2.9.12 is vulnerable to information exposure due to the lack of authentication and authorization checks on the settings export functionality (download_settings function), which is registered on the plugins_loaded hook and explicitly allows execution on non-admin (public) pages. The function exports all plugin configuration settings including the protection_password field, which is stored in plaintext. Unauthenticated attackers can retrieve the PDF protection password by accessing the /?export-meeting-list=1 endpoint.

The WP Composer – The Easiest Page Builder plugin for WordPress in versions up to and including 1.0.5 is vulnerable to Stored Cross-Site Scripting via the 'pbwp_raw_shortcode' shortcode due to the shortcode handler decoding Base64-encoded content and outputting it directly without any sanitization or escaping. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The Base64 encoding allows the payload to bypass WordPress's KSES content filtering at save time.

The VW Writer Blog theme for WordPress in versions up to and including 1.3.8 is vulnerable to unauthorized modification of data due to a missing capability check on the 'vw_writer_blog_reset_all_settings' function. Authenticated attackers with Subscriber-level access and above can reset all theme customizer settings to their defaults.

The Ibtana – Ecommerce Product Addons plugin for WordPress in versions up to and including 0.4.7.7 is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepa_use_gt_editor' AJAX action. Authenticated attackers with Subscriber-level access and above can update or delete arbitrary post meta entries via the 'iepa_builder' meta key.

The Wow Elements Addons for Elementor plugin in versions up to and including 1.11.2 is vulnerable to Server-Side Request Forgery due to the plugin passing user-controlled input from the 'Changelog File' setting directly to the wp_remote_get function without adequate validation or sanitization of the URL. Authenticated attackers with Contributor-level access and above can make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services.

The BlockSpare plugin for WordPress in versions up to and including 4.2.6 is vulnerable to authorization bypass due to incorrect logic in the permission callback, using an AND (&&) operator instead of an OR (||) operator. Authenticated attackers with Subscriber-level access and above can bypass authorization checks and create arbitrary posts.

The Metasync plugin for WordPress in versions up to and including 2.6.23 is vulnerable to unauthorized data modification due to a missing capability check in the save_instant_indexing_settings() function. The function is hooked to admin_init and only checks for $_POST['submit'] before writing attacker-supplied $_POST['metasync_post_types'] into the site-wide 'metasync_options_instant_indexing' option, with no current_user_can() check and no nonce verification.

The Search Atlas SEO plugin for WordPress in all versions up to and including 2.6.23 is vulnerable to authorization bypass because it does not properly verify that a user is authorized to perform an action. This allows authenticated attackers with subscriber-level access or above to overwrite the whitelabel settings password with an attacker-controlled value.

The SSL Zen plugin for WordPress in all versions up to and including 4.7.42 is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter due to insufficient input sanitization and output escaping. The vulnerability is only exploitable when in the system_requirements stage.

The Real3D Flipbook Lite plugin for WordPress in versions up to and including 5.1.1 is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute and other unsanitized attributes handled by on_shortcode(). Attribute values are copied verbatim into flipbook options and emitted via wp_json_encode() inside a <script type="application/json"> block without the JSON_HEX_TAG flag, allowing a literal </script> sequence to break out of the JSON script context.

The AppMySite plugin for WordPress in all versions up to and including 3.15.3 is vulnerable to Stored Cross-Site Scripting via the save_ams_license_key AJAX handler due to insufficient input sanitization and output escaping. The handler performs no capability check and no nonce verification, meaning any authenticated user with Subscriber-level access or above can invoke it to store the malicious payload.

The Create plugin for WordPress in all versions up to and including 2.5.3 is vulnerable to generic SQL Injection via the 'order' parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. The vulnerable advanced-filter SQL branch is only entered when at least one of the following parameters is present: linked_posts, created_after, created_before, missing_fields, post_id, a comma-separated type value, or exclude_type.

The Create plugin for WordPress in all versions up to and including 2.5.3 is vulnerable to generic SQL Injection via the 'order_by' parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. The REST endpoint permission callback defaults to the publish_posts capability, meaning any Author-level user or above can reach the vulnerable code path without any additional preconditions.

The OTP Login & Register Woocommerce plugin for WordPress in all versions up to and including 2.7.3 is vulnerable to Stored Cross-Site Scripting via the 'fb-config' setting due to insufficient input sanitization and output escaping. On multisite installations where administrators do not hold the unfiltered_html capability, this vulnerability can be leveraged to target the network super administrator.

The PDF Builder for WooCommerce plugin for WordPress in all versions up to and including 2.0.11 is vulnerable to authorization bypass because it does not properly verify that a user is authorized to perform an action. This allows authenticated attackers with subscriber-level access or above to retrieve invoice numbers, formatted invoice numbers, and creation timestamps for arbitrary WooCommerce orders by supplying any OrderNumber and InvoiceId values with a garbage nonce.

The WP Customer Reviews plugin for WordPress in all versions up to and including 3.7.8 is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' parameter due to insufficient input sanitization and output escaping.

The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes. This allows unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status. This allows unauthenticated attackers to mark a pending order as paid without paying.

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations. This allows users who hold its own administrator-assigned custom role to read, modify and permanently delete other hosts' records and the WordPress user accounts linked to them.

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request. This allows authenticated users holding a Hydra Booking-assigned host role to modify other hosts' profile data and reassign ownership of another host's record to themselves.