CVE Vulnerability Catalog

The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress in versions up to and including 1.2.0 is vulnerable to Sensitive Information Exposure via the 'image_hub_api_keys_* (6 options)' parameter. An authenticated attacker with subscriber-level access and above can extract plaintext API credentials for six third-party services — Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash — emitted verbatim into every admin page's HTML via wp_localize_script. The leaked HTML also contains a valid image_hub_nonce AJAX nonce, which — combined with the absence of any capability check in the image_hub_update_settings AJAX handler — allows the same attacker to overwrite all six stored API credential options via update_option().

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress (versions up to and including 3.16.0.6) is vulnerable to authorization bypass due to improper verification of user authorization. An unauthenticated attacker can retrieve billing PII (full name, street address, email address, phone number) for any WooCommerce order by submitting an enumerable sequential order ID.

The Modula Image Gallery plugin for WordPress (versions up to and including 3.0.11) is vulnerable to sensitive information exposure via the 'id' parameter in /wp-json/wp/v2/modula-gallery/{id}. An unauthenticated attacker can extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field.

The My Calendar – Accessible Event Manager plugin for WordPress (versions up to and including 3.8.7) is vulnerable to privilege escalation. The mcs parameter is reflected unsanitized, allowing an unauthenticated attacker to inject a nested [my_calendar above=...] shortcode, which then calls arbitrary PHP functions via call_user_func(), including edit_user(), leading to administrator account takeover.

The Forminator Forms plugin for WordPress (versions up to and including 1.58.1) allows unauthenticated attackers to execute arbitrary shortcodes because a value passed to do_shortcode is not properly validated. Exploitation is possible on any block-theme install via a single unauthenticated GET request to the search results page or by submitting an anonymous comment, with no Forminator-specific content required.

The miniOrange OTP Login plugin for WordPress (versions up to and including 5.5.8) is vulnerable to authentication bypass via the mo_by_pass_login() function. The mo_delay_otp_process() short-circuits the authentication flow before password validation, and the Delay OTP grace flag is stored in user meta without binding to the session, allowing an unauthenticated attacker to log in as any user, including administrators.

The FluentCart plugin for WordPress (versions up to and including 1.7.0) is vulnerable to Insecure Direct Object Reference (IDOR) via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user-controlled key. An unauthenticated attacker can read and exfiltrate another customer's stored billing and shipping address PII, including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID.

The Gwolle Guestbook plugin for WordPress (versions up to and including 5.1.1) is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute if a user is tricked into clicking a crafted link.

The Forminator Forms plugin for WordPress (versions up to and including 1.58.1) allows unauthenticated attackers to execute arbitrary shortcodes because forminator_replace_quiz_form_data() invokes do_shortcode() on the notification body after the {quiz_result} merge tag is substituted, while earlier-substituted {user_agent} and {refer_url} tags carry attacker-controlled bytes that are not stripped of shortcode delimiters. Submitting a quiz whose notification template contains {quiz_result} is sufficient.

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (versions up to and including 7.5.5) is vulnerable to stored Cross-Site Scripting (XSS) via comment content and the yotu-wp Cookie-Blocker filter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The Backuply plugin for WordPress (versions up to and including 1.5.8) is vulnerable to second-order SQL injection via the 'Biographical Info' field. The value is exported verbatim into the backup's SQL dump, and when the backup is later restored, a crafted payload can execute arbitrary SQL with full database privileges.

The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress (versions up to and including 5.3.17) is vulnerable to Stored Cross-Site Scripting via the 'icon_light' shortcode attribute due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts that execute when a user visits the injected page.

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress (versions up to and including 5.2.1) is vulnerable to Insecure Direct Object Reference via the 'password' parameter due to missing validation on a user-controlled key. An authenticated attacker with vendor-level access can change the WordPress account password of any customer who has placed at least one order with that vendor, enabling account takeover.

The Cooked – Recipe Management plugin for WordPress (versions up to and including 1.16.1) is vulnerable to Stored Cross-Site Scripting via [cooked-timer] shortcode content due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts that execute when a user visits the injected page.

Wheels CLI versions 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. This can lead to shell command execution on deploy hosts and the CI runner, deletion of unintended files, overwriting other vendor files, writing outside the project, injection of executable CFML, stored XSS, and termination of an unrelated process.

Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit recipient is configured, an attacker can trigger a cold start and direct later error emails to an address under their control, disclosing error and request metadata, and in some cases configuration secrets and other users' session data. This is fixed in 4.1.2.

Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope, and if it overlaps with an unauthorized client's request that raises an error, that client can receive full exception details, including tag context or a serialized exception, and any sensitive data they contain. This is fixed in 4.1.2.

Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct sibling directory, allowing access outside the intended root, including limited file disclosure. Separately, the CLI database-dump output check can write outside the application root to an existing writable case-distinct sibling directory; that action requires the CLI POST, loopback and password gate. This is fixed in 4.2.0.

Wheels versions 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without verifying they belong to the parent being saved. A user can update, reassign, or delete another parent's hasMany or hasOne rows, and edit nested belongsTo records by posting another associated record's key.

Wheels versions 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true (default in development). In 4.1.2 the local-access restriction trusts client-supplied headers without checking the connecting peer.