CVE Vulnerability Catalog

The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 6.2.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This allows authenticated attackers with Custom-level access and above to read private form submissions, change submission statuses, permanently delete submissions, and modify global plugin settings.

The Bookly plugin for WordPress is vulnerable to PHP Object Injection through deserialization of untrusted input via the 'value' parameter in versions up to and including 28.2. Authenticated attackers with custom-level access or above can inject a PHP object, but no known gadget chain is available.

ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control. An attacker can leverage these functions to read relevant information.

ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs.

The 10Web Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in versions up to and including 2.34.8. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses the page.

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_month' parameter in all versions up to and including 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This allows authenticated attackers with subscriber-level access and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a regression vulnerability — a capability check introduced in versions 2.0.19.11–2.0.19.14 to address CVE-2024-50425 was removed in version 2.1, meaning any authenticated subscriber-level account can reach the vulnerable handler with no nonce validation required.

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to and including 34.0.10. Unauthenticated attackers can delete arbitrary files on the server, potentially leading to remote code execution, and relocated files are publicly accessible in the wp-content/uploads/ppom_files/confirmed/ directory.

The SpeedyCache plugin for WordPress up to version 1.4.2 is vulnerable to sensitive information exposure via the 'comment_author_*' parameter. Unauthenticated attackers can extract full names and email addresses of commenters, which are pre-filled in forms and persisted in cached pages.

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to and including 2.7.9 due to insufficient input sanitization and output escaping. This allows authenticated attackers with editor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the plugin's 'Comments' lightbox setting to be enabled (disabled by default), a moderator to approve the injected comment, and a site visitor to click the affected image to open the lightbox.

The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'country' parameter in all versions up to and including 4.8.4 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated attackers may also exploit this vulnerability when the plugin's Enable Free Membership feature is turned on, as it permits anonymous front-end registration and profile submission.

The Team – Team Members Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttp_filter_taxonomy' parameter in all versions up to and including 6.0.2. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts.

The LazyLoad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment_content' parameter in versions up to and including 2.4.0. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts, but require admin approval of the comment.

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id' parameter in versions up to and including 1.2.30. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts.

The GiveWP – Donation Plugin and Fundraising Platform for WordPress is vulnerable to Stored Cross-Site Scripting via the 'givewp_campaign_grid' shortcode in versions up to and including 4.17.0. The vulnerability is due to insufficient input sanitization and output escaping on shortcode attributes.

The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via comment content with the <presto-player> tag in versions up to and including 4.5.1. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts, but require initial comment approval.

The Real Estate Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in versions up to and including 7.3. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. The reCAPTCHA check can be trivially bypassed.

The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to and including 5.1.2. This is due to insufficient input sanitization and output escaping, allowing authenticated attackers with subscriber-level access and above to inject scripts.

The Order Export & Order Import for WooCommerce plugin is vulnerable to Sensitive Information Exposure in all versions up to and including 2.7.8. Unauthenticated attackers can download exported order CSV files containing customer PII if the .htaccess and index.php guard files are missing from the export directory.

The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number verified during its OTP password reset. This allows unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.

The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to. This allows unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control.