CVE Vulnerability Catalog

The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type restriction on it, allowing users with the Author role or higher to plant content that, once an administrator runs the import, copies an arbitrary server-readable file into a publicly served directory, exposing it to unauthenticated retrieval.

The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to an email address they do not own, gaining an authenticated session.

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the plugin's status metadata onto arbitrary posts.

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators.

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as well as site-wide gallery filters.

The GeoDirectory plugin for WordPress up to version 2.8.187 is vulnerable to Local File Inclusion (LFI) via the 'design_type' parameter. Unauthenticated attackers can include and execute arbitrary .php files on the server, potentially leading to access control bypass, sensitive data disclosure, or code execution.

The LatePoint plugin for WordPress up to version 5.7.3 is vulnerable to privilege escalation. The lack of an allowlist for setting names/values and missing role validation for the 'default_wp_role_for_customer' setting allows authenticated attackers with 'settings__edit' capability (e.g., agents) to overwrite the default WordPress role to 'administrator', causing new customer accounts to be created with full admin privileges.

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 1.17.1 via the 'file_path' parameter. An authenticated attacker with administrator-level access or above can read the contents of arbitrary files on the server, which can contain sensitive information. This requires the attacker to upload a crafted ZIP archive containing a media_metadata.json file with path traversal sequences in the file_path field while specifying an allowed file extension for the destination filename to bypass the extension guard introduced in version 1.13.2.

The Kadence Blocks plugin for WordPress up to version 3.7.12 is vulnerable to stored XSS via the Block Font Family attribute. Exploitation requires the "Load Google Fonts Locally" option to be enabled, which is not the default configuration.

The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections (Administrators by default) to store JavaScript that executes in the session of any user who later opens that view, including a Super Administrator on multisite.

The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks.

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.

The AI Puffer plugin for WordPress up to version 2.4.89 is vulnerable to authorization bypass. Authenticated attackers with subscriber-level access can modify global semantic search settings that are restricted to administrators.

The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. An authenticated attacker with subscriber-level access or above can modify global plugin indexing and vector-search configuration options (aipkit_training_general_settings and aipkit_indexing_field_settings), affecting all users of the plugin. This is only exploitable when an administrator has granted 'sources' module access to a lower-privileged role via the plugin's Role Manager.

The Groundhogg plugin for WordPress up to version 4.9 is vulnerable to privilege escalation. Missing ownership and capability checks in the 'process_edit()' function allow authenticated users with 'edit_contacts' capability (e.g., sales reps) to reassign a contact to any WordPress account, including an administrator, and then use the auto-login URL to authenticate as that administrator.

The LifterLMS plugin for WordPress up to version 10.2.1 is vulnerable to PHP Object Injection via deserialization of untrusted input. Authenticated attackers with 'edit_course' capability (e.g., instructors) can inject a PHP object, which may lead to file deletion, data theft, or code execution if a POP chain is present in another plugin or theme.

The Smart Popup by Supsystic plugin for WordPress up to version 1.13.2 is vulnerable to SQL Injection via the 'sidx' parameter due to insufficient escaping and lack of query preparation.

The JetFormBuilder plugin for WordPress up to version 3.6.6 is vulnerable to Reflected DOM-Based XSS via a query parameter matching the preset's query_var setting. Exploitation requires a form with a text field configured with a query_var Dynamic Preset and a macro reference.