CVE Vulnerability Catalog

The Kadence Blocks plugin for WordPress up to version 3.7.12 is vulnerable to stored XSS via the Block Font Family attribute. Exploitation requires the "Load Google Fonts Locally" option to be enabled, which is not the default configuration.

The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections (Administrators by default) to store JavaScript that executes in the session of any user who later opens that view, including a Super Administrator on multisite.

The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks.

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.

The AI Puffer plugin for WordPress up to version 2.4.89 is vulnerable to authorization bypass. Authenticated attackers with subscriber-level access can modify global semantic search settings that are restricted to administrators.

The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. An authenticated attacker with subscriber-level access or above can modify global plugin indexing and vector-search configuration options (aipkit_training_general_settings and aipkit_indexing_field_settings), affecting all users of the plugin. This is only exploitable when an administrator has granted 'sources' module access to a lower-privileged role via the plugin's Role Manager.

The Groundhogg plugin for WordPress up to version 4.9 is vulnerable to privilege escalation. Missing ownership and capability checks in the 'process_edit()' function allow authenticated users with 'edit_contacts' capability (e.g., sales reps) to reassign a contact to any WordPress account, including an administrator, and then use the auto-login URL to authenticate as that administrator.

The LifterLMS plugin for WordPress up to version 10.2.1 is vulnerable to PHP Object Injection via deserialization of untrusted input. Authenticated attackers with 'edit_course' capability (e.g., instructors) can inject a PHP object, which may lead to file deletion, data theft, or code execution if a POP chain is present in another plugin or theme.

The Smart Popup by Supsystic plugin for WordPress up to version 1.13.2 is vulnerable to SQL Injection via the 'sidx' parameter due to insufficient escaping and lack of query preparation.

The JetFormBuilder plugin for WordPress up to version 3.6.6 is vulnerable to Reflected DOM-Based XSS via a query parameter matching the preset's query_var setting. Exploitation requires a form with a text field configured with a query_var Dynamic Preset and a macro reference.

The HivePress plugin for WordPress up to version 1.7.31 is vulnerable to stored XSS via the 'custom text attribute' parameter. Exploitation requires an administrator to configure a Text attribute with a display format placing %value% inside an HTML attribute.

The Simple Newsletter Plugin – Noptin for WordPress up to version 4.3.10 is vulnerable to stored XSS via the 'noptin_fields[<custom_field_merge_tag>]' parameter. The attack requires a published campaign with a [[subscriber.*]] merge tag and uses the manage_preferences form.

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'not_found' parameter in all versions up to and including 3.3.58 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page.

The Avada (Fusion) Builder plugin for WordPress up to version 7.16.1 contains an authorization bypass vulnerability. An unauthenticated attacker can invoke arbitrary WordPress action hooks by sending a crafted request to the public form-submit endpoint, potentially leading to permanent deletion of content (posts, pages, comments) or other state changes.

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unquoted popup shortcode attribute in all versions up to and including 7.5.54.7212 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. Successful exploitation requires the profile_videos_enable_bio option to be enabled, as script execution occurs on the author bio/archive page where the profile-video shortcode is rendered.

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell 'data' Value in the updateRows Action in all versions up to and including 1.15.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. This is only exploitable by Subscriber-level users when an administrator has added their role to the plugin's 'access_roles' setting, which is a documented and explicitly supported plugin feature.

The rtMedia plugin for WordPress, BuddyPress and bbPress up to version 4.7.13 is vulnerable to limited file deletion due to insufficient file path validation in the process function. Unauthenticated attackers can delete arbitrary safe files on the server, using a public nonce emitted in frontend JavaScript on pages with rtMedia gallery or upload shortcode.

The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to and including 1.9.6 due to insufficient input sanitization and output escaping in the flrt_elementor_load_more_anchor() function. The function reads query parameters from $_SERVER['REQUEST_URI'] via getFormActionOrFullPageUrl(true), which URL-decodes them through parse_str() and re-assembles them using build_query() — a WordPress core function that does NOT re-encode values ($urlencode=false). The resulting URL, containing unescaped special characters, is injected into a data-next-page HTML attribute via preg_replace() without esc_attr() or esc_url(). This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into clicking a specially crafted link.

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to and including 1.6.11.11 due to the appointment update REST API endpoint not restricting which fields can be modified by token-authenticated customers. This allows unauthenticated attackers to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type.

The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.7.7 due to the plugin not properly verifying that a user is authorized to perform an action. This allows authenticated attackers with Contributor-level access and above to publish their own Hello+ header/footer templates and draft currently active templates owned by higher-privileged users.