CVE Vulnerability Catalog

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email (Contact Email custom field htmlvar_name)' parameter in all versions up to and including 2.8.188 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. Successful exploitation requires that an administrator has added and configured the Contact Email custom field to render on the public single-listing output page, and that the administrator subsequently approves the attacker's submitted listing.

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title> in all versions up to and including 5.2.10 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. The payload is not neutralized at save time because post_content stores only a benign block reference to an external feed URL; the malicious HTML is injected at render time from the attacker-controlled RSS feed title, bypassing any save-time wp_kses filtering.

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to and including 3.1.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This allows authenticated attackers with author-level access and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On fresh installations of version 3.1.10 and later, exploitation requires administrator-level access; however, on sites upgraded from a version prior to 3.1.10, the preserveCampaignRoleAccess() migration grants the edit_fireboxes capability to any role that previously held edit_posts, reducing the minimum required privilege to Author-level.

The Fastcache by Host.it plugin up to version 1.7.4 is vulnerable to Code Injection via the `fastcache_settings[cache_cookie_exclude][]` parameter. The setting is registered without a sanitize_callback, and the buildSiteHtaccessRules() function only applies trim() to cookie values before interpolating them into an Apache RewriteCond line, leaving embedded newlines intact. This allows authenticated administrators to inject arbitrary Apache directives into .htaccess, such as php_value auto_prepend_file, enabling execution of attacker-controlled PHP code on every request.

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'inputs (array key)' parameter in all versions up to and including 1.15.48 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action such as clicking on a link.

The Download Manager plugin for WordPress up to version 3.3.71 is vulnerable to sensitive information exposure via the 'first_name' parameter. Authenticated attackers with subscriber-level access can extract the administrator's full Cookie header, including wordpress_logged_in_* session cookies, from the suspension email sent during the administrator's authenticated request. This enables full session hijack and account takeover.

The 3D Product configurator plugin for WooCommerce up to version 2.16.2 is vulnerable to Remote Code Execution via the 'xpv_image' parameter. Missing authentication and nonce checks on the wp_loaded handler, combined with lack of sanitization before echoing into a Dompdf-rendered HTML template with PHP execution enabled, allow unauthenticated attackers to execute code on the server.

The Anti-Spam by CleanTalk plugin for WordPress up to version 6.88 is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The vulnerability is exploitable once a comment from the attacker's email is approved; on default WordPress installations, only the first comment from a given email is moderated, and subsequent comments auto-approve.

The Download Manager plugin for WordPress up to version 3.3.71 is vulnerable to Stored Cross-Site Scripting via the 'regurl' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page. The injected payload only fires for logged-out visitors, as the vulnerable login-form.php template branch is gated on !is_user_logged_in().

The Fluent Forms plugin for WordPress up to version 6.2.14 is vulnerable to Reflected Cross-Site Scripting via the 'any attacker-chosen name matching the {get.NAME} placeholder' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into clicking a link. Exploitation requires a site administrator to have configured a Custom HTML field on a published form containing a {get.*} SmartCode inside a URL-accepting attribute such as iframe src or a href.

The Table Field Add-on for ACF and SCF plugin for WordPress up to version 1.4.1-RC2 is vulnerable to Stored Cross-Site Scripting via Table Field Value due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access can inject arbitrary web scripts that execute when a user accesses an injected page.

The Extensions For CF7 plugin up to version 3.4.5 is vulnerable to Arbitrary File Upload via the extcf7_submit function. Missing file extension, MIME type, and size validation, combined with absence of PHP-execution guards and a sanitize_file_name() bypass, allow unauthenticated attackers to upload executable files, leading to remote code execution.

The ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information can be read by reflectively invoking the interface.

The Blocksy Companion plugin up to version 2.1.58 is vulnerable to privilege escalation. The implement_user_registration() AJAX handler disables Dokan's vendor-registration nonce check and trusts an attacker-supplied $_POST['role'] value, allowing unauthenticated attackers to obtain a Dokan 'seller' account and be auto-authenticated, even when vendor signup is disabled.

The Bookly plugin for WordPress up to version 28.4 is vulnerable to Insecure Direct Object Reference via the 'id, wp_user_id' parameter due to missing validation on a user-controlled key. Authenticated attackers with subscriber-level access can overwrite the WordPress account binding of any Bookly staff record, including those owned by administrators, effectively hijacking a higher-privileged staff member's account association and escalating privileges.

The Advanced Form Integration plugin up to version 2.9.0 is vulnerable to Authentication Bypass via Unverified Password Change. The adfoin_ultimatememberac_send_data function passes an attacker-controlled field key and value directly to UM()->user()->update_profile() in the 'account' context, which bypasses Ultimate Member's banned-key validation, without any identity verification, ownership check, capability check, or current-password reauthentication. This allows unauthenticated attackers to change the password of any WordPress user, including administrators, via a public Contact Form 7 form.

The Advanced IP Blocker plugin up to version 8.13.13 is vulnerable to Authentication Bypass. The handle_login_action() function performs no server-side check that step-1 password authentication was completed, and an error branch unconditionally mints a fresh nonce for any unauthenticated caller. This allows attackers to brute-force an unthrottled 6-digit TOTP code and obtain a fully authenticated session for any 2FA-enabled account, including administrators.

The Bookly plugin for WordPress up to version 28.4 is vulnerable to sensitive information exposure via the classic booking form's Details step. The endpoint bookly_render_details is registered for both wp_ajax and wp_ajax_nopriv, the module overrides csrfTokenValid() to always return true, and getCodes() loads the persisted Customer entity keyed solely by the attacker-supplied phone (or email) with no invocation of customerIdentityConfirmed(). When placeholders like {client_name}, {client_email}, {client_phone}, or {client_note} are placed in the Details step's information text, the matched customer's stored data is substituted into the returned HTML.

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped, allowing command injection.

The Advanced Classifieds & Directory Pro plugin for WordPress up to version 3.4.4 is vulnerable to Stored Cross-Site Scripting via the 'phone' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with custom-level access can inject arbitrary web scripts that execute when a user accesses an injected page. The vulnerability is only exploitable on sites where the 'Force Bootstrap' setting is enabled and the 'ACADP Listing Address' widget is placed on a sidebar displayed on single listing pages; both conditions are non-default.