CVE Vulnerability Catalog

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kubio/copyright Block Content in all versions up to and including 2.8.4 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page. This bypasses both WordPress core kses-on-save and the plugin's own wp_kses_post() because entity-encoded script tags are treated as inert text but decoded into live HTML.

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. Attackers with LatePoint Agent-level access or above can read bookings and customer PII (full name, email, phone, and notes) assigned to other agents, and delete arbitrary bookings. This vulnerability is only exploitable when an administrator has enabled the Abilities API toggles.

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. Authenticated attackers with subscriber-level access or above can permanently delete arbitrary posts, pages, and custom post types (bypassing the trash) or change any published post to draft status.

The Bar Association Website by KA Informatics Technologies Ltd. Co. is vulnerable to Reflected XSS due to improper neutralization of input during web page generation. This issue affects versions through 18092026. The vendor was contacted but did not respond.

The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.3.68 via the duplicate() function hooked on admin_init. This is due to the handler only verifying the generic 'edit_posts' capability and a plugin-wide static nonce without any object-level authorization check. Authenticated attackers with Author-level access or above can duplicate arbitrary Download Manager packages owned by other users, copying all package metadata including protected file references, role-based access restrictions, and password lock settings into an attacker-owned clone.

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to and including 11.8.2 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into clicking a link. The nonce check is bypassed by default because the 'booking_is_nonce_at_front_end' option ships disabled.

The Divi theme for WordPress in all versions up to and including 5.11.1 is vulnerable to arbitrary shortcode execution because it does not properly validate a value before running do_shortcode. Unauthenticated attackers can execute arbitrary shortcodes, and when the 'Force Enable D4 Shortcode Framework' option is enabled, this includes invoking the et_pb_contact_form shortcode to send email to an attacker-selected recipient with attacker-controlled content.

The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty. This allows unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it.

The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler. This allows unauthenticated users to create accounts even when the site has registration disabled.

The EmbedPress plugin for WordPress in all versions up to and including 4.6.5 is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute if they can trick a user into clicking a link. This is a regression: the esc_url() wrapper that remediated CVE-2023-5749 was removed in version 4.3.0 during a refactor.

The GPTranslate plugin for WordPress in all versions up to and including 2.34.6 is vulnerable to Sensitive Information Exposure via enqueue_frontend_scripts. Unauthenticated attackers can extract the plaintext third-party AI provider API key (OpenAI, DeepL, xAI/Grok, Gemini, Claude, or Google Cloud Translation) by fetching any public page and applying the inverse transformation bundled in the plugin's own public JavaScript asset. This affects the default configuration and all supported non-DeepSeek providers.

The Filter Gallery plugin for WordPress in all versions up to and including 1.1.4 is vulnerable to authorization bypass because it does not properly verify that a user is authorized to perform an action. Authenticated attackers with subscriber-level access and above can overwrite the title and content of arbitrary WordPress posts, write the _wp_attachment_image_alt meta key on arbitrary posts, and create or overwrite arbitrary ufg_gallery_* options.

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time. This allows users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PHP where a local file containing PHP code can be reached. Exploitation requires the plugin's Lightspeed subsystem to be enabled, which is not the default.

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection. The protection is dropped when the request's verification value is missing or incorrect, which any visitor can arrange, allowing unauthenticated attackers to re-expose the concealed WordPress login page location.

The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections. The mere presence of an attacker-suppliable request parameter is treated as sufficient, allowing unauthenticated attackers to disable those protections and re-expose the concealed login and admin URLs on any request.

The Custom Twitter Feeds plugin for WordPress in all versions up to and including 2.8.0 is vulnerable to Stored Cross-Site Scripting via the 'buttoncolor' shortcode attribute due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. This is exploitable on common installs where the admin has configured access tokens with zero or multiple legacy feeds.

The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.

The Magazine Blocks plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6 due to improper verification that a user is authorized to perform an action. An authenticated attacker with contributor-level access and above can demote administrator-owned published builder templates to draft status and replace them with attacker-authored block content rendered site-wide.

The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's clientId attribute in versions up to, and including, 1.8.6 due to insufficient input sanitization and output escaping in the NewsTicker::render() method, which concatenates the clientId block attribute into an HTML class attribute without applying esc_attr().

The Foxtool All-in-One plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3 due to improper verification that a user is authorized to perform an action. An authenticated attacker with subscriber-level access and above can modify arbitrary subkeys of the foxtool_settings option, including enabling site-wide SVG uploads by toggling the media-up3 key, which can facilitate stored cross-site scripting via malicious SVG files.