CVE Vulnerability Catalog

The Post Snippets plugin for WordPress in versions up to and including 4.2.4 is vulnerable to stored cross-site scripting (XSS) via shortcode attributes due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts that execute when a user visits an injected page, provided snippet shortcodes are enabled.

The Waitlist Woocommerce plugin for WordPress in versions up to and including 2.9.1 is vulnerable to stored cross-site scripting (XSS) via the 'type' shortcode attribute due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts that execute when a user visits an injected page.

The Beyondseo plugin for WordPress in versions up to and including 1.3.6 is vulnerable to unauthorized access because it permanently grants the Contributor role the rankingcoach_write_* capabilities (including rankingcoach_write_redirectManager), while the module's REST endpoints authorize state-changing requests solely via current_user_can() without admin capability, ownership, or additional nonce checks. An authenticated attacker with Contributor-level access can create, update, or delete 301/302 redirects executed for every frontend visitor, hijacking arbitrary paths including /checkout and /wp-login.

The PayPal Brasil para WooCommerce plugin for WordPress in all versions up to and including 1.7.8 is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. An unauthenticated attacker can disable or enable the PayPal Brasil BCDC payment gateway and overwrite its WooCommerce gateway settings, removing PayPal from checkout for all customers.

The WP Inventory Manager plugin for WordPress in all versions up to and including 2.5.5 is vulnerable to time-based SQL injection via the 'sort_order' shortcode attribute due to insufficient escaping of the user-supplied parameter and lack of sufficient preparation of the existing SQL query. An authenticated attacker with Contributor-level access can append additional SQL queries to extract sensitive information from the database, exploiting the [wpinventory_categories] shortcode in a draft post rendered through preview.

The Advanced Custom Fields: Extended plugin for WordPress in all versions up to and including 0.9.2.7 is vulnerable to unauthorized data access and triggering of server-side actions due to multiple AJAX handlers registered for unauthenticated users (wp_ajax_nopriv_*) that fail to implement proper current_user_can() checks. While handlers use acf_verify_ajax() to validate nonces, acf_nonce values are generated for guest users and exposed in the page source, allowing unauthenticated attackers to bypass visibility permissions and disclose post titles and internal Flexible Content layout structures. The vulnerability was partially patched in version 0.9.2.4.

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress in all versions up to and including 7.8.14.3 is vulnerable to stored cross-site scripting via the 'content[cta_label]' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with custom-level access can inject arbitrary web scripts that execute when a user accesses an injected page; by default only Administrators hold the hustle_edit_module capability, but the plugin's Permissions screen allows delegating it to lower roles including Subscriber.

The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress in all versions up to and including 1.10.2 is vulnerable to stored cross-site scripting via the 'repeater[*][version_uid]' parameter and many sibling fields (freeze-mode, cookie-input, ip-input, compare, utm-value, page-url-compare, group-name, custom) due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page.

The CMB2 plugin for WordPress in all versions up to and including 2.13.4 is vulnerable to stored cross-site scripting via the 'cmb43ex1_grp[0][txt]' parameter (a wysiwyg field inside a group whose field id is controlled by integrator config) due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when a user accesses an injected page; this is only exploitable when a site integrator renders the plugin's documented front-end form helper with a wysiwyg field inside a repeatable group on a publicly accessible page.

The VikRentCar Car Rental Management System plugin for WordPress in all versions up to and including 1.4.10 is vulnerable to blind SQL injection via the 'catid' parameter due to insufficient escaping of the user-supplied parameter and lack of sufficient preparation of the existing SQL query. An authenticated attacker with Contributor-level access can append additional SQL queries to extract sensitive information from the database by storing a malicious block via the REST API in a pending post and triggering server-side rendering through preview.

The VikRentCar Car Rental Management System plugin for WordPress in all versions up to and including 1.4.10 is vulnerable to stored cross-site scripting via the 'className' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page; wp_kses_post() applied at save time does not neutralize the payload because the injection lands in an HTML-attribute context and the block-comment JSON encoding of the quote is decoded by do_blocks() at render time.

The Clean Login plugin for WordPress in versions up to and including 1.20.1 is vulnerable to missing authorization due to a missing capability check on the CleanLogin_Shortcode::get_pages_with_shortcodes() function hooked to the save_post action. An authenticated attacker with Contributor-level access can overwrite the plugin's cl_login_url, cl_login_id, cl_register_url, cl_register_id, cl_restore_url, cl_restore_id, cl_edit_url, cl_edit_id, cl_change_password_url, and cl_change_password_id options with the ID and permalink of a post they authored by embedding the plugin's shortcodes in their own post content.

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and sibling 'to'/'first'/'second') shortcode attribute of the [wsm_showTrafficStatsList] shortcode in versions up to, and including, 8.8. User-supplied attributes are insufficiently escaped and concatenated into a SQL query in fnGetHourlyReportByDateNameTimeZone(). An authenticated attacker with Contributor-level access or above can append additional SQL queries to extract sensitive information from the database.

The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.0.0. Due to improper verification that a user is authorized to perform an action, an authenticated attacker with subscriber-level access or above can repeatedly trigger RAG document sync operations that issue paid embedding API calls to OpenAI, Gemini, OpenRouter, or xAI charged to the site administrator's stored API key. This drains AI API credits and causes financial loss.

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6. Due to improper verification that a user is authorized to perform an action, an authenticated attacker with contributor-level access or above can duplicate arbitrary posts — including private, draft, and pending posts authored by Administrators and Editors — into drafts they own, exposing the original post's content, excerpt, title, taxonomies, and metadata. The nonce is a static string not bound to a specific post, making exploitation easier.

The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary web scripts into pages that execute when a user accesses the injected page. Exploitation requires an administrator to run the plugin's block-conversion migration ("Scan & Convert Blocks" during deactivation), which triggers the vulnerable build_group_block() function.

The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image' parameter (any body field referenced by the ImageHelper node's mix tag). This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. Exploitation requires that an administrator has built a webhook-triggered flow that pipes a webhook body field into an ImageHelper imageToBase64 node, and that the webhook remains in its default configuration (no bearer secret enforced, no IP allowlist set).

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary web scripts into pages that execute when a user accesses the injected page. Because the payload contains no angle brackets, wp_kses_post leaves the shortcode intact on save, allowing the malicious attribute value to survive post submission and fire in any viewer's browser — including an administrator previewing a pending post.

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6. Due to improper verification that a user is authorized to perform an action, an authenticated attacker with contributor-level access or above can retrieve the plugin's 127-character site-wide grw_auth_code authentication secret and use it to impersonate the WordPress site to the RichPlugins backend service at app.richplugins.com.

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[section][fields][row][col][type]' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. An authenticated attacker with shop manager-level access or above can inject arbitrary web scripts into pages that execute when a user accesses the injected page.