CVE Vulnerability Catalog

The Simply Schedule Appointments plugin for WordPress (versions up to and including 1.6.12.35) is vulnerable to stored Cross-Site Scripting via the 'status' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The Ultra Addons for Contact Form 7 plugin for WordPress (versions up to and including 3.5.54) is vulnerable to stored Cross-Site Scripting via File Upload due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The 10Web Booster plugin for WordPress (versions up to and including 2.34.5) is vulnerable to limited file write via path traversal. An unauthenticated attacker can create arbitrary directories outside the cache root and write cached pages into them, leading to cache poisoning and arbitrary directory creation.

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments, allowing unauthenticated attackers to upload files that may be executable, making remote code execution possible.

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to and including 3.0.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute when a user visits an injected page. The wp_kses_post filter does not strip the payload because angle-bracket characters are not required, letting the unescaped attribute value survive storage and fire as a live event handler in the unauthenticated (guest) rendering branch.

The User Profile Builder plugin for WordPress (versions up to and including 4.0.3) is vulnerable to Stored Cross-Site Scripting via the First Name field due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. This vulnerability is only exploitable when the Email Confirmation feature is enabled in Profile Builder.

The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-axis column value parameter in all versions up to and including 3.0.6 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts that execute when a user visits an injected page. It requires an administrator to have published a chart whose SQL query returns a column controllable by a lower-privileged user, such as wp_users.display_name, which a Subscriber can populate with a payload via the standard WordPress profile page.

The Broken Link Checker plugin for WordPress in versions up to and including 2.4.14.1 is vulnerable to arbitrary shortcode execution because it does not properly validate a value before running do_shortcode. Unauthenticated attackers can execute arbitrary shortcodes if a submitted comment containing the payload in an href or src attribute is approved through the normal comment moderation workflow; once approved, the shortcode executes automatically via WP-Cron.

The Nexter Extension plugin for WordPress (versions up to and including 4.7.11) is vulnerable to privilege escalation. The /?reset-view handler in role_switcher_to_view_admin_as() performs no nonce or capability check, and the profile_update cleanup hook does not fire during bulk role changes via wp-admin/users.php?action=promote, leaving a stale 'administrator' value in user meta.

The Mail Mint plugin for WordPress in versions up to and including 1.31.4 is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint. Insufficient escaping of the user-supplied filter 'value' before it is appended to a SQL query in SegmentFilterService::get_meta_join_query() at line 797 — the value is string-interpolated into the WHERE fragment in a numeric (unquoted) context and the surrounding $wpdb->prepare() calls do not cover the injected value.

The NotificationX plugin for WordPress in versions up to and including 3.3.3 is vulnerable to Missing Authorization leading to arbitrary content injection. The /notificationx/v1/popup-submit REST route is registered with permission_callback => '__return_true', and the handler PopupNotification::handle_popup_submission() accepts an attacker-controlled nx_id, loads the referenced NotificationX campaign, and copies its source into the new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup.

The Klarna for WooCommerce plugin for WordPress (versions up to and including 4.13.3) is vulnerable to authorization bypass due to improper verification of user authorization. An unauthenticated attacker can access any order's secret order_key and full billing and shipping PII (name, email, phone, address, postcode, city, region, country) exposed inline as the klarna_payments_params JavaScript variable.

The Bulk Page Generator – LPagery plugin for WordPress in versions up to and including 3.1.0 is vulnerable to authorization bypass because it does not properly verify that a user is authorized to perform an action. An authenticated attacker with subscriber-level access and above can create, modify, and delete LPagery-managed pages and bulk page-generation processes otherwise restricted to administrators. On default fresh installations where Freemius has not been opted into, the AES-256-CBC key used to validate Bearer tokens collapses to the publicly known SHA-256 hash of an empty string, making the token entirely forgeable.

The Mang Board plugin for WordPress (versions up to and including 2.4.3) is vulnerable to stored Cross-Site Scripting (XSS) via the 'content' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The MailOptin plugin for WordPress (versions up to and including 1.2.78.6) is vulnerable to privilege escalation. The subscribe_to_email_list endpoint accepts the optin_data[form_custom_field_mappings] parameter without validation, allowing an attacker to override the administrator's mapping and pass arbitrary wp_users columns (including ID and user_pass) to wp_insert_user().

The Mang Board plugin for WordPress in versions up to and including 2.4.4 is vulnerable to Stored Cross-Site Scripting via the 'content' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access and above can inject arbitrary web scripts into pages that execute whenever a user accesses the injected page. The sanitization bypass is compounded by the ability to omit the data_type parameter in a modify request, skipping the HTMLPurifier branch entirely and leaving only mbw_htmlspecialchars2 encoding — fully reversed at render.

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress (versions up to and including 0.1.4.1) is vulnerable to privilege escalation. The plugin registers its admin page using a role name returned by InstaWP_Setting::get_allowed_role() as the required capability, and generate_section_field() renders the master API key as a plain-text HTML input without additional manage_options checks. An authenticated attacker with Subscriber-level access or above can read the plaintext master API key, use its SHA-256-derived secret as a bearer token in the plugin's REST API, and call POST /wp-json/instawp-connect/v2/auto-login to mint a 30-second single-use login URL that sets an administrator authentication cookie.

The Groundhogg plugin for WordPress (versions up to and including 4.9.3) is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function. An authenticated attacker with Sales Representative-level access or above can delete arbitrary files on the server, which can easily lead to remote code execution.

The Mang Board plugin for WordPress (versions up to and including 2.4.4) is vulnerable to arbitrary file upload via the mbw_file_upload function. Missing file extension validation on the image_path parameter allows unauthenticated attackers to upload executable files, enabling remote code execution.

The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress in versions up to and including 1.2.0 is vulnerable to Sensitive Information Exposure via the 'image_hub_api_keys_* (6 options)' parameter. An authenticated attacker with subscriber-level access and above can extract plaintext API credentials for six third-party services — Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash — emitted verbatim into every admin page's HTML via wp_localize_script. The leaked HTML also contains a valid image_hub_nonce AJAX nonce, which — combined with the absence of any capability check in the image_hub_update_settings AJAX handler — allows the same attacker to overwrite all six stored API credential options via update_option().