CVE Vulnerability Catalog

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[section][fields][row][col][type]' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. An authenticated attacker with shop manager-level access or above can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the 'rp4wp_view' parameter. An authenticated attacker with contributor-level access or above can extract the titles and publication dates of all private posts site-wide, normally restricted to Editor-level users and above. The page's existing authorization check only verifies edit_posts and edit_post on a parent post the attacker owns, both of which any Contributor satisfies, leaving no effective gate against reading other authors' private posts.

The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.0 via the 'rp4wp_create_link' parameter of the hidden 'rp4wp_link_related' admin page. The handle_create_link() handler verifies the nonce and that the current user can edit the parent post, but never checks that the attacker-supplied child post ID is one the user is allowed to read; LinkRepository::insert() stores the arbitrary child ID without validation, and ManageLinks::render() later calls LinkRepository::get_children() in its no-extra-args fast path, which falls through to array_map('get_post', $child_ids) — bypassing read_private_posts/read_post capability checks — and then echoes esc_html($child->post_title) in the parent's editor meta box. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the titles of arbitrary non-public posts (drafts, pending, private, future, trashed) authored by higher-privileged users by linking those post IDs to a draft they own and then reading the resulting meta box.

The Cozy Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'productRating.iconColor' parameter in versions up to and including 2.2.27 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page. The vulnerable code path is only reached when the productRating option is enabled and the associated WooCommerce product has a non-zero rating.

The Cozy Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content (block attribute icon.view / icon.layout / icon.gap)' parameter in versions up to and including 2.2.27 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page. Although wp_kses_post is applied on save, it does not neutralize a quote-only attribute-breakout payload containing no '<' character, leaving the block comment and its decoded JSON attributes intact and exploitable at render time.

The s2Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in versions up to and including <= 261011 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page. The payload bypasses wp_kses_post() on save because it contains no literal angle brackets — only backslash-escaped sequences that PHP's date() materializes into HTML tag characters at render time after WordPress's shortcode_parse_atts() applies stripcslashes() to the attribute value.

The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes of the [ttbm-hotel-map] shortcode in versions up to and including 2.3.6. This is due to insufficient input sanitization and output escaping on user-supplied attributes in the ttbm_hotel_map_shortcode() function, which concatenates raw attribute values into double-quoted HTML attributes of an <iframe> tag. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page.

The UiChemy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'actions[save_builder][data][elements][...][settings][slot_{N}_link][url]' parameter in versions up to and including 5.3.0 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page. The injected javascript: payload fires on click rather than on page load, making exploitation contingent on a privileged user such as an Editor or Administrator clicking the attacker-crafted link while reviewing or previewing the Contributor's post.

The Document Embedder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content (post_content containing block JSON documentSource.doc)' parameter in versions up to and including 2.4.0 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page. The payload is triggered specifically when the victim clicks the embedded document's Download button, which causes the de_track_download AJAX fallback path to programmatically create an anchor with the attacker-controlled href and call .click() — a condition reached because supplying docId=0 causes can_read_document() to return false, bypassing the normal download flow.

The easy.jobs plugin for WordPress is vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the 'icon' attribute of the easyjobs/job-list Gutenberg block in versions up to and including 2.8.2 due to insufficient input sanitization and output escaping on user-supplied attributes. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page.

The Hustle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[title]' parameter in versions up to and including 7.8.14.3 due to insufficient input sanitization and output escaping. An authenticated attacker with custom-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page. Exploitation requires that an administrator has explicitly granted the 'Create and Update Modules' (hustle_create / hustle_edit_module) capability to the attacker's role via the plugin's own Settings → Permissions feature; this delegation is not enabled by default.

The Tainacan plugin for WordPress is vulnerable to Directory Traversal in versions up to and including 1.3.0 via the 'tmp_file' parameter. An authenticated attacker with Editor-level access or higher can read the contents of arbitrary files on the server, which can contain sensitive information. The poisoned importer path is persisted to the database and later triggered via a separate GET request to the /source_info endpoint, which passes the attacker-controlled path to fopen() and fgetcsv() and returns parsed file contents in the REST response.

The If-So Dynamic Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversion' Shortcode Attribute in versions up to and including 1.10.2 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page.

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tab_index, empty_notice' parameter in all versions up to, and including, 3.16.2 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. wp_kses_post does not strip the payload on save because the dangerous characters reside within shortcode attribute text between square brackets, which kses treats as plain text rather than HTML markup.

The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. The injected script executes specifically in the administrator's browser session, as the vulnerable branch only renders when an administrator previews or opens the post containing the crafted shortcode.

The Awesome Support – WordPress HelpDesk & Support Plugin is vulnerable to Stored Cross-Site Scripting via the 'wpas_files' parameter in all versions up to, and including, 6.4.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with custom-level access and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. This vulnerability is only exploitable when the "Enable drag-n-drop uploader for ticket form" setting is enabled, as it is disabled by default.

The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Body URL Autolink in all versions up to, and including, 1.9.87 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. This is possible because the ?postie=get-mail endpoint is reachable by unauthenticated users with no capability check, and the email processing path removes WordPress's kses output filters before saving raw markup, allowing the unescaped href attribute value to be stored as post content.

The Recipe Card Blocks Lite plugin for WordPress before 3.6.4 does not sanitize or cast a block and shortcode attribute before concatenating it into SQL queries. This allows authenticated users with Contributor-level access or above to perform SQL injection attacks.

The WP Roster plugin for WordPress before 2.35 does not perform any capability or nonce checks on one of its AJAX actions. This allows unauthenticated attackers to delete the WordPress user accounts of roster members.

The Customer Engagement System plugin for WordPress before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the supplied API key. This allows unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response timing which ones are reachable.