CVE Vulnerability Catalog

The Customer Engagement System plugin for WordPress before 2.0.2 does not safely build the SQL statements storing a popup's page and category visibility rules, concatenating request-supplied IDs directly into an INSERT statement without parameter binding or integer casting. This allows an authenticated administrator to inject arbitrary SQL and read the WordPress database contents.

The PayPlug for WooCommerce (Official) plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier. This allows unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCommerce orders.

The GeoDirectory plugin for WordPress before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who clicks the badge, including administrators.

The GeoDirectory plugin for WordPress before 2.8.196 does not properly sanitize or escape a post badge click-through link value before outputting it in an anchor element on a listing. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view the listing, including an administrator reviewing moderated content.

The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action. A forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site.

The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present. A forged request that omits the field can cause a logged-in user with the Author role or above to trash or delete attachments.

The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute. This allows users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pending post, views the content.

The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools. This allows authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal MCP WordPress plugin before 1.5.10.

The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect. This allows unauthenticated attackers to redirect users to arbitrary external websites.

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query. This allows users with the Editor role or higher to perform SQL injection attacks.

The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings. Unauthenticated attackers could reassign the login, registration and password-recovery slugs and lock the administrator out of the login interface.

The Copy Anything to Clipboard for WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing it and writing it back into the page through a client-side script. Users with the contributor role and above could perform Stored Cross-Site Scripting attacks against higher-privileged users.

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor can pass to its pagination endpoint. This could allow reading content of non-public post types and recovering values of private custom fields on published posts.

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface. Users with the contributor role and above could perform Stored Cross-Site Scripting attacks against higher-privileged users who open the affected post in the editor.

The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request. Unauthenticated users could disclose another customer's order key and cancel their unpaid guest order.

The Customer Email Verification for WooCommerce plugin in versions up to and including 2.8.2 is vulnerable to Authentication Bypass via a Predictable Email-Verification Token. The authenticate_user_by_email_link() function lacks capability and nonce checks, and the token is generated as md5(email . time()), allowing unauthenticated attackers to log in as a newly created customer or mark an account as verified.

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action. It relies only on published status and not on the post type's visibility, allowing unauthenticated users to disclose content of posts stored in non-public post types, such as captured contact-form submissions.

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute. Users with the Contributor role or above could inject JavaScript that runs in the browser of any user who views the page, including an administrator reviewing a pending submission.

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request. Unauthenticated attackers could inject arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.

The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions. This allows unauthenticated users to add or delete reservation types in the plugin's configuration.