CVE Vulnerability Catalog

The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them.

The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the edit_posts capability (Contributor and above) delete or modify custom widget skins via a crafted request, provided they can trick the user into performing an action such as clicking a link.

The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitrary posts, via IDOR.

The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and trigger the customer shipment notification email.

The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request.

The MasterStudy LMS WordPress Plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user.

The MasterStudy LMS WordPress Plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished (draft, pending and private) courses.

The MasterStudy LMS WordPress plugin before version 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data. This allows unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user.

The MasterStudy LMS WordPress plugin before version 3.7.46 does not properly verify authorization when retrieving order line-item data. This allows any authenticated user, including Subscribers, to read other instructors' course sales records by supplying another user's identifier.

The CatalogX WordPress plugin before version 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator. This allows unauthenticated attackers to inject arbitrary content into that email, which is delivered when an unrelated visitor later submits a product enquiry.

The FormLayer WordPress plugin before version 1.0.9 does not perform any authorization check before returning a form's full stored configuration in the response to its public submission handler. This allows unauthenticated users to disclose notification recipient addresses, confirmation redirect targets and integration settings, including those of unpublished forms.

The Rank Math SEO WordPress plugin before version 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against. This allows users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users.

The Rank Math SEO WordPress plugin before version 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata. This allows unauthenticated users to read the content of password-protected posts.

The GamiPress WordPress plugin before version 7.9.9.6 does not properly restrict its video watch-tracking functionality. This allows users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them without limit.

The MultiVendorX WordPress plugin before version 5.0.15 does not have proper authorisation controls on one of its REST API listing routes. This allows unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications.

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before version 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when a visitor interacts with the affected button. Exploitation requires the plugin to be running a non-default icon display configuration.

The Comments WordPress plugin before version 7.6.66 does not validate a value used to build a database query. This allows unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private and draft posts. The injected text reaches the query as grammar rather than as data and does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed comment content rather than the database at large.

The Ultimate Member WordPress plugin before version 2.13.0 does not check whether a comment has been approved or whether the profile it belongs to is private before returning profile activity to unauthenticated visitors. This allows reading the content of comments still awaiting moderation.

The Gutentor WordPress plugin before version 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role.

The Solace Extra WordPress plugin before version 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published (draft, pending, private, and trashed) Site Builder parts that WordPress would otherwise not serve.