CVE Vulnerability Catalog

The Shiptastic for WooCommerce plugin versions 5.1.0 and earlier are vulnerable to unauthenticated Insecure Direct Object References (IDOR). Unauthenticated attackers can access objects they should not have access to.

The PeproDev Ultimate Invoice plugin versions 2.2.6 and earlier have an unauthenticated broken access control vulnerability. Unauthenticated users can gain unauthorized access to functions or data.

The Complianz plugin versions 7.5.0 and earlier are vulnerable to unauthenticated sensitive data exposure. Unauthenticated attackers can access confidential information.

The Complianz plugin versions 7.5.0 and earlier have a Server-Side Request Forgery (SSRF) vulnerability exploitable by an author. A user with author role can force the server to send requests to internal resources.

The Query Wrangler plugin versions 1.5.57 and earlier have a broken access control vulnerability exploitable by a subscriber. A user with subscriber role can gain unauthorized access to functions or data.

The Create plugin (mediavine-create) by John-Michael L'Allier contains a vulnerability that exposes sensitive system information to an unauthorized control sphere. The issue affects versions from n/a through 2.6.0 and allows retrieval of embedded sensitive data.

Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.

The Photography plugin versions up to 7.7.6 contain an unauthenticated broken access control vulnerability. An attacker without authentication can bypass access control mechanisms.

The Event post plugin versions up to 6.0.1 contain an unauthenticated broken access control vulnerability. An attacker without authentication can bypass access control mechanisms.

The Content Control plugin versions up to 2.6.5 contain an unauthenticated broken access control vulnerability. An attacker without authentication can bypass access control mechanisms.

The Style Kits plugin versions up to 2.6.5 contain a contributor broken access control vulnerability. An attacker with contributor privileges can bypass access control mechanisms.

The HashThemes Demo Importer plugin versions up to 1.4.2 contain an author Cross Site Scripting (XSS) vulnerability. An attacker with author privileges can inject malicious script.

The LA-Studio Element Kit for Elementor plugin contains a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 1.6.3.

The TheGem theme by CodexThemes contains a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions before 5.12.1.1.

The Reviewer plugin versions up to 3.14.2 contain a subscriber broken access control vulnerability. An attacker with subscriber privileges can bypass access control mechanisms.

The ListingPro plugin versions up to 2.9.10 contain a subscriber broken access control vulnerability. An attacker with subscriber privileges can bypass access control mechanisms.

The Civi plugin version 2.2.4 and earlier contains a broken access control vulnerability that can be exploited without authentication. An attacker can gain unauthorized access to functions or data.

The Modula Image Gallery plugin versions 2.14.25 through 2.14.30 are vulnerable to stored XSS attacks. An attacker can inject a malicious script that executes in other users' browsers.

The Ninja Tables plugin version 5.2.10 and earlier allows unauthenticated attackers to access sensitive data. The vulnerability is due to a lack of proper data protection against unauthorized reading.

The Virtue/Ascend/Pinnacle Toolkit plugin version 4.9.12 and earlier is vulnerable to XSS attacks from a contributor role. A user with contributor privileges can inject a malicious script.