CVE Vulnerability Catalog

The Context Blog theme for WordPress up to version 1.3.5 is vulnerable to sensitive information exposure via the context_blog_modal_popup function. Unauthenticated attackers can extract the content of password-protected posts.

The fresh Podcaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'freshpodcaster' shortcode in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes.

The bbp Style Pack plugin for WordPress up to version 6.4.5 contains a stored XSS vulnerability. The bsp_topic_fields_form_save() function writes unsanitized input to post meta, and bsp_topic_content_append_topic_fields() outputs it without HTML encoding. Authenticated attackers with Subscriber-level access can inject arbitrary scripts that execute when any user visits the affected page.

The WCFM – Frontend Manager for WooCommerce plugin up to version 6.7.27 has an authorization bypass vulnerability. The wcfm-my-account-enquiry-manage branch lacks user permission checks, allowing unauthenticated attackers to inject arbitrary reply content into store inquiries, overwrite main inquiry records, and trigger unsolicited notification emails to customers and vendors.

The WP Easy Pay plugin for WordPress up to version 4.5.0 contains an authorization bypass vulnerability that allows authenticated attackers with subscriber-level access or higher to change the status of arbitrary posts and pages to 'draft', effectively unpublishing site content.

The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 3.7.3 due to insufficient input sanitization and output escaping of the 'post_title' field. Authenticated attackers with Vendor-level access or higher can inject arbitrary web scripts that execute when users access affected pages.

The Wallet for WooCommerce plugin for WordPress up to version 1.6.4 contains an authorization bypass vulnerability. It allows authenticated attackers with subscriber-level access or higher to enumerate the login names, email addresses, and user IDs of all WordPress accounts, including administrators.

The WP Hotel Booking plugin for WordPress up to version 2.3.1 fails to properly verify data authenticity in the PayPal IPN handler. An attacker can use the `test_ipn` parameter to redirect validation to PayPal sandbox and force upgrade transaction status from 'pending' to 'completed' without actual payment. Missing checks on `txn_id` uniqueness, `receiver_email`, and `mc_currency` after a `VERIFIED` response further enable exploitation.

The White Label CMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 2.7.12 due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts that execute when a user accesses an injected page.

The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to 13.3. This is due to insufficient input sanitization and output escaping. Authenticated attackers with editor-level permissions or higher can inject arbitrary scripts that execute when users access affected pages.

The Cost Calculator Builder plugin for WordPress up to version 4.0.11 exposes sensitive payment gateway credentials (Stripe, Razorpay, PayPal) in the page source. An unauthenticated attacker can extract these credentials when the 'use in all calculators' option is enabled for at least one payment gateway.

The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 6.7.27 via the wcfm_product_archive due to missing validation on a user controlled key.

The Catalyst Connect Zoho CRM Client Portal plugin for WordPress is vulnerable to time-based SQL injection via the 'uid' parameter in versions up to and including 2.2.0. This is due to insufficient escaping of the user-supplied parameter and lack of proper preparation of the SQL query.

The Print, PDF, Email by PrintFriendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content_position_css' parameter in all versions up to and including 5.5.10 due to insufficient input sanitization and output escaping.

The Notification for Telegram plugin for WordPress up to version 3.5.1 contains an authorization bypass vulnerability. Authenticated attackers with subscriber-level access or higher can create, modify, or reschedule the nftb_cron_hook WordPress cron event, enabling unauthorized manipulation of the plugin's background task scheduling logic.

The Affilia – Affiliate Program & Referral Tracking plugin for WordPress up to version 3.3.3 fails to properly verify user authorization before performing actions. This allows authenticated attackers with subscriber-level access or higher to approve or reject affiliate referrals, credit commissions to affiliate wallets, delete referral records, and modify custom banner options, enabling financial fraud. The only authentication check relies on a nonce embedded in every frontend page load, making it trivially accessible to any authenticated user.

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress up to version 1.4.12 is vulnerable to authorization bypass. This is due to improper verification of user authorization before performing actions.

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress up to version 1.4.12 suffers from missing authorization in AJAX actions. Lack of capability checks and nonce verification allows unauthenticated attackers to delete specific records by ID or all records from any module's database table.

The SurfLink - Ultimate Link Manager plugin for WordPress up to version 2.6.0 has a vulnerability in the ajax_import_410() function, allowing authenticated attackers with Subscriber-level access to import arbitrary URLs into the 410 Gone database table. It lacks a capability check (current_user_can()) and nonce verification (check_ajax_referer()), while other AJAX handlers in the same class are properly secured.

The ThriveDesk plugin for WordPress is vulnerable to unauthorized cache deletion due to a missing capability check in the 'thrivedesk_clear_cache' AJAX action. Authenticated attackers with Subscriber-level access and above can clear the plugin's cache.