CVE Vulnerability Catalog

The Video Background Block plugin in versions up to and including 2.0.3 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. The flaw allows injection of malicious scripts into site pages.

Reflected Cross-Site Scripting vulnerability in Social Rocket WordPress plugin due to improper input neutralization during web page generation. Affects versions through 1.3.5.

Unauthenticated SQL Injection vulnerability in ARMember Premium versions up to 7.8. An attacker without authentication can manipulate database queries.

The UDesign Core plugin in versions up to and including 4.15.0 contains a Subscriber-level SQL Injection vulnerability. The flaw allows injection of malicious SQL queries into the database.

Unauthenticated SQL Injection vulnerability in Porto Theme - Functionality versions up to 3.9.3. An attacker can execute unauthorized database queries.

The ListingPro plugin in versions up to and including 2.9.12 contains a Subscriber-level SQL Injection vulnerability. The flaw allows injection of malicious SQL queries into the database.

The Snapshotify – All-in-One Backup & Restore & Migrate plugin in versions up to and including 1.3.2 contains an unauthenticated Sensitive Data Exposure vulnerability. The flaw may lead to unauthorized access to confidential information.

The Norvis Backup plugin in versions up to and including 1.1.0 contains an unauthenticated Sensitive Data Exposure vulnerability. The flaw may lead to unauthorized access to confidential information.

The Museder RestoreOne plugin in versions up to and including 2.7.276 contains an unauthenticated Sensitive Data Exposure vulnerability. The flaw may lead to unauthorized access to confidential information.

The WXD Backup Lite plugin in versions up to and including 1.0.2 contains an unauthenticated Broken Access Control vulnerability. The flaw allows bypassing access control mechanisms.

The SafeSnap – Verified WordPress Backup & Restore plugin in versions up to and including 2.1.2 contains an unauthenticated Sensitive Data Exposure vulnerability. The flaw may lead to unauthorized access to confidential information.

Unauthenticated SQL Injection vulnerability in Newsletter Subscription Form – User Subscriptions Form, Capture Email versions up to 1.5.9. An attacker can inject malicious SQL queries.

The CF7 Views – Complete Entry Management for Contact Form 7 plugin in versions up to 3.2.6 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.

The Blog, Posts and Category Filter for Elementor plugin in versions up to 2.1.0 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.

The vulnerability allows an unauthenticated attacker to change settings in the TrueBooker plugin in versions up to and including 1.2.9.

Unauthenticated PHP Object Injection vulnerability in GDPR Framework By Data443 versions up to 2.5.0. An attacker can inject malicious PHP objects, potentially leading to code execution.

The Advanced Posts Listing – Show Post List Easily plugin in versions up to 1.0.8 contains a Broken Access Control vulnerability. The vulnerability can be exploited by an unauthenticated attacker.

The SendPress Newsletters WordPress plugin (versions up to 1.26.1.20) contains a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands.

The WooCommerce Multivendor Marketplace – REST API plugin in versions up to 1.6.3 contains a Broken Access Control vulnerability. The vulnerability can be exploited by an unauthenticated attacker.

The Simple JWT Login plugin in version 4.0.0 contains a Broken Authentication vulnerability. The vulnerability can be exploited by a Subscriber-level user.