CVE Vulnerability Catalog

The CF7 Views – Complete Entry Management for Contact Form 7 plugin in versions up to 3.2.6 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.

The Blog, Posts and Category Filter for Elementor plugin in versions up to 2.1.0 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.

The vulnerability allows an unauthenticated attacker to change settings in the TrueBooker plugin in versions up to and including 1.2.9.

Unauthenticated PHP Object Injection vulnerability in GDPR Framework By Data443 versions up to 2.5.0. An attacker can inject malicious PHP objects, potentially leading to code execution.

The Advanced Posts Listing – Show Post List Easily plugin in versions up to 1.0.8 contains a Broken Access Control vulnerability. The vulnerability can be exploited by an unauthenticated attacker.

The SendPress Newsletters WordPress plugin (versions up to 1.26.1.20) contains a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands.

The WooCommerce Multivendor Marketplace – REST API plugin in versions up to 1.6.3 contains a Broken Access Control vulnerability. The vulnerability can be exploited by an unauthenticated attacker.

The Simple JWT Login plugin in version 4.0.0 contains a Broken Authentication vulnerability. The vulnerability can be exploited by a Subscriber-level user.

The Simple File List plugin in versions up to 6.3.11 contains an Arbitrary File Deletion vulnerability. The vulnerability can be exploited by an unauthenticated attacker.

The vulnerability allows an unauthenticated attacker to access sensitive data in the Mailjet Email Marketing plugin in versions up to and including 6.2.3.

Reflected XSS vulnerability in the VikRentCar WordPress plugin, versions up to 1.4.7. Improper input neutralization during page generation allows reflected XSS attacks.

The vulnerability allows a subscriber-level user to perform a Cross Site Scripting (XSS) attack in the Front End PM plugin in versions up to and including 11.4.6.

The vulnerability allows an unauthenticated attacker to exploit Broken Access Control in the 10Web Social Photo Feed plugin in versions up to and including 1.4.35.

The Gmedia Photo Gallery (grand-media) plugin by Serhii Pasyuk contains an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. The vulnerability allows Blind SQL Injection and affects versions from n/a through 1.25.1.

The Hotel Booking plugin in versions up to 3.8 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery (document-gallery) allows Reflected XSS. This issue affects Document Gallery through version 5.1.1.

The Youzify plugin in versions up to 1.3.7 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.

The Ansar Import – One Click Starter Sites – for Elementor & Themes plugin in versions <= 2.1.2 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.

The Tabs plugin in versions <= 2.5 contains a Remote Code Execution (RCE) vulnerability exploitable by an editor-level user.

The JobZilla - Job Board WordPress theme in versions <= 2.2 contains a privilege escalation vulnerability exploitable by a subscriber-level user.