CVE Vulnerability Catalog

The Progressify - Progressive Web App (PWA) plugin in versions up to and including 1.6.0 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker. Insufficient input sanitization enables injection of malicious JavaScript code.

The WP Media folder plugin in versions up to and including 6.2.2 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker. Insufficient input sanitization allows injection of malicious JavaScript code.

The vulnerability allows a subscriber to perform remote code execution (RCE) in WooCommerce Designer Pro up to version 1.9.33.

The WooCommerce Appointments plugin (up to version 5.3.2) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker to perform a Blind SQL Injection attack.

The WP2LEADS plugin in versions up to and including 3.5.7 contains a SQL Injection vulnerability exploitable by an attacker with subscriber privileges. Insufficient input validation allows injection of malicious SQL queries.

Broken Access Control vulnerability in WP2LEADS up to version 3.5.7 allows a subscriber to gain unauthorized access to functions they should not have permissions for.

The JetElements For Elementor plugin in versions up to and including 2.9.2.2 contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation.

A vulnerability was identified in SourceCodester Simple Student Information System 1.0 affecting some unknown processing of the file /register.php in the Profile Field Handler component. Manipulation of the firstname/lastname arguments leads to cross site scripting, and the attack may be initiated remotely.

A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the file searchresults.php. Executing a manipulation of the argument searchbox can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

SQL Injection vulnerability in Paid Member Subscriptions up to version 3.1.1 allows a subscriber to inject malicious SQL code into database queries.

Unauthenticated Sensitive Data Exposure vulnerability in SiteVault – Backup, Restore, Migration & Cloning up to version 1.5.17 allows an unauthenticated attacker to access sensitive data.

Unauthenticated Privilege Escalation vulnerability in Salon booking system up to version 10.31.7 allows an unauthenticated attacker to escalate privileges.

Unauthenticated Cross Site Scripting (XSS) vulnerability in WP Mailster up to version 1.9.0.0 allows an unauthenticated attacker to inject malicious scripts into pages viewed by other users.

The Delete All Comments of wordpress plugin in versions up to 7.1 contains a missing authorization vulnerability due to incorrectly configured access control security levels. This allows attackers to exploit the misconfigured access control.

Subscriber Privilege Escalation vulnerability in WP User Profiles up to version 2.7.3 allows a subscriber to escalate privileges.

The Zero Spam plugin in versions up to and including 5.7.11 contains a Bypass vulnerability that allows an unauthenticated attacker to circumvent protection mechanisms.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Form Block up to version 1.8.1 allows an unauthenticated attacker to inject malicious scripts into pages viewed by other users.

Editor Privilege Escalation vulnerability in Import and export users and customers up to version 2.5.5 allows a user with the editor role to escalate privileges.

Unauthenticated PHP Object Injection vulnerability in Haaken up to version 1.5 allows an unauthenticated attacker to inject malicious PHP objects, potentially leading to remote code execution.

Unauthenticated Cross Site Scripting (XSS) vulnerability in GiveWP up to version 4.17.0 allows an unauthenticated attacker to inject malicious scripts into pages viewed by other users.