CVE Vulnerability Catalog

The Smart Manager plugin for WordPress is vulnerable to generic SQL injection via the 'access_privileges' parameter in versions up to and including 8.97.0. Authenticated attackers with subscriber-level access and above can append SQL queries to existing queries to extract sensitive information from the database. Exploitation is only possible when an administrator has saved a role-based deny-list configuration that does not block the internal 'access-privilege' module.

The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress in versions up to and including 3.5.3 is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes due to insufficient input sanitization and output escaping.

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress in versions up to and including 3.0.19 is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. An unauthenticated attacker can read, create, update, clone, and delete email notification flows, including overwriting default reservation confirmation, cancellation, and admin alert emails with attacker-controlled content.

The WPC Estimated Delivery Date for WooCommerce plugin for WordPress in versions up to and including 4.0.1 is vulnerable to Reflected Cross-Site Scripting via the 'rule_data' parameter due to insufficient input sanitization and output escaping.

The WP Ultimate Review plugin for WordPress in versions up to and including 2.4.3 is vulnerable to arbitrary shortcode execution due to improper validation of a value before running do_shortcode. The bypass relies on WordPress's strip_shortcodes() function unwrapping the [[tag]] double-bracket escape to a bare [tag] that survives wp_insert_post storage and fires when the publicly queryable xs_review post type is rendered through the_content.

The WPMobile.App – Android and iOS App Builder plugin for WordPress in versions up to and including 11.84 is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI (path segment after /android_json/search/)' parameter due to insufficient input sanitization and output escaping. Exploitation requires the app's content mode to be configured as 'webview' (i.e., the 'speed' option is not set to '1').

The WP Ultimate Review plugin for WordPress in versions up to and including 2.4.3 is vulnerable to arbitrary shortcode execution due to improper validation of a value before running do_shortcode. The nonce required to pass the only gate is emitted to unauthenticated visitors via the public review form, and submitted shortcode payloads are auto-published without admin approval by default.

The Wp Social Login and Register Social Counter plugin for WordPress in versions up to and including 3.2.1 is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute and Arbitrary User Meta Write due to insufficient input sanitization and output escaping. The attacker must chain two steps: invoking the nonce-only dismiss_ajax_call endpoint to set the xs_social_profile_image meta flag, then setting their display name to a script payload.

The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to stored DOM-based cross-site scripting via the 'X-Real-IP' HTTP header in versions up to and including 8.16. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The attack requires no authentication, nonce, or capability.

The Simple Membership plugin for WordPress is vulnerable to unauthorized data modification and sensitive information disclosure in versions up to and including 4.8.3 via the resend-activation and email-activation endpoints. Unauthenticated attackers can redirect a pending member's activation email and the follow-up 'registration complete' email containing username and plaintext password to an attacker-chosen address, and then activate the account without consent.

The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report. An unauthenticated visitor who knows a valid invitation code can obtain the usernames and email addresses of every user who registered with that code.

The Strong Testimonials plugin for WordPress is vulnerable to stored cross-site scripting via the 'platform_user_photo' custom field in versions up to and including 3.3.11. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires an administrator to have added custom text fields 'platform' and 'platform_user_photo' to a public testimonial submission form.

The Transliterator plugin for WordPress is vulnerable to stored cross-site scripting via comment content using a predictable {rstr_keep} placeholder in versions up to and including 2.5.8. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The payload survives WordPress comment sanitization because the tags and attributes used are permitted by the core comment kses allow-list.

The SEOPress plugin for WordPress is vulnerable to stored cross-site scripting via author display name in versions up to and including 10.2. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires the 'Track Authors' custom dimension to be configured in Google Analytics 4 or Matomo settings, and the attacker must be able to publish public singular content.

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page. This allows users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators.

The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read. This allows users granted the translator capability to retrieve the contents of files of certain types from anywhere on the server, including outside the web root.

The GD Rating System plugin for WordPress is vulnerable to stored cross-site scripting via 'title' and 'url' render args in gdrts_live_handler AJAX in versions up to and including 3.7.1. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Although the AJAX action requires a per-item nonce, that nonce is publicly emitted in the page's JSON block on every page rendering the rating item.

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement. This allows users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce, or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data. This allows an unauthenticated attacker to modify or delete another customer's stored cart.

The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress in versions up to and including 1.10.41 is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. An authenticated attacker with subscriber-level access or higher can overwrite the post_content of any post or page with LLM-generated text, influencing SEO and consuming paid AltText.ai API credits.