CVE Vulnerability Catalog

The Responsive Slider Gallery plugin in versions up to and including 1.5.5 contains a PHP Object Injection vulnerability exploitable by an Editor-level user. This enables injection of a malicious PHP object.

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin in versions <= 2.33.6 is vulnerable to PHP Object Injection. The vulnerability can be exploited by a user with Contributor privileges.

The GravityExport Lite for Gravity Forms plugin in versions <= 2.7.2 contains a Broken Access Control vulnerability exploitable without authentication. An unauthenticated attacker can bypass access control mechanisms.

The Easy Pricing Tables plugin in versions <= 4.1.2 is vulnerable to SQL Injection. The vulnerability can be exploited by a user with Contributor privileges.

The Quiz Cat plugin in versions <= 3.1.1 is vulnerable to SQL Injection. The vulnerability can be exploited by a user with Author privileges.

The WordPress Persistent Login plugin in versions <= 3.1.3 is vulnerable to unauthenticated Cross Site Scripting (XSS). An unauthenticated attacker can inject malicious script.

The Site Reviews plugin in versions <= 8.3.1 is vulnerable to unauthenticated Cross Site Scripting (XSS). An unauthenticated attacker can inject malicious script.

Safe SVG plugin version 2.5.0 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by contributors, allowing injection of malicious scripts.

The SEO Plugin by Squirrly SEO in versions <= 14.2.5 is vulnerable to PHP Object Injection. The vulnerability can be exploited by a user with Contributor privileges.

Simply Schedule Appointments plugin version 1.6.12.29 and earlier contains a Broken Access Control vulnerability that can be exploited without authentication, allowing unauthorized access to functionality.

The Cost of Goods for WooCommerce plugin in versions <= 3.5.2 is vulnerable to PHP Object Injection. The vulnerability can be exploited by a user with Shop manager privileges.

The WP Statistics plugin in versions <= 14.16.13 is vulnerable to unauthenticated Cross Site Scripting (XSS). An unauthenticated attacker can inject malicious script.

The Minimum and Maximum Quantity for WooCommerce plugin in versions <= 2.1.2 is vulnerable to PHP Object Injection. The vulnerability can be exploited by a user with Author privileges.

The Music Player for WooCommerce plugin versions 1.9.1 and earlier contains a PHP Object Injection vulnerability exploitable by a shop manager. An attacker with shop manager privileges can exploit this to execute arbitrary code.

The WP Data Access plugin versions 5.5.84 and earlier contain an unauthenticated SQL Injection vulnerability. A remote attacker can exploit this to execute unauthorized queries against the database.

The Notification for Telegram plugin versions 3.5.2 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

The JW Player for WordPress plugin versions 2.3.11 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

Apache WSS4J stores the Nonce of each accepted UsernameToken as raw base64 text, but authentication decodes that text and uses the bytes. The same bytes can be written as base64 in several ways. An attacker who captured an authenticated request could re-send it with a space added to the Nonce: the password digest still verified, but the token no longer matched the remembered one, so the replay was accepted. Since a UsernameToken does not cover the message body, the captured token could then be reused on requests of the attacker's choosing until it expired. Affects deployments with a nonce replay cache configured, as Apache CXF has by default, and only tokens using a password digest. The cache is now keyed on the decoded Nonce. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and SignedElements for the rest of the message. A policy requiring the SOAP Body to be signed is then satisfied even when the Body carries no signature, removing the protection against XML Signature Wrapping. The DOM code is not affected. Users are recommended to upgrade to versions 4.0.2, 3.0.6, or 2.4.4 which fix this issue.

WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass.