CVE Vulnerability Catalog

Unauthenticated Denial of Service (DoS) vulnerability in WP Store Locator before version 3.0.0.

The Go Live Update Urls plugin in versions up to and including 7.0.8 contains a PHP Object Injection vulnerability exploitable by a Contributor-level user. This allows injection of a malicious PHP object.

The Kadence WooCommerce Email Designer plugin in versions up to and including 1.5.19.1 contains a PHP Object Injection vulnerability exploitable by a Shop manager-level user. This enables injection of a malicious PHP object.

Cross Site Scripting (XSS) vulnerability in Pixel Manager for WooCommerce up to version 1.69.0. A user with Contributor role can inject malicious script.

Unauthenticated Insecure Direct Object References (IDOR) vulnerability in Simply Schedule Appointments up to version 1.6.12.31.

Safe SVG plugin version 2.5.0 and earlier contains an Insecure Direct Object References (IDOR) vulnerability exploitable by contributors, allowing unauthorized access to resources.

The FormGent plugin in versions up to and including 1.12.2 contains a Broken Access Control vulnerability exploitable by a Subscriber-level user. Missing access control checks allow unauthorized operations to be performed.

The AcyMailing SMTP Newsletter plugin in versions up to and including 11.0.5 is vulnerable to unauthenticated remote code execution (RCE). An attacker can execute arbitrary code without authentication.

The Import and export users and customers plugin in versions up to and including 2.5.2 contains a Privilege Escalation vulnerability exploitable by a Subscriber-level user. This allows privileges to be elevated.

The GamiPress plugin is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in SQL commands. This affects versions from n/a through 8.0.2.

Business Directory plugin version 6.4.27 and earlier contains an Insecure Direct Object References (IDOR) vulnerability exploitable by contributors, allowing unauthorized access to resources.

The NextGEN Gallery plugin in versions up to and including 4.5.0 contains an Arbitrary File Download vulnerability exploitable by an unauthenticated attacker. This allows downloading arbitrary files from the server.

The Responsive Slider Gallery plugin in versions up to and including 1.5.5 contains a PHP Object Injection vulnerability exploitable by an Editor-level user. This enables injection of a malicious PHP object.

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin in versions <= 2.33.6 is vulnerable to PHP Object Injection. The vulnerability can be exploited by a user with Contributor privileges.

The GravityExport Lite for Gravity Forms plugin in versions <= 2.7.2 contains a Broken Access Control vulnerability exploitable without authentication. An unauthenticated attacker can bypass access control mechanisms.

The Easy Pricing Tables plugin in versions <= 4.1.2 is vulnerable to SQL Injection. The vulnerability can be exploited by a user with Contributor privileges.

The Quiz Cat plugin in versions <= 3.1.1 is vulnerable to SQL Injection. The vulnerability can be exploited by a user with Author privileges.

The WordPress Persistent Login plugin in versions <= 3.1.3 is vulnerable to unauthenticated Cross Site Scripting (XSS). An unauthenticated attacker can inject malicious script.

The Site Reviews plugin in versions <= 8.3.1 is vulnerable to unauthenticated Cross Site Scripting (XSS). An unauthenticated attacker can inject malicious script.

Safe SVG plugin version 2.5.0 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by contributors, allowing injection of malicious scripts.