CVE Vulnerability Catalog

Missing authorization in the Blog2Social plugin for WordPress (up to version 8.8.3). Authenticated attackers with Subscriber access can modify, reschedule, or delete other users' scheduled social media posts by manipulating the b2s_id parameter.

The WowPress plugin for WordPress up to version 1.0.0 is vulnerable to Stored XSS via shortcode attributes. Authenticated attackers with contributor-level access can inject arbitrary scripts that execute when users visit affected pages.

The Wavr plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the `wave` shortcode. This is due to insufficient input sanitization and output escaping on user supplied attributes.

Stored Cross-Site Scripting vulnerability in the Inquiry Form to Posts or Pages plugin for WordPress up to version 1.0. The 'Form Header' field is insufficiently sanitized and escaped, allowing authenticated admin-level attackers to inject arbitrary scripts that execute on the plugin settings page or pages with the [inquiry_form] shortcode.

The Masteriyo LMS plugin for WordPress up to version 2.1.7 has an authorization bypass vulnerability due to insufficient webhook signature verification. Unauthenticated attackers can send fake Stripe webhook events and mark any order as completed without payment.

The Sports Club Management plugin for WordPress up to version 1.12.9 is vulnerable to stored XSS via the 'before' and 'after' attributes of the scm_member_data shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary scripts that execute when a user visits an affected page.

The Quran Translations plugin for WordPress up to version 1.7 is vulnerable to Cross-Site Request Forgery (CSRF). Missing nonce verification in the quran_playlist_options() function allows an unauthenticated attacker to modify plugin settings via a forged request, provided they trick an administrator into clicking a link.

The Attendance Manager plugin for WordPress up to version 0.6.2 is vulnerable to SQL injection via the 'attmgr_off' parameter. Authenticated attackers with Subscriber-level access or higher can append malicious SQL queries to extract sensitive database information.

The Columns by BestWebSoft plugin for WordPress up to version 1.0.3 is vulnerable to Stored XSS via the 'id' attribute of the '[print_clmns]' shortcode. Lack of output escaping allows attackers with contributor-level access to inject arbitrary scripts, provided at least one column exists created by an admin.

The Riaxe Product Customizer plugin for WordPress up to version 2.4 exposes the REST API endpoint '/wp-json/InkXEProductDesignerLite/orders' without authentication, allowing unauthenticated attackers to extract sensitive customer and order data from WooCommerce, including names, IDs, totals, and statuses.

The WP Blockade plugin for WordPress up to version 0.9.14 lacks authorization in the render_shortcode_preview() function, allowing any authenticated user to execute arbitrary WordPress shortcodes.

The PZ Frontend Manager plugin for WordPress up to version 1.0.6 contains a missing authorization vulnerability in the pzfm_user_request_action_callback() function. This AJAX function lacks capability checks and nonce verification, allowing authenticated attackers with Subscriber-level access or higher to delete arbitrary WordPress users, including administrators.

The Pinterest Site Verification plugin using Meta Tag for WordPress versions up to 1.8 contains a stored cross-site scripting vulnerability via the 'post_var' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.

The Whole Enquiry Cart for WooCommerce plugin for WordPress versions up to 1.2.1 contains a stored cross-site scripting vulnerability via the 'woowhole_success_msg' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level access can inject arbitrary web scripts that execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

The AM LottiePlayer plugin for WordPress up to version 3.6.0 is vulnerable to Stored Cross-Site Scripting via uploaded SVG files due to insufficient input sanitization and output escaping. Authenticated attackers with Author-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.

In the Ado::Sessions library for Perl up to version 0.935, insecure session IDs are generated. The IDs are based on the rand() function, epoch time, and PID, making them predictable. Ado is no longer maintained and has been removed from the CPAN index.

Amon2::Plugin::Web::CSRFDefender versions 7.00 through 7.03 for Perl generate an insecure session id. The generate_session_id function attempts to read from /dev/urandom, but if unavailable, generates bytes using SHA-1 seeded with rand(), PID, and epoch time. PID comes from a small set, and time may be guessed. The rand() function is unsuitable for cryptographic purposes.

The Plus Addons for Elementor plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in the Progress Bar shortcode due to insufficient input sanitization and output escaping. This affects versions up to and including 6.4.9.

Cross-site scripting vulnerability exists in MATCHA SNS 1.3.9 and earlier. If exploited, an arbitrary script may be executed in the web browser of the user who accessed the website using the product.

The LatePoint plugin for WordPress up to version 5.3.0 contains a Stored XSS vulnerability via the 'button_caption' parameter in the [latepoint_resources] shortcode. Attackers with contributor-level access or higher can inject arbitrary scripts that execute when a user visits the page.