CVE Vulnerability Catalog

The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via the 'filtersource' parameter in all versions up to and including 14.6 due to insufficient escaping and lack of query preparation. This allows authenticated attackers with administrator-level access to append additional SQL queries and extract sensitive information from the database.

The WPBot – AI ChatBot plugin for WordPress up to version 8.5.6 has an authorization bypass vulnerability. An authenticated attacker with subscriber-level access or higher can trigger arbitrary re-embedding of stored RAG documents, modifying the rag_documents table and consuming the site owner's paid third-party AI API credits (OpenAI, Gemini, OpenRouter, or xAI).

The Themify Builder plugin for WordPress up to version 7.7.7 contains an authorization bypass vulnerability. Authenticated attackers with subscriber-level access or higher can overwrite or delete generated CSS stylesheets of arbitrary posts, including private and draft posts of other users, and modify plugin-scoped font options. The CSRF nonce (tf_nonce) is exposed on public front-end pages, making it easily obtainable.

The Cache Purger plugin for WordPress up to version 2.3.20 has an authorization bypass vulnerability that allows authenticated attackers with subscriber-level access or higher to permanently delete the cache-purge audit log (wp-content/purge.log). This is due to insufficient verification of user permissions before performing the action.

The SysBasics Customize My Account for WooCommerce – Live My Account Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'row_type' parameter in all versions up to and including 4.4.14 due to insufficient input sanitization and output escaping.

The WPBot – AI ChatBot plugin for WordPress up to version 8.5.6 has an authorization bypass vulnerability that allows unauthenticated attackers to delete arbitrary chat session records from the database, including chat history and conversation logs. The issue stems from insufficient user permission verification before performing actions.

The Delicious Recipes plugin for WordPress up to version 1.10.2 is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute. This is due to insufficient input sanitization and output escaping in the wrap_direction_text() function, which interpolates the user-supplied href value from nested link nodes directly into an anchor tag via sprintf() without esc_url() or URL scheme validation.

The Tutor LMS plugin for WordPress up to version 4.0.0 inclusive contains a second-order SQL injection vulnerability. An authenticated attacker with custom-level access or higher can store a malicious SQL query in a quiz answer, which executes when a privileged user or REST API key holder requests the /wp-json/tutor/v1/quiz-attempt-details/{id} endpoint.

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'location' Profile Field in all versions up to and including 3.1.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts that execute whenever a user accesses an injected page.

The Quiz Master Next plugin for WordPress up to version 11.2.0 is vulnerable to SQL Injection via stored quiz page data. This is due to insufficient escaping of the 'pages' parameter in the qsm_ajax_save_pages() AJAX handler and lack of prepared SQL statement in qsm_options_questions_tab_content(), allowing authenticated attackers with Author-level access or higher to inject malicious SQL.

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'price_wrapper' shortcode attribute in all versions up to and including 3.6.0.0 due to insufficient input sanitization and output escaping.

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to and including 3.6.0.0 due to insufficient escaping and lack of proper query preparation.

The FunnelKit WordPress plugin before version 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation. This allows users with administrator privileges to delete arbitrary .json files outside the intended directory through path traversal, potentially disabling other FunnelKit plugin functions (denial of service).

The Header Footer Builder for Elementor WordPress plugin before version 1.2.1 does not require administrative capability for its dashboard template-import action. A Contributor can import a template containing an Elementor HTML widget that executes JavaScript site-wide for any visitor or administrator.

The Customer Reviews for WooCommerce WordPress plugin before version 5.113.0 lacks authentication, capability, and nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled. This allows unauthenticated users to upload media files (limited to an image and video allowlist) to the Media Library and create attachment posts, leading to media library pollution and disk space exhaustion.

The AI Engine WordPress plugin before version 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users' private conversations and take over their conversation records when the discussions feature is enabled.

The WP Job Portal WordPress plugin before version 2.5.5 fails to properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with a subscriber-level (self-registerable) account to perform SQL injection attacks.

The Appointment Booking Plugin for WordPress before version 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcher. This allows attackers to perform privileged actions, such as overwriting the booking-form configuration or disconnecting the connected payment gateway, via Cross-Site Request Forgery against a logged-in administrator.

The BetterDocs WordPress plugin before version 4.5.5 does not sanitize an AI-generated documentation summary before storing and outputting it. The feature is exposed to unauthenticated users, allowing them to store a malicious payload via prompt injection that executes in the browser of any visitor, including administrators.

The SEO Booster plugin for WordPress is vulnerable to generic SQL Injection via the 'sort_field' parameter in all versions up to and including 7.3.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query.