CVE Vulnerability Catalog

Grav API Plugin before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. PagesController::move() sanitizes the slug only with ltrim($body['slug'], '.'), which strips leading periods but does not neutralize '/' or '..' segments. An authenticated API caller with api.pages.write permission can supply path traversal sequences (e.g., 01.home/../../../pwned) to move an entire page directory (content and media) to an arbitrary writable location outside user/pages/, including outside the Grav installation.

Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential brute-forcing attacks and reconfigure CORS policies to include attacker-controlled origins with credentials enabled.

Remote code execution (RCE) vulnerability in Grav versions 1.7.0 through 2.0.9. FlexDirectory::dynamicDataField() calls call_user_func_array() on attacker-controlled input without restricting dangerous functions like exec or system. An authenticated user with create or update permissions on any Flex directory can execute arbitrary shell commands on the server.

Unauthenticated Cross-Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert versions up to 1.6.5.

The Kwayy HTML Sitemap plugin versions up to 4.0 contain an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability. An attacker can trick an administrator into performing unintended actions.

The Persian Woocommerce SMS plugin versions up to 7.2.2 contain an SQL Injection vulnerability exploitable by a shop manager. An attacker with shop manager privileges can manipulate database queries.

The Visualizer WordPress plugin (versions up to and including 4.0.1) has a blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands.

The PeproDev Ultimate Invoice plugin versions up to 2.2.6 contain an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. An attacker can trick the server into sending requests to internal resources.

The Manual - Documentation, Knowledge Base & Education WordPress Theme versions up to 7.5.4 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code.

The PeproDev Ultimate Invoice plugin versions up to 2.2.6 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code.

The Manual - Documentation, Knowledge Base & Education WordPress Theme versions up to 7.5.4 contain an unauthenticated Broken Access Control vulnerability. An attacker can gain unauthorized access to functions or data.

The Complianz plugin versions up to 7.5.0 contain a PHP Object Injection vulnerability exploitable by an administrator. An attacker with admin privileges can inject a malicious PHP object.

The Dokan Pro plugin versions up to 5.0.3 contain an unauthenticated Broken Access Control vulnerability. An attacker can gain unauthorized access to functions or data.

The Dokan Pro plugin versions up to 5.0.2 contain an SQL Injection vulnerability exploitable by a subscriber. An attacker with subscriber privileges can manipulate database queries.

The Dokan Pro plugin version 5.0.2 and earlier allows a subscriber-level PHP object injection. An attacker with subscriber role can submit malicious data that gets deserialized, leading to remote code execution.

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the weDevs Dokan Pro plugin allows Reflected XSS. This issue affects Dokan Pro from n/a before 5.0.7.

Cross-Site Request Forgery (CSRF) vulnerability in LA-Studio Element Kit for Elementor (lastudio-element-kit) allows Stored XSS. This issue affects versions from n/a through 1.6.2.

The Vino plugin version 1.9 and earlier allows a contributor-level Local File Inclusion. A user with contributor role can read arbitrary files from the server.

The Tonda Core plugin version 2.1.2 and earlier allows a contributor-level Local File Inclusion. A user with contributor role can read arbitrary files from the server.

The Uncanny Automator plugin version 7.3.2 and earlier allows an administrator-level SQL injection. An administrator can execute arbitrary SQL queries against the database.