CVE Vulnerability Catalog

The Content Pilot plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.2.4. The plugin extracts HTML meta descriptions from remotely fetched RSS articles, processes them without proper sanitization, and saves them as post content, allowing an unauthenticated attacker controlling an RSS source to inject arbitrary scripts. These scripts execute when a user visits the injected page.

The WP Data Access plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 5.5.88 via the 'rel_tab' parameter. An unauthenticated attacker can extract all rows and columns of the database table backing any anonymously published app, including user password hashes, email addresses, and password-reset keys. This requires an administrator to have published at least one app with REST API authorization set to 'anonymous'.

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.5.15 due to improper verification of user authorization. An authenticated attacker with subscriber-level access or higher can view the entire Redux options payload, including plaintext password values, API keys, license keys, and SMTP credentials, exposed in the inline JavaScript block on the profile page. The Users extension is loaded automatically for every Redux instance, so any site running Redux Framework is affected.

The User Frontend plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'field_attr[required]' parameter in versions up to and including 4.3.13 due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts that execute if they trick a user into clicking a link. The nonce check is ineffective because the wpuf_nonce value is publicly available to every anonymous visitor.

The WP2LEADS plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in versions up to and including 3.5.6 due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. An authenticated attacker with subscriber-level access or higher can append additional SQL queries to extract sensitive information from the database.

The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/wp-retina-2x/v1/replace REST API endpoint in versions up to and including 7.2.0. An authenticated attacker with Author-level access or higher can replace files that do not belong to them.

The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to 2.29.24 via WP_Object_Cache::_getFilePath. Unauthenticated attackers can extract complete WordPress user records — including plaintext user_login, user_email, hashed user_pass, and user_activation_key — from predictable gzip-serialized cache files at wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz. This vulnerability is only exploitable when the plugin's Object Cache feature is enabled, and requires the attacker to first trigger caching of the target user record (e.g., via an unauthenticated REST API request) before retrieving the resulting cache file.

The Product Filter for WooCommerce by WBW plugin is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' JSON parameter in versions up to 3.4.6 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability persists in versions that received the 3.4.3 patch because absint() was applied only to the getVar() read path, leaving the wpf_fid value read from the JSON-decoded filterSettings payload entirely unsanitized.

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in versions up to 2.10.7 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. This requires HTML Minify to be enabled with the default 'mfunc' entry present in the ignored-comment stems list, and exploitation depends on the attacker predicting the md5(time()) placeholder namespace by reading the server clock via the HTTP Date response header within the applicable time window.

The Product Filter for WooCommerce by WBW plugin is vulnerable to Missing Authorization / Information Disclosure in versions up to 3.4.6 via the 'filterSettings[default_query]' parameter of the 'filtersFrontend' AJAX action. The handler is registered as 'wp_ajax_nopriv_filtersFrontend' and performs no capability or nonce check; raw POST data is JSON-decoded into $filterSettings and the attacker-controlled 'default_query' array is unconditionally array_merge()'d into the WP_Query arguments, overriding the plugin's safe defaults (most notably post_status, post_type, posts_per_page, and nopaging). This makes it possible for unauthenticated attackers to enumerate non-public WooCommerce products (draft, future, pending) — including their count and rendered listing markup — and to force unbounded queries that load all products in a single request.

The UsersWP plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in versions up to 1.2.78. The vulnerability exists because get_dummy_user_passowrd() derives the shared password for all 25 built-in dummy user accounts as the first 15 characters of substr(hash('SHA256', AUTH_KEY . site_url()), 0, 25), while the full 25-character value of that same hash is simultaneously embedded in the hidden 'uwp_register_hash' field rendered on every registration form response — reachable without authentication via both the public /register/ page and the wp_ajax_nopriv_uwp_ajax_register_form AJAX handler, even when user registration is disabled. This makes it possible for unauthenticated attackers to recover the dummy user password directly from a single HTTP request and use it to authenticate as any of the 25 built-in dummy accounts (such as antawn, chynna, or kiki) through wp-login.php, potentially achieving privilege escalation if any dummy account holds an elevated role. Exploitation requires that an administrator has previously created dummy users via the plugin's Tools page.

The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 via the 'member[ID]' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite any existing Welcart shop-member account's email address and password by supplying that member's numeric ID, then authenticate as that member to achieve full account takeover.

The WP Job Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'degreetitle' parameter in all versions up to, and including, 2.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of a webmention source URL in versions up to, and including, 5.10.1. This is due to insufficient input sanitization, allowing unauthenticated attackers to inject arbitrary web scripts that execute after an administrator approves the pending webmention comment.

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in all versions up to, and including, 1.2.31. The delete_reviews_image() function trusts attachment IDs supplied via the wcpr_image_upload_id POST parameter stored in comment meta without ownership or capability checks, allowing unauthenticated attackers to permanently delete any WordPress media library attachment.

The Hustle plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.14.3. Due to improper verification of user authorization, authenticated attackers with custom-level access can overwrite the site's active ESP integration credentials (AWeber, Constant Contact, Infusionsoft, ConvertKit, or HubSpot API keys) with attacker-controlled values, diverting lead submissions to the attacker's ESP tenant, and for HubSpot, irreversibly delete OAuth tokens.

The PDF Invoices & Packing Slips for WooCommerce plugin is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoice_number' parameter (via document filename). Unauthenticated attackers can extract another customer's complete invoice PDF, including billing identity, shipping address, private order notes, line items, prices, dates, order ID, and invoice number, delivered directly to the attacker's email as an order confirmation attachment.

The Discussion Board – WordPress Forum Plugin is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 via the user profile Website (user_url) field. Due to insufficient output escaping in the ctdb_filter_comment_author_name() callback, authenticated attackers with subscriber-level access and above can inject arbitrary web scripts that execute when a user accesses a Discussion Board topic containing the attacker's reply.

The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed. This allows unauthenticated attackers to change the payment status of any order in the store regardless of the payment method it was placed with.

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the '__construct' function in all versions up to, and including, 2.20.4. This makes it possible for unauthenticated attackers to delete theme files on the server.