CVE Vulnerability Catalog

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress (up to 6.2) is vulnerable to Stored Cross-Site Scripting via the 'Subject' parameter (e.g., from CF7). Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user visits an injected page. The payload is stored without authentication via any mail-sending feature when Graph Mailer is enabled but OAuth authorization is not completed.

The Rox Appointment Booking plugin for WordPress (up to 1.3.1) is vulnerable to Privilege Escalation via Mass Assignment. The public REST endpoint allows unauthenticated attackers to persist an arbitrary WordPress user ID (wp_user_id) with a controlled email address. When an administrator opens and saves the customer record, the administrator's email is overwritten, enabling account takeover.

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.5.15 due to improper verification of user authorization. An authenticated attacker with subscriber-level access or higher can view the entire Redux options payload, including plaintext password values, API keys, license keys, and SMTP credentials, exposed in the inline JavaScript block on the profile page. The Users extension is loaded automatically for every Redux instance, so any site running Redux Framework is affected.

The User Frontend plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'field_attr[required]' parameter in versions up to and including 4.3.13 due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts that execute if they trick a user into clicking a link. The nonce check is ineffective because the wpuf_nonce value is publicly available to every anonymous visitor.

The Wp Social Login and Register Social Counter plugin for WordPress (up to 3.2.2) is vulnerable to Authentication Bypass. The social login REST callback locates an account by the email returned from the OAuth provider and sets an authentication cookie without a password check, while the only verification guard is a no-op for bundled Facebook and Twitter adapters. This allows unauthenticated attackers to obtain a session as any user, including Administrators, if they control an OAuth account with a matching email.

The WP2LEADS plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in versions up to and including 3.5.6 due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. An authenticated attacker with subscriber-level access or higher can append additional SQL queries to extract sensitive information from the database.

The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/wp-retina-2x/v1/replace REST API endpoint in versions up to and including 7.2.0. An authenticated attacker with Author-level access or higher can replace files that do not belong to them.

The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to 2.29.24 via WP_Object_Cache::_getFilePath. Unauthenticated attackers can extract complete WordPress user records — including plaintext user_login, user_email, hashed user_pass, and user_activation_key — from predictable gzip-serialized cache files at wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz. This vulnerability is only exploitable when the plugin's Object Cache feature is enabled, and requires the attacker to first trigger caching of the target user record (e.g., via an unauthenticated REST API request) before retrieving the resulting cache file.

The Popup Builder plugin for WordPress in versions up to and including 4.4.5 does not properly verify that a user is authorized to perform an action. An unauthenticated attacker can trash all published popups on the site with a single GET request, amplified by a second flaw in SGPopup::find() that causes the trash branch to fire against every popup simultaneously.

The Product Filter for WooCommerce by WBW plugin is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' JSON parameter in versions up to 3.4.6 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability persists in versions that received the 3.4.3 patch because absint() was applied only to the getVar() read path, leaving the wpf_fid value read from the JSON-decoded filterSettings payload entirely unsanitized.

The Mail logging & Catcher plugin for WordPress in versions up to and including 2.2.0 is vulnerable to Sensitive Information Exposure via the 'message' parameter. An authenticated attacker with subscriber-level access or above can extract valid administrator password-reset keys from stored email logs and complete the password-reset flow to escalate to administrator.

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in versions up to 2.10.7 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. This requires HTML Minify to be enabled with the default 'mfunc' entry present in the ignored-comment stems list, and exploitation depends on the attacker predicting the md5(time()) placeholder namespace by reading the server clock via the HTTP Date response header within the applicable time window.

The Product Filter for WooCommerce by WBW plugin is vulnerable to Missing Authorization / Information Disclosure in versions up to 3.4.6 via the 'filterSettings[default_query]' parameter of the 'filtersFrontend' AJAX action. The handler is registered as 'wp_ajax_nopriv_filtersFrontend' and performs no capability or nonce check; raw POST data is JSON-decoded into $filterSettings and the attacker-controlled 'default_query' array is unconditionally array_merge()'d into the WP_Query arguments, overriding the plugin's safe defaults (most notably post_status, post_type, posts_per_page, and nopaging). This makes it possible for unauthenticated attackers to enumerate non-public WooCommerce products (draft, future, pending) — including their count and rendered listing markup — and to force unbounded queries that load all products in a single request.

The UsersWP plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in versions up to 1.2.78. The vulnerability exists because get_dummy_user_passowrd() derives the shared password for all 25 built-in dummy user accounts as the first 15 characters of substr(hash('SHA256', AUTH_KEY . site_url()), 0, 25), while the full 25-character value of that same hash is simultaneously embedded in the hidden 'uwp_register_hash' field rendered on every registration form response — reachable without authentication via both the public /register/ page and the wp_ajax_nopriv_uwp_ajax_register_form AJAX handler, even when user registration is disabled. This makes it possible for unauthenticated attackers to recover the dummy user password directly from a single HTTP request and use it to authenticate as any of the 25 built-in dummy accounts (such as antawn, chynna, or kiki) through wp-login.php, potentially achieving privilege escalation if any dummy account holds an elevated role. Exploitation requires that an administrator has previously created dummy users via the plugin's Tools page.

The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 via the 'member[ID]' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite any existing Welcart shop-member account's email address and password by supplying that member's numeric ID, then authenticate as that member to achieve full account takeover.

The FunnelKit Automations plugin for WordPress and WooCommerce in versions up to and including 3.8.5.2 is vulnerable to time-based SQL Injection via the 'bwfan_cart_id' parameter. An unauthenticated attacker can inject additional SQL queries during a guest checkout, with the injection firing when a scheduled Action Scheduler job later reloads the stored meta.

The User Submitted Posts plugin for WordPress in versions up to and including 20260916 is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'user-submitted-content' parameter. An unauthenticated attacker can inject arbitrary web scripts that execute when a user accesses an injected page.

The ThirstyAffiliates plugin for WordPress in versions up to and including 3.12.1 is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter. An unauthenticated attacker can inject arbitrary web scripts that execute when a user accesses an injected page.

The Shipping Zones by Drawing for WooCommerce plugin in versions up to and including 3.3.0 is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter. An unauthenticated attacker can inject arbitrary attributes into the Google Maps link in the admin order view, executing when an administrator opens the order.

The Welcart e-Commerce plugin for WordPress in versions up to and including 2.12.5 is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter. An unauthenticated attacker can inject arbitrary web scripts that execute when an administrator opens the order in the WordPress admin panel.