CVE Vulnerability Catalog

The WooCommerce Extra Product Options Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '<fieldname>_start / <fieldname>_end' parameter in all versions up to and including 3.3.2 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into performing an action such as clicking a link. The vulnerability is only exploitable on product pages where a Date & Time Range Picker extra field is configured, though the required field name is visible in the product page source.

The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'querystring:<key>' URL parameter in all versions up to and including 3.15.5 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into performing an action such as clicking a link. The bypass is triggered when an attacker supplies a matching 'field:<key>' URL parameter that causes the server to fully resolve the {field:*} placeholder, forcing the client-side else-branch to abandon the server-sanitized value and reconstruct field content from the raw query string.

The WP Activity Log plugin for WordPress (versions up to and including 5.6.1) is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page.

The Smart Post plugin for WordPress (versions up to and including 4.0.9) is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page. Exploitation requires the victim page to contain an Author Filter block alongside a grid or live-filter block, and execution is triggered by a visitor clicking the attacker's author entry in the dropdown.

The SimpleForm plugin for WordPress (versions up to and including 3.10.2) is vulnerable to arbitrary file upload via the handle_upload function. Missing a server-side file key allowlist and pre-sanitization extension derivation allows a trailing-dot filename to bypass all extension and MIME validation, enabling unauthenticated attackers to upload executable files and achieve remote code execution. The only access control is a nonce printed into every public form's data-nonce attribute, trivially obtainable by any unauthenticated visitor.

A flaw was found in konflux-ci that allows privilege escalation when the user interface proxy automatically disables TLS certificate verification for connections to internal backend services in environments lacking a default service certificate authority. Because the proxy attaches a cluster-scoped authentication token with user impersonation rights to these requests, an adjacent network attacker capable of intercepting traffic can capture the credentials to gain full administrative control of the cluster.

A flaw was found in konflux-ci that allows an attacker with repository write access to achieve arbitrary code execution within the CI/CD workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest synchronization scripts to dynamically evaluate unvalidated script output. Successful exploitation allows compromise of CI/CD pipelines, theft of sensitive authentication tokens and deployment credentials, and unauthorized access to production systems.

A flaw was found in konflux-ci that allows an attacker with permission to trigger automated workflow runs to cause information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing injection of malicious filter commands. As a result, sensitive information such as API credentials, deployment keys, and internal notes may be exposed in workflow logs.

A flaw was found in konflux-ci where CI automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potentially allowing them to modify source code or release artifacts.

The FeedWordPress plugin for WordPress (versions up to and including 2026.0517) is vulnerable to Stored Cross-Site Scripting via syndicated RSS/Atom feed content. The SyndicatedPost::sanitize_content() function only strips the 'target' attribute, and SyndicatedPost::insert_post() deliberately removes WordPress's wp_filter_kses and wp_filter_post_kses filters before persisting imported feed items. This allows unauthenticated attackers who control an external feed that a site has already subscribed to to inject arbitrary web scripts into pages.

The All in One SEO plugin for WordPress in versions up to and including 5.0.3 is vulnerable to Sensitive Information Exposure via the 's' parameter. Unauthenticated attackers can extract arbitrary non-public post meta values, including sensitive custom fields such as API keys and internal notes, which are emitted verbatim into the HTML title element and JSON-LD SearchResultsPage schema.

The Amelia (Booking for Appointments and Events Calendar) plugin for WordPress in versions up to and including 2.4.12 is vulnerable to Sensitive Information Exposure via the 'page' parameter. Unauthenticated attackers can extract staff personally identifiable information (full name, email address, phone number, gender, timezone) and administrator-authored internal notes for every published event, because the raw providers array is never stripped before output in the JSON response.

The Acadlix LMS plugin for WordPress (versions up to and including 1.1.9) is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function. Authenticated attackers with subscriber-level access or higher can delete arbitrary files on the server, potentially leading to remote code execution when critical files such as wp-config.php are deleted. The route's permission callback only verifies a generic wp_rest nonce emitted in the public acadlixOptions JavaScript object on every frontend page, effectively reducing the authentication requirement to unauthenticated.

The Newsletters plugin for WordPress in versions up to and including 4.18.1 is vulnerable to time-based SQL Injection via the 'id' parameter due to insufficient escaping of user-supplied input and lack of proper preparation of the existing SQL query. An authenticated attacker with subscriber-level access or higher can append additional SQL queries to existing queries to extract sensitive information from the database. An attacker can obtain the required nonce and subscriberauth cookie without a WordPress account by subscribing through the public newsletter form and opening the management link sent via email; the ownership check verifies only the subscriber_id field and does not validate that the injected id parameter belongs to the authenticated subscriber.

The User Frontend plugin for WordPress (up to 4.3.13) is vulnerable to Privilege Escalation via the 'post_content' parameter in submit_post(). A control byte can bypass the shortcode blocklist, allowing injection of a registration shortcode with 'editor' role. This lets authenticated attackers with Subscriber-level access create an Editor account.

The Uncanny Toolkit for LearnDash plugin for WordPress (up to 3.8.2) is vulnerable to Authentication Bypass via the 'email' parameter in uo_login_action(). A parser-differential flaw allows skipping account verification by using a raw string for lookup and a sanitized string for login. This lets unauthenticated attackers log in to unverified or suspended accounts if they know the credentials.

The Shield Security plugin for WordPress (up to 22.3.2) is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI' parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user visits an injected page. The hidden 'path' column in ForTraffic.php is unescaped, enabling the attack.

The SEOPress plugin for WordPress (up to 10.3) is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter. Insufficient input sanitization and output escaping allow authenticated attackers with Subscriber-level access to inject arbitrary scripts that execute when a user visits an injected page. The payload uses the %%archive_title%% token with HTML, and the plugin substitutes the token after escaping.

The Project Manager – AI Powered Project Management plugin for WordPress (up to 4.1.1) is vulnerable to Remote Code Execution via the 'id' parameter. The unsanitized value is concatenated into a validation rule string and then invoked as a dynamic PHP function without allowlist checks. This allows unauthenticated attackers to execute code on the server.

The PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter (mapped to display_name) in versions up to and including 4.17.0 due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or higher can inject arbitrary scripts that execute when a user visits the injected page. Exploitation requires the attacker's account to have a mapped author term, which is not present by default for new users.