CVE Vulnerability Catalog

The Welcart e-Commerce plugin for WordPress in versions up to and including 2.12.5 is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter. An unauthenticated attacker can inject arbitrary web scripts that execute when an administrator opens the order in the WordPress admin panel.

The WP Booking System – Booking Calendar plugin for WordPress in versions up to and including 2.1.0.5 lacks a capability check in the wpbs_action_ajax_calendar_remove_note() function. An authenticated attacker with Subscriber-level access or above can delete arbitrary calendar notes belonging to any calendar.

The VikRentCar Car Rental Management System plugin for WordPress in versions up to and including 1.4.10 is vulnerable to Stored Cross-Site Scripting via the 'optionals' parameter. An unauthenticated attacker can inject arbitrary web scripts that execute when a user accesses an injected page.

The WP Job Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'degreetitle' parameter in all versions up to, and including, 2.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Relevanssi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in versions up to 4.28.5 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. This requires comment indexing and highlighting enabled, and the payload fires when a visitor reaches a singular page via a Relevanssi search-result permalink with the highlight query parameter.

The VikRentCar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'poplink' parameter in versions up to 1.4.9 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. The handler requires only a WordPress nonce (vikwp_nonce), which the plugin emits to unauthenticated visitors on the public booking-confirmation page.

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in versions up to 2.10.7 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. Exploitation requires a previously active Pro license with REST caching enabled that has since become inactive while Disk Enhanced page caching remains configured, and the attacker must hold a previously approved commenter identity.

The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of a webmention source URL in versions up to, and including, 5.10.1. This is due to insufficient input sanitization, allowing unauthenticated attackers to inject arbitrary web scripts that execute after an administrator approves the pending webmention comment.

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in all versions up to, and including, 1.2.31. The delete_reviews_image() function trusts attachment IDs supplied via the wcpr_image_upload_id POST parameter stored in comment meta without ownership or capability checks, allowing unauthenticated attackers to permanently delete any WordPress media library attachment.

The Hustle plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.14.3. Due to improper verification of user authorization, authenticated attackers with custom-level access can overwrite the site's active ESP integration credentials (AWeber, Constant Contact, Infusionsoft, ConvertKit, or HubSpot API keys) with attacker-controlled values, diverting lead submissions to the attacker's ESP tenant, and for HubSpot, irreversibly delete OAuth tokens.

The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin in versions up to and including 7.1.1 is vulnerable to PHP Object Injection via the 'customer_note' parameter. The checkout field is insufficiently sanitized and passed to unserialize() without validation, allowing unauthenticated attackers to execute code on the server.

The PDF Invoices & Packing Slips for WooCommerce plugin is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoice_number' parameter (via document filename). Unauthenticated attackers can extract another customer's complete invoice PDF, including billing identity, shipping address, private order notes, line items, prices, dates, order ID, and invoice number, delivered directly to the attacker's email as an order confirmation attachment.

The Discussion Board – WordPress Forum Plugin is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 via the user profile Website (user_url) field. Due to insufficient output escaping in the ctdb_filter_comment_author_name() callback, authenticated attackers with subscriber-level access and above can inject arbitrary web scripts that execute when a user accesses a Discussion Board topic containing the attacker's reply.

The PDF Invoices & Packing Slips for WooCommerce plugin is vulnerable to Stored Cross-Site Scripting via the 'billing_address.first_name / last_name / company, customer_note' parameters in versions up to 5.16.4 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. This is an incomplete fix for CVE-2026-92244: the wp_kses() allow-list introduced in 5.16.2 correctly blocks raw-tag payloads but is bypassed by entity-encoded payloads (e.g., <img onerror=…>) that contain no literal angle-bracket characters and are therefore passed through unmodified before the trailing decode rematerializes them.

The SureCart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in versions up to 4.9.4 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. Successful execution requires the injected comment to be visible on a page that loads SureCart's web-component bundle (e.g., a page containing a SureCart Buy Button block), and the comment must be auto-approved or approved by a moderator.

The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed. This allows unauthenticated attackers to change the payment status of any order in the store regardless of the payment method it was placed with.

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the '__construct' function in all versions up to, and including, 2.20.4. This makes it possible for unauthenticated attackers to delete theme files on the server.

The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export. This allows unauthenticated users to read the content of draft and private posts.

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data. This allows unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the plugin's stored settings.