CVE Vulnerability Catalog

The BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5 due to missing nonce validation on the woobe_delete_tax_term() function. This makes it possible for unauthenticated attackers to delete WooCommerce taxonomy terms (categories, tags, etc.) via a forged request granted they can trick a site administrator or shop manager into performing an action such as clicking on a link.

The BEAR – Bulk Editor and Products Manager Professional plugin for WordPress up to version 1.1.5 is vulnerable to CSRF due to missing nonce validation in the woobe_redraw_table_row() function, allowing unauthenticated attackers to trick admins into updating WooCommerce product data.

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wsm_showDayStatsGraph' shortcode in all versions up to and including 8.4 due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute whenever a user accesses an injected page.

The Robo Gallery plugin for WordPress up to version 5.1.3 is vulnerable to Stored Cross-Site Scripting via the 'Loading Label' setting. The plugin uses a `|***...***|` marker pattern to embed raw JavaScript code within JSON configuration objects. Authenticated attackers with Author-level access can inject arbitrary scripts that execute whenever a page with the gallery is viewed.

The pdfl.io plugin for WordPress up to version 1.0.5 is vulnerable to Stored XSS via the 'text' attribute of the 'pdflio' shortcode. Lack of output escaping allows attackers with contributor-level access to inject arbitrary scripts.

The PrivateContent Free plugin for WordPress, all versions up to and including 1.2.0, has a Stored XSS vulnerability via the 'align' shortcode attribute in the [pc-login-form] shortcode. The attribute is not properly sanitized or escaped, allowing authenticated attackers with Contributor-level access and above to inject arbitrary scripts.

The Flipmart plugin for WordPress (versions up to 2.8) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The AnyTrack Affiliate Link Manager plugin for WordPress up to version 1.5.5 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.

Missing authorization in the G5Plus April theme (g5plus-april) allows exploiting incorrectly configured access control security levels. The vulnerability affects versions up to 6.8 inclusive.

The Mailercloud WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.0.7.

The tagDiv Composer (td-composer) plugin for WordPress versions up to and including 5.4.3 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags, allowing code injection.

The RT-Theme 18 | Extensions plugin for WordPress up to version 2.5 inserts sensitive data into sent information. Attackers can retrieve embedded sensitive data.

CSRF vulnerability in RT-Theme 18 | Extensions (rt18-extensions) up to version 2.5 inclusive. Allows Cross-Site Request Forgery.

The Tribal WordPress plugin inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions up to and including 1.3.4.

The UiCore Elements plugin (versions up to and including 1.3.17) is vulnerable to Stored XSS due to improper neutralization of input during web page generation.

The Accept PayPal Payments using Contact Form 7 extension for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 4.0.4.

Missing authorization in the Make My Trivia plugin allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.1.0.

The MIPL WC Multisite Sync plugin for WordPress up to version 1.4.4 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.

Missing authorization in the Precious Metals Automated Product Pricing – Pro plugin allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 4.0.5.

The WPBITS Addons For Elementor Page Builder plugin for WordPress (versions up to and including 1.8.1) contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject a malicious script that executes in other users' browsers.