CVE Vulnerability Catalog

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Virusdie virusdie allows retrieving embedded sensitive data. This issue affects Virusdie from n/a through <= 1.1.6.

Missing Authorization vulnerability in Wappointment team Wappointment allows exploiting incorrectly configured access control security levels. This issue affects Wappointment through <= 2.7.6.

The WPBakery Visual Composer WHMCS Elements plugin for WordPress has a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 1.0.4.3.

The Simple Keyword to Link plugin (up to version 1.5) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick an authenticated user into performing unwanted actions within the application.

The BBP Core plugin (up to version 1.4.1) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can gain unauthorized access to plugin functionality.

The SALESmanago & Leadoo plugin (up to version 3.9.0) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can leverage this to perform unauthorized actions.

The Claspo – Popups, Spin the Wheel & Email Capture plugin (up to version 1.0.7) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can gain unauthorized access to plugin functionality.

CSRF vulnerability in My auctions allegro up to version 3.6.33. Allows an attacker to perform unauthorized actions in the context of a logged-in user.

Stored XSS vulnerability in the My auctions allegro plugin (up to version 3.6.35) allows an attacker to inject malicious script into a page, which will be executed in another user's browser.

The Twitch Player plugin (ttv-easy-embed-player) in versions up to and including 2.1.3 contains a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.

Missing Authorization vulnerability in Sunshine Photo Cart (up to 3.5.7.1) allows exploiting incorrectly configured access control security levels.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes WC Builder wc-builder allows Stored XSS. This issue affects WC Builder: from n/a through <= 1.2.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in modeltheme ModelTheme Addons for WPBakery and Elementor modeltheme-addons-for-wpbakery allows Stored XSS. This issue affects ModelTheme Addons for WPBakery and Elementor: from n/a through < 1.5.6.

CSRF vulnerability in WP Email Capture up to version 3.12.5. Allows an attacker to perform unauthorized actions in the context of a logged-in user.

The Free Shipping Bar: Amount Left for Free Shipping for WooCommerce plugin up to version 2.4.9 contains a Stored Cross-site Scripting (XSS) vulnerability that allows an attacker to inject a persistent script into the website.

The Academy LMS plugin up to version 3.4.0 contains a Stored Cross-site Scripting (XSS) vulnerability that allows an attacker to inject a persistent script into the website.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Category Icon category-icon allows Stored XSS. This issue affects Category Icon: from n/a through <= 1.0.2.

Missing Authorization vulnerability in Spiffy Calendar (up to 5.0.7) allows exploiting incorrectly configured access control security levels.

Missing authorization in WpStream wpstream allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 4.9.5.

Missing authorization in WpStream wpstream allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 4.9.5.