CVE Vulnerability Catalog

The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 14. This is due to a flawed permission check in the REST API permission callback that returns true when no nonce is provided. This makes it possible for unauthenticated attackers to impersonate any WordPress user and inject arbitrary messages into any WooCommerce order conversation by directly calling the REST endpoint with controlled user_id, order_id, and context parameters.

The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to unauthorized data export due to a missing capability check on the cdash_watch_for_export() function in all versions up to and including 3.3.11. Unauthenticated attackers can export business directory information, including sensitive business details.

The Ace Post Type Builder plugin for WordPress is vulnerable to unauthorized custom taxonomy deletion due to missing authorization validation on the cptb_delete_custom_taxonomy() function in all versions up to and including 1.9. This allows authenticated attackers with Subscriber-level access and above to delete arbitrary custom taxonomies.

The atec Duplicate Page & Post plugin for WordPress is vulnerable to unauthorized post duplication due to missing authorization validation on the duplicate_post() function in all versions up to and including 1.2.20. This allows authenticated attackers with Contributor-level access and above to duplicate arbitrary posts, including private and password-protected posts, leading to data exposure.

The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_order_by_id() function in all versions up to and including 14. Unauthenticated attackers can view sensitive WooCommerce order details and private conversation messages between customers and store administrators for any order by supplying an arbitrary order ID.

The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'options_update' function in all versions up to, and including, 2.1. This makes it possible for unauthenticated attackers to delete the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The Bookme – Free Online Appointment Booking and Scheduling Plugin for WordPress is vulnerable to time-based SQL Injection via the `filter[status]` parameter in all versions up to, and including, 4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.

The Job Board by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 1.2.1. This is because the plugin stores the entire unsanitized $_GET superglobal array directly into the database via update_user_meta() when users save search results, and later outputs this data without proper escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses the saved search or views their profile, provided they can trick the user into performing the search and saving the results.

The Frontend File Manager plugin for WordPress (versions up to and including 23.4) is vulnerable to Insecure Direct Object Reference (IDOR) in the '/wpfm/v1/file-rename' REST API endpoint because it does not validate file ownership before processing rename requests. An authenticated attacker with Subscriber-level access or above can rename files uploaded by other users via the 'fileid' parameter.

The AI Engine for WordPress: ChatGPT, GPT Content Generator plugin is vulnerable to arbitrary file read in all versions up to and including 1.0.1. This is due to insufficient validation of user-supplied file paths in the 'lqdai_update_post' AJAX endpoint and the use of file_get_contents() with user-controlled URLs without protocol restrictions in the insert_image() function.

The ProjectList plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 0.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The Just Highlight plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Highlight Color' setting in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the plugin's settings page.

The Inline frame – Iframe plugin for WordPress (all versions up to and including 0.1) is vulnerable to stored cross-site scripting via the 'embedsite' shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. An authenticated attacker with contributor-level access or above can inject arbitrary web scripts.

The Refund Request for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_refund_status' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update refund statuses to approved or rejected.

The Peer Publish plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0 due to missing nonce validation on website management pages. This allows unauthenticated attackers to add, modify, or delete website configurations via a forged request if they trick an administrator into clicking a link.

The Conditional Maintenance Mode for WordPress plugin is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.0 due to missing nonce validation when toggling maintenance mode status. An unauthenticated attacker can enable or disable the site's maintenance mode via a forged request if they trick an administrator into clicking a link.

The Locker Content plugin for WordPress version 1.0.0 is vulnerable to Sensitive Information Exposure via the 'lockerco_submit_post' AJAX endpoint, allowing unauthenticated attackers to extract content from posts protected by the plugin.

The Autochat Automatic Conversation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_auycht_saveCid' AJAX endpoint in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to connect and disconnect the client ID.

The Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference (IDOR) in versions up to and including 1.1.3 via several functions in class-th-wishlist-frontend.php due to missing validation on a user-controlled key. This allows unauthenticated attackers to modify other users' wishlists.

The Zweb Social Mobile – Ứng Dụng Nút Gọi Mobile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘vithanhlam_zsocial_save_messager’, 'vithanhlam_zsocial_save_zalo', 'vithanhlam_zsocial_save_hotline', and 'vithanhlam_zsocial_save_contact' parameters in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.