CVE Vulnerability Catalog

The Uncanny Automator plugin (versions before 6.10.0) exposes sensitive system information to an unauthorized control sphere. This may allow retrieval of embedded sensitive data.

The Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to improper neutralization of input during web page generation. This issue affects versions up to and including 7.1.2.

The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fluentcrm_content' shortcode in all versions up to, and including, 2.9.84 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_remove_agent' function in all versions up to and including 3.3.1. This allows authenticated attackers with Subscriber-level access and above to remove the role and capabilities of any user with an Administrator, WSDesk Supervisor, or WSDesk Agents role.

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.9 via the 'eh_crm_ticket_single_view_client' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of all support tickets.

The Magical Products Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpdpr_title_tag' and 'mpdpr_subtitle_tag' parameters in the MPD Pricing Table widget in all versions up to and including 1.1.29 due to insufficient input sanitization and output escaping on user-supplied HTML tag names. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.

The Groundhogg plugin for WordPress is vulnerable to SQL injection via the 'term' parameter in all versions up to and including 4.2.6.1 due to insufficient escaping and lack of preparation on the SQL query. This allows authenticated attackers with Administrator-level access and above to append additional SQL queries to extract sensitive information from the database.

The WP Delete Post Copies plugin for WordPress (all versions up to and including 6.0.2) is vulnerable to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. An authenticated attacker with administrator-level permissions or above can inject arbitrary web scripts into pages that execute whenever a user accesses the injected page; this only affects multi-site installations and installations where unfiltered_html has been disabled.

The Schedule Post Changes With PublishPress Future plugin for WordPress in versions up to and including 4.9.1 is vulnerable to unauthorized modification of data due to a missing authorization check on the saveFutureActionData function. An authenticated attacker with author-level access or higher can change the status of arbitrary posts and pages via the REST API endpoint.

The HT Mega – Absolute Addons For Elementor plugin for WordPress up to version 3.0.0 is vulnerable to Stored Cross-Site Scripting (XSS) in Gutenberg blocks. The vulnerability is due to insufficient input validation on user-supplied HTML tag names, allowing dangerous tags like 'script', 'iframe', and 'object' to be injected.

The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 2.0.5 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to retrieve the output of phpinfo().

The 简数采集器 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.6.3 via the __kds_flag functionality that imports featured images. This allows authenticated attackers with Administrator-level access and above to read the contents of arbitrary files on the server.

The WP Company Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the 'social-networks' shortcode in all versions up to, and including, 1.9.0. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an injected page.

The Shortcode for Google Street View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'streetview' shortcode in all versions up to, and including, 0.5.7. This is due to insufficient input sanitization and output escaping on the 'id' attribute, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts.

The WPSite Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'format' shortcode attribute in the wpsite_y shortcode and the 'before' attribute in the wpsite_postauthor shortcode in all versions up to and including 1.2. This is due to insufficient input sanitization and output escaping in error messages. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.

The Custom Post Type plugin for WordPress (all versions up to and including 1.0) is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce validation on the custom post type deletion functionality. This makes it possible for unauthenticated attackers to delete custom post types via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The HotelRunner Booking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hotelrunner' shortcode in all versions up to, and including, 5.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The AuthorSure plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.3. Missing nonce validation on the 'authorsure' page allows unauthenticated attackers to update settings and inject malicious scripts via a forged request if an admin clicks a link.

The Import WP – Export and Import CSV and XML files plugin for WordPress up to version 2.14.17 is vulnerable to sensitive information exposure due to a lack of .htaccess protection. Unauthenticated attackers can extract sensitive data from exports stored in /exportwp and import data stored in /importwp.

The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the wps_rma_fetch_order_msgs() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read other user's order messages.