CVE Vulnerability Catalog

upKeeper Manager contains a vulnerability where sensitive information is inserted into log files, allowing use of known domain credentials. This affects versions from 5.2.0 before 5.2.12.

The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Improper Authorization leading to Sensitive Post Meta Disclosure in versions up to and including 1.3.2. This is due to missing object-level authorization checks in the resolve_variables() AJAX handler. This makes it possible for authenticated attackers with the siteseo_manage capability (e.g., Author-level users who have been granted SiteSEO access by an administrator) to read arbitrary post metadata from any post, page, attachment, or WooCommerce order they cannot edit, via the custom field variable resolution feature granted they have been given access to SiteSEO by an administrator and legacy storage is enabled. In affected WooCommerce installations, this exposes sensitive customer billing information including names, email addresses, phone numbers, physical addresses, and payment methods.

The WordPress plugin 'SureForms' is vulnerable to Cross-Site Request Forgery Bypass in all versions up to and including 1.13.1. The plugin distributes generic WordPress REST API nonces (wp_rest) to unauthenticated users, allowing bypass of CSRF protection on REST API endpoints relying solely on nonce verification.

The User Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppb-embed shortcode in all versions up to and including 3.14.8 due to insufficient input sanitization and output escaping on user supplied attributes.

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `wfop_phone` shortcode in all versions up to, and including, 3.13.1.2. This is due to insufficient input sanitization and output escaping on the user-supplied `default` attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Booking Plugin for WordPress Appointments – Time Slot plugin in versions up to and including 1.4.7 is vulnerable to unauthorized email sending due to missing validation on the 'tslot_appt_email' AJAX action. This allows unauthenticated attackers to send appointment notification emails to arbitrary recipients with attacker-controlled text content.

The WordPress plugin 'WP Login and Register using JWT' is vulnerable to unauthorized data access due to a missing capability check on the 'mo_jwt_generate_new_api_key' function in all versions up to and including 3.0.0. Authenticated attackers with Subscriber-level access and above can generate a new API key on sites without one and use it to access restricted endpoints.

The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect capability check on the siteseo_reset_settings function in all versions up to and including 1.3.2. This allows authenticated attackers with access to at least one SiteSEO setting capability to reset the plugin's settings.

The WSChat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'reset_settings' AJAX endpoint in all versions up to and including 3.1.6.

The Pet-Manager – Petfinder plugin for WordPress is vulnerable to stored cross-site scripting via the kwm-petfinder shortcode in all versions up to and including 3.6.1 due to insufficient input sanitization and output escaping on user-supplied attributes. An authenticated attacker with Contributor-level access or above can inject arbitrary scripts that execute when a user visits the page.

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.3 via the 'get_image_size_by_url' function. This is due to insufficient validation of user-supplied URLs when determining image dimensions for gallery items. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

The Directorist plugin for WordPress (versions up to and including 8.5.2) lacks capability checks on the 'directorist_prepare_listings_export_file' and 'directorist_type_slug_change' AJAX actions. An authenticated attacker with Subscriber-level access or above can export listing details and change the directorist slug.

The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.0.80. The plugin exposes quiz answers through the ays_quiz_check_answer AJAX action without proper authorization checks; the endpoint only validates a nonce that is publicly available to all site visitors, allowing unauthenticated attackers to extract quiz answers.

The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Authorization in versions up to, and including, 5.9.10. This is due to the plugin not properly verifying that a user is authorized to perform an action in the `trigger_mailing_queue_sending` function.

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via $item['field_id'] in all versions up to and including 1.7.1036 due to insufficient input sanitization and output escaping.

The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.10.0. This is due to the plugin not properly verifying that a user is authorized to perform actions on the REST API /wp-json/yith/wishlist/v1/lists endpoint (which uses permission_callback => '__return_true') and the AJAX delete_item handler (which only checks nonce validity without verifying object-level authorization). This makes it possible for unauthenticated attackers to disclose wishlist tokens for any user and subsequently delete wishlist items by chaining the REST API authorization bypass with the exposed delete_item nonce on shared wishlist pages and the AJAX handler's missing object-level authorization check.

The New User Approve plugin for WordPress in all versions up to and including 3.0.9 is vulnerable to unauthorized data disclosure due to insufficient API key validation using loose equality comparison. This allows unauthenticated attackers to retrieve personally identifiable information (PII), including usernames and email addresses, via the Zapier REST API endpoints by exploiting PHP type juggling with the api_key parameter set to "0" on sites where the Zapier API key has not been configured.

The YITH WooCommerce Wishlist plugin for WordPress in all versions up to and including 4.10.0 is vulnerable to Insecure Direct Object Reference via the REST API endpoint and AJAX handler due to missing validation on user-controlled keys. This allows unauthenticated attackers to discover any user's wishlist token ID and subsequently rename the victim's wishlist without authorization.

Tanium addressed an arbitrary file deletion vulnerability in TanOS. Technical details were not disclosed in the description.

LibreNMS prior to version 25.11.0 contains a boolean-based blind SQL injection vulnerability at the /ajax_output.php endpoint. The hostname parameter is interpolated directly into an SQL query without proper sanitization or parameter binding, allowing an attacker to manipulate the query logic and infer data from the database through conditional responses. This issue has been patched in version 25.11.0.