CVE Vulnerability Catalog

The Appointment Booking Calendar plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 1.3.95.

The Theater for WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 0.18.8.

The Save as PDF Button plugin for WordPress (all versions up to and including 1.9.2) is vulnerable to Stored Cross-Site Scripting via the restpackpdfbutton shortcode. This is due to insufficient input sanitization and output escaping on user-supplied attributes.

The Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the 'wp_ajax_wpqai_disconnect_quicq_afosto' AJAX endpoint in all versions up to and including 2.0.0. This allows authenticated attackers with Subscriber-level access and above to disconnect Afosto.

The WordPress Content Flipper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bgcolor' shortcode attribute of the 'flipper_front' shortcode in all versions up to and including 0.1. This is due to insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts.

The WP Headless CMS Framework plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to and including 1.15. The plugin only checks for the presence of the Authorization header, allowing unauthenticated attackers to access content they should not access.

The Angel – Fashion Model Agency WordPress CMS Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the profile media uploader in all versions up to, and including, 3.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the user has access to the edit profile form with the media upload option.

The Comment Edit Core – Simple Comment Editing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.1.0 via the 'ajax_get_comment' function. This allows unauthenticated attackers to extract sensitive data including user IDs, IP addresses, and email addresses.

The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress (all versions up to and including 6.0.7) is vulnerable to generic SQL Injection via the 'filterbyauthor' parameter due to insufficient escaping and lack of preparation on the existing SQL query. An authenticated attacker with Administrator-level access and above can append additional SQL queries to extract sensitive information from the database.

The WordPress plugin Survey Maker is vulnerable to unauthorized access of data due to a missing capability check on the 'ays_survey_show_results' AJAX endpoint in all versions up to and including 5.1.9.4. This allows unauthenticated attackers to view all survey submissions.

The Welcart e-Commerce plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the 'usces_export' action in all versions up to and including 2.11.24. This allows unauthenticated attackers to access configured payment credentials (e.g., PayPal API secret), business contact details, mail templates, and other operational settings.

The Survey Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to and including 5.1.9.4. This allows unauthenticated attackers to update the ays_survey_maker_upgrade_plugin option.

The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notification' post meta registration. This is due to setting the 'auth_callback' parameter to '__return_true', which allows unauthenticated access to the metadata. This makes it possible for unauthenticated attackers to extract sensitive data including email notification configurations, which frequently contain vendor-provided CRM/help desk dropbox addresses, CC/BCC recipients, and notification templates.

The Page Builder: Pagelayer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 2.0.5 via the pagelayer_replace_page function due to missing validation on a user-controlled key. This allows authenticated attackers with Author-level access and above to replace media files belonging to other users, including administrators.

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cleanCache() function in all versions up to, and including, 1.10.45. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Anubis, a Web AI Firewall Utility, prior to version 1.23.0 did not validate the redirect URL when using subrequest authentication, allowing redirection to any URL scheme. While most modern browsers block redirects to `javascript:` URLs, it could still trigger dangerous behavior in some cases. The issue is fixed in version 1.23.0.

Bitplatform Boilerplate, a Visual Studio and .NET project template, versions prior to 9.11.3 are affected by a cross-site scripting (XSS) vulnerability in WebInteropApp/WebAppInterop, potentially allowing attackers to inject malicious scripts that compromise the security and integrity of web applications. Version 9.11.3 fixes the issue.

Frappe Learning is a learning system that helps users structure their content. From version 2.0.0 and prior to version 2.41.0, when admins revoked a role from a user, the effect was not immediate because of caching. The issue was fixed in version 2.41.0 by ensuring the cache is cleared after roles are updated.

Frappe Learning is a learning system that helps users structure their content. Starting in version 2.0.0 and prior to version 2.41.0, users were able to access submissions made by other students. The issue has been fixed in version 2.41.0 by ensuring proper roles and redirecting if accessed via direct URL.

A flaw has been found in code-projects Responsive Hotel Site 1.0. The affected element is an unknown function of the file /admin/usersetting.php. Executing manipulation of the argument usname can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.