CVE Vulnerability Catalog

An unauthenticated reflected Cross-Site Scripting (XSS) vulnerability was discovered in VirtueMart versions 1.0.0 to 4.4.10 for Joomla. The vulnerability allows execution of malicious JavaScript in the user's browser.

A malicious or malformed app can be installed but not uninstalled, potentially leading to unavailability. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.

The The7 — Website and eCommerce Builder for WordPress theme is vulnerable to Stored Cross-Site Scripting via the 'the7_fancy_title_css' parameter in all versions up to, and including, 12.9.1. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts.

A vulnerability in the Discussion Board – WordPress Forum Plugin up to version 2.5.5. It allows arbitrary shortcode execution due to improper validation before running do_shortcode. Authenticated attackers with Subscriber-level access and above can exploit this.

The Fast Velocity Minify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

The FuseWP – WordPress User Sync to Email List & Marketing Automation plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.23.0. This is due to missing or incorrect nonce validation on the save_changes function. This makes it possible for unauthenticated attackers to add or edit sync rules via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The Charitable – Donation Plugin for WordPress is vulnerable to SQL Injection via the donation_ids parameter in all versions up to, and including, 1.8.8.4 due to insufficient escaping and lack of preparation on the SQL query. This allows authenticated attackers with Subscriber-level access and above to append additional SQL queries to extract sensitive information. Exploitation requires a paid donation.

The SpendeOnline.org plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spendeonline' shortcode in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on user supplied attributes.

The Advanced Database Cleaner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.6. This is due to missing or incorrect nonce validation on the aDBc_prepare_elements_to_clean() function.

The Password Policy Manager | Password Manager plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the 'moppm_ajax' AJAX endpoint in all versions up to and including 2.0.5. This allows authenticated attackers with Subscriber-level access or higher to log out the site's connection to miniorange.

The Social Feed Gallery plugin for WordPress is vulnerable to Information Exposure in versions less than, or equal to, 4.9.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate Instagram profile and media data from any account the site owner connected to their site.

The Widget Options – The #1 WordPress Widget & Block Control Plugin is vulnerable to Stored Cross-Site Scripting via multiple functions in all versions up to, and including, 4.1.2. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts.

The WordPress Testimonial Carousel For Elementor plugin (versions up to 11.6.2) is vulnerable to stored cross-site scripting (XSS) via multiple parameters due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or above can inject arbitrary scripts into pages.

The Gutenberg Blocks – PublishPress Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Marker Title' and 'Marker Description' parameters for the Maps block in versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping.

The Listeo theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'soundcloud' shortcode in version less than, or equal to, 2.0.8. Insufficient input sanitization and output escaping on user supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts.

The Tutor LMS plugin for WordPress in versions up to and including 3.8.3 is vulnerable to Sensitive Information Exposure. An authenticated attacker with tutor-level access or above can view assignments for courses they do not teach, which may contain sensitive information.

The Tutor LMS Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 3.8.3 due to missing validation on a user-controlled key in the tutor_assignment_submit() function. An authenticated attacker with Subscriber-level access or above can view and edit assignment submissions of other students.

The WP VR – 360 Panorama and Free Virtual Tour Builder plugin for WordPress is vulnerable to unauthorized data access in all versions up to and including 8.5.41. This is due to improper verification of user authorization, allowing authenticated attackers with contributor-level access or higher to modify sensitive plugin options.

The GenerateBlocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_option_rest' function in all versions up to, and including, 2.1.1. This makes it possible for authenticated attackers, with contributor level access and above, to read arbitrary WordPress options, including sensitive information such as SMTP credentials, API keys, and other data stored by other plugins.

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'.