CVE Vulnerability Catalog

The UPC/EAN/GTIN Code Generator plugin for WordPress (versions up to 2.0.2) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick a logged-in administrator into performing unwanted actions.

The WP SMS plugin (versions up to and including 7.0.1) contains a Missing Authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tattersoftware WP Tesseract wp-tesseract allows Stored XSS. This issue affects WP Tesseract: from n/a through <= 1.0.2.

An Open Redirect vulnerability in the WP Gravity Forms HubSpot plugin (gf-hubspot) up to version 1.2.5. It allows redirecting users to untrusted sites, potentially used for phishing.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NIKITAS GEORGOPOULOS WeShare Buttons e-mailit allows Stored XSS. This issue affects WeShare Buttons: from n/a through <= 13.0.0.

Cross-Site Request Forgery (CSRF) vulnerability in John James Jacoby WP Media Categories wp-media-categories allows Cross Site Request Forgery. This issue affects WP Media Categories: from n/a through <= 2.1.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoefff Werk aan de Muur werk-aan-de-muur allows Stored XSS. This issue affects Werk aan de Muur: from n/a through <= 1.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder allows Stored XSS. This issue affects Colibri Page Builder: from n/a through < 1.0.334.

The ShopMagic plugin for WooCommerce up to version 4.5.6 inserts sensitive information into sent data, allowing retrieval of embedded sensitive data.

The MasterStudy LMS plugin up to version 3.6.20 exposes sensitive system information to unauthorized control spheres. This vulnerability allows retrieval of embedded sensitive data.

The Doctreat plugin up to version 1.6.7 has a basic XSS vulnerability (improper neutralization of script-related HTML tags), allowing code injection.

The WooCommerce Orders & Customers Exporter plugin has a missing authorization vulnerability, enabling exploitation of incorrectly configured access control levels. Affects versions up to 5.4.

The Accordion plugin from PickPlugins has a missing authorization vulnerability, allowing exploitation of incorrect access control security levels. Affects versions up to 2.3.14.

The UDesign Core plugin by AndonDesign is vulnerable to Missing Authorization in versions from n/a through 4.14.0. This issue allows exploiting incorrectly configured access control security levels.

Insertion of Sensitive Information Into Sent Data vulnerability in inkthemes WP Gmail SMTP wp-gmail-smtp allows Retrieve Embedded Sensitive Data.This issue affects WP Gmail SMTP: from n/a through <= 1.0.7.

The AppExperts plugin for WordPress up to version 1.4.5 allows insertion of sensitive information into sent data, enabling retrieval of embedded sensitive data.

The SUMO Memberships for WooCommerce plugin (sumomemberships) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through < 7.8.0.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeAtelier IDonatePro idonate-pro allows Retrieve Embedded Sensitive Data.This issue affects IDonatePro: from n/a through <= 2.1.9.

The Wikipedia Preview plugin up to version 1.15.0 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized access to functionality.

The Breeze Checkout plugin by Breeze Team (versions up to and including 1.4.0) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.