CVE Vulnerability Catalog

The Klarna for WooCommerce plugin for WordPress (versions up to and including 4.13.3) is vulnerable to authorization bypass due to improper verification of user authorization. An unauthenticated attacker can access any order's secret order_key and full billing and shipping PII (name, email, phone, address, postcode, city, region, country) exposed inline as the klarna_payments_params JavaScript variable.

The Mang Board plugin for WordPress (versions up to and including 2.4.3) is vulnerable to stored Cross-Site Scripting (XSS) via the 'content' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress (versions up to and including 0.1.4.1) is vulnerable to privilege escalation. The plugin registers its admin page using a role name returned by InstaWP_Setting::get_allowed_role() as the required capability, and generate_section_field() renders the master API key as a plain-text HTML input without additional manage_options checks. An authenticated attacker with Subscriber-level access or above can read the plaintext master API key, use its SHA-256-derived secret as a bearer token in the plugin's REST API, and call POST /wp-json/instawp-connect/v2/auto-login to mint a 30-second single-use login URL that sets an administrator authentication cookie.

The Groundhogg plugin for WordPress (versions up to and including 4.9.3) is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function. An authenticated attacker with Sales Representative-level access or above can delete arbitrary files on the server, which can easily lead to remote code execution.

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress (versions up to and including 3.16.0.6) is vulnerable to authorization bypass due to improper verification of user authorization. An unauthenticated attacker can retrieve billing PII (full name, street address, email address, phone number) for any WooCommerce order by submitting an enumerable sequential order ID.

The Modula Image Gallery plugin for WordPress (versions up to and including 3.0.11) is vulnerable to sensitive information exposure via the 'id' parameter in /wp-json/wp/v2/modula-gallery/{id}. An unauthenticated attacker can extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field.

The miniOrange OTP Login plugin for WordPress (versions up to and including 5.5.8) is vulnerable to authentication bypass via the mo_by_pass_login() function. The mo_delay_otp_process() short-circuits the authentication flow before password validation, and the Delay OTP grace flag is stored in user meta without binding to the session, allowing an unauthenticated attacker to log in as any user, including administrators.

The FluentCart plugin for WordPress (versions up to and including 1.7.0) is vulnerable to Insecure Direct Object Reference (IDOR) via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user-controlled key. An unauthenticated attacker can read and exfiltrate another customer's stored billing and shipping address PII, including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID.

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (versions up to and including 7.5.5) is vulnerable to stored Cross-Site Scripting (XSS) via comment content and the yotu-wp Cookie-Blocker filter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The Backuply plugin for WordPress (versions up to and including 1.5.8) is vulnerable to second-order SQL injection via the 'Biographical Info' field. The value is exported verbatim into the backup's SQL dump, and when the backup is later restored, a crafted payload can execute arbitrary SQL with full database privileges.

Wheels CLI versions 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. This can lead to shell command execution on deploy hosts and the CI runner, deletion of unintended files, overwriting other vendor files, writing outside the project, injection of executable CFML, stored XSS, and termination of an unrelated process.

Wheels versions 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without verifying they belong to the parent being saved. A user can update, reassign, or delete another parent's hasMany or hasOne rows, and edit nested belongsTo records by posting another associated record's key.

Wheels versions 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true (default in development). In 4.1.2 the local-access restriction trusts client-supplied headers without checking the connecting peer.

Wheels versions 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=), production with error information disabled returns true for an out-of-scope key instead of throwing.

The Flying Scripts plugin for WordPress (versions up to and including 1.2.4) is vulnerable to stored cross-site scripting via the 'comment' parameter due to insufficient input sanitization and output escaping. The payload uses only kses-allowed elements, and the XSS is introduced post-save by the plugin's output-buffer rewriter.

The RSS Aggregator by Feedzy plugin for WordPress (versions up to and including 5.2.11) is vulnerable to stored cross-site scripting via the 'media:thumbnail@url' parameter due to insufficient input sanitization and output escaping. The attacker must control an external RSS feed that the target site has already configured for import.

The Colibri Page Builder plugin for WordPress (versions up to and including 1.0.390) is vulnerable to stored cross-site scripting via the 'comment' parameter due to insufficient input sanitization and output escaping. The payload survives storage because the widened comment allow-list permits SVG elements, and execution occurs when colibri.js reads the stored data-target value and passes it to jQuery().

The Customer Email Verification for WooCommerce plugin (versions up to and including 3.3.0) is vulnerable to privilege escalation via the 'alg_wc_ev_verify_email' parameter. The activation code is generated using wp_rand(100), yielding only ~101 possible values, and the verify() handler lacks nonce checks and rate limiting.

Frappe HRMS versions 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints due to missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to extract sensitive information from the database.

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444. A malicious RDP server can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height, causing writes past the U/V planes.