CVE Vulnerability Catalog

The Content Egg plugin for WordPress in versions up to and including 12.0.0 lacks a per-post capability check in the ajaxUpdateProducts() function. An authenticated attacker with contributor-level access or above can modify Content Egg product data and update-timestamp post meta on arbitrary posts, including those owned by administrators.

The JoomSport plugin for WordPress in versions up to and including 5.7.14 is vulnerable to SQL injection via the 'pgroup' parameter due to insufficient escaping and lack of query preparation. An authenticated attacker with contributor-level access or above can append additional SQL queries to extract sensitive information from the database.

The Events Made Easy plugin for WordPress in versions up to and including 3.3.1 is vulnerable to stored cross-site scripting via the 'width' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary scripts that execute when a user visits the injected page.

The Cool FormKit Lite plugin for Elementor in versions up to and including 2.7.9 is vulnerable to stored DOM-based cross-site scripting via the '_elementor_data.form_fields[].custom_id' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary scripts that execute when a user visits the injected page.

The Page and Post Restriction plugin for WordPress in versions up to and including 1.6.1 is vulnerable to authentication bypass. The papr_restrict_page_post_rest_api() function re-authenticates the user from the wordpress_logged_in cookie without verifying a REST nonce, which combined with permissive REST CORS allows an unauthenticated attacker to read REST API responses as a logged-in victim.

The Firelight Lightbox plugin for WordPress before 2.3.23 does not escape the URL of links opened in its Classic lightbox before inserting them into the page as HTML. This allows users with a role as low as Contributor to perform stored cross-site scripting attacks against users who click a crafted link.

The BuddyForms plugin for WordPress before 2.10.1 does not verify that a user editing an existing entry is the author of the target post. This allows users with edit access to a form, as low as Subscriber, to overwrite the title, content, and status of any other user's posts or pages, including those of administrators.

The BuddyForms plugin for WordPress before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration. This allows unauthenticated users to download any form's stored settings, including notification recipient email addresses and reCAPTCHA secret keys.

The Fraud Prevention For WooCommerce and EDD plugin for WordPress before 2.3.6 does not check that a user is allowed to manage orders before letting them add an order's customer details to the store's fraud blacklist. This allows users with the Subscriber role and above to prevent arbitrary legitimate customers from placing orders.

The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end. This could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including administrators.

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement. This allows high-privilege users such as administrators to perform SQL injection attacks.

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a logged-in administrator views the statistics pages.

The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The affected action is gated by an anonymous nonce that only validates for logged-out requests, so the payload executes against logged-out visitors rather than authenticated users.

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks. This allows a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials.

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login. This allows anyone who holds a user's current authenticator code to log in as that user, including an administrator, without the password.

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine. This allows unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server. This is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4.

The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. The plugin accepts arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete files when a subsequent draft references the poisoned draft via the previous_draft_id parameter, allowing unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory.

The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via its export and re-import workflow. The flaw is caused by a CSV escape-character mismatch between the exporter (fputcsv with default backslash escape) and the importer (fgetcsv with double-quote escape), allowing a crafted value in a Subscriber's Biographical Info field to inject a second row that creates an arbitrary Administrator account.

A flaw was found in glib-networking where the client-side session cache for TLS 1.3 does not limit the number of session tickets retained for a single host. A malicious server can send excessive session ticket messages, causing unbounded memory growth in the client application, leading to memory exhaustion and a Denial of Service (DoS).

The Xray Audit module for Drupal contains a missing authorization vulnerability that allows forceful browsing of restricted resources. This issue affects versions from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, and from 3.0.0 to 3.1.1.