CVE Vulnerability Catalog

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, and 11.8.x <= 11.8.5 fail to enforce DM/GM check on the server side. An authenticated user can quarantine a post belonging to a DM or GM via a direct API call.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, and 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles. An authenticated attacker can escalate a guest account to team or channel admin via a crafted PUT request to the member roles API endpoint.

The User Registration & Membership plugin for WordPress (versions up to and including 5.2.8) is vulnerable to arbitrary shortcode execution because it does not properly validate a value before running do_shortcode. An authenticated attacker with subscriber-level access or above can execute arbitrary shortcodes.

The WP Booking System – Booking Calendar plugin for WordPress (versions up to and including 2.1.0.1) is vulnerable to SQL injection via the 'data[orderby]' parameter due to insufficient escaping and lack of query preparation. An authenticated attacker with administrator-level access can append additional SQL queries to extract sensitive database information; exploitation requires a calendar with more than 200 bookings.

The GeoDirectory – WP Business Directory Plugin for WordPress (versions up to and including 2.8.192) is vulnerable to Stored Cross-Site Scripting via the 'twitterusername' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access can inject arbitrary scripts that execute when a user visits the injected page.

The Premium Packages – Sell Digital Products Securely plugin for WordPress (versions up to and including 7.2.8) is vulnerable to Stored Cross-Site Scripting via the 'note' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access can inject scripts that execute when a user visits the injected page.

The Site Reviews plugin (versions up to and including 8.3.4) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control levels. This may enable unauthorized users to perform actions reserved for higher privileges.

The WebberZone Top 10 – Popular Posts plugin for WordPress (versions up to and including 4.5.2) is vulnerable to Stored Cross-Site Scripting via the 'other_attributes' parameter (parsed to inject instance_id) and undeclared 'is_widget' due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access can inject scripts that execute when a user visits the injected page.

The WPeMatico RSS Feed Fetcher plugin for WordPress (versions up to and including 2.9) is vulnerable to Stored Cross-Site Scripting because it removes the wp_filter_post_kses filter before saving RSS feed content. An unauthenticated attacker who publishes or compromises an RSS feed subscribed to by an administrator can inject arbitrary scripts into imported posts.

The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.

The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.

The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the plugin and the second at which a token was issued. An attacker able to constrain when a staff or administrator token was issued can compute a valid token and access the booking API as that user, including an administrator.

The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions. This allows any authenticated user, such as a subscriber, to trigger a one-way migration that creates published records and permanently deletes the plugin's entire post-type and taxonomy configuration.

The HivePress – Business Directory, Listings & Classified Ads plugin for WordPress (versions up to and including 1.7.32) is vulnerable to Stored Cross-Site Scripting via the 'message' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access can inject scripts that execute in the victim's browser upon successful login via a form on the attacker's listing page.

The WSP MCP AI Agents Connector plugin for WordPress (versions up to and including 2.9.5) is vulnerable to Sensitive Information Disclosure because the wsp_get_posts tool lacks proper capability requirements and the MCP endpoint accepts any logged-in user. An authenticated attacker with subscriber-level access can read titles, URLs, authors, categories, tags, and 40-word excerpts of all unpublished posts.

The Photo Engine (Media Organizer & Lightroom) plugin for WordPress (versions up to and including 6.5.6) is vulnerable to authorization bypass because it does not properly verify user permissions. An unauthenticated attacker can permanently delete arbitrary media attachments and upload new files; a subscriber-level user can obtain a wplr_auth_token and perform destructive actions.

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress in versions up to and including 1.4.5 is vulnerable to Sensitive Information Exposure via the 'woof_settings[woof_stat][server_options]' parameter. Unauthenticated attackers can extract the external MySQL host, database name, username, and plaintext password from the inline woof_tm_data script object on any public frontend filter page.

The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget. This allows any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.

The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields. This allows any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.