CVE Vulnerability Catalog

The WSP MCP AI Agents Connector plugin for WordPress (versions up to and including 2.9.5) is vulnerable to Sensitive Information Disclosure because the wsp_get_posts tool lacks proper capability requirements and the MCP endpoint accepts any logged-in user. An authenticated attacker with subscriber-level access can read titles, URLs, authors, categories, tags, and 40-word excerpts of all unpublished posts.

The Photo Engine (Media Organizer & Lightroom) plugin for WordPress (versions up to and including 6.5.6) is vulnerable to authorization bypass because it does not properly verify user permissions. An unauthenticated attacker can permanently delete arbitrary media attachments and upload new files; a subscriber-level user can obtain a wplr_auth_token and perform destructive actions.

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress in versions up to and including 1.4.5 is vulnerable to Sensitive Information Exposure via the 'woof_settings[woof_stat][server_options]' parameter. Unauthenticated attackers can extract the external MySQL host, database name, username, and plaintext password from the inline woof_tm_data script object on any public frontend filter page.

The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget. This allows any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.

The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields. This allows any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress in versions up to and including 7.25.00 is vulnerable to Privilege Escalation. The 'start_comms' dispatcher gates access only by comparing a caller-supplied 'apikey' against the stored plugin API key with no capability check and no nonce verification, then writes unvalidated parameters into the WPS_IC_SETTINGS option, allowing unauthenticated attackers to grant any role the 'manage_wpc_settings' capability.

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement. This allows unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on.

The Tainacan plugin for WordPress in versions up to and including 1.3.0 is vulnerable to Directory Traversal via the 'guid' parameter. Authenticated attackers with subscriber-level access and above can read the contents of arbitrary files on the server, which can contain sensitive information.

The Tutor LMS – eLearning and online course solution plugin for WordPress in versions up to and including 4.0.8 is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url' parameter. Unauthenticated attackers can inject arbitrary web scripts that execute in the victim's browser whenever the victim accesses a page that includes the malicious payload.

The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress in versions up to and including 1.19 is vulnerable to Sensitive Information Exposure. The W3TC_DYNAMIC_SECURITY constant is hardcoded to a publicly known value, allowing unauthenticated attackers to learn the W3 Total Cache mfunc security key.

The fanx_fingerprint function in ssl/sslxprint.c of ssldump miscalculates the heap buffer size, resulting in a 3-byte heap-based buffer overflow on every invocation with valid inputs. An attacker can supply a crafted pcap file containing a TLS X.509 certificate to trigger the overflow when ssldump is run with FAN/1 fingerprinting enabled.

The Quick PayPal Payments: Payment Button & Form plugin for WordPress in versions up to and including 6.0.4 is vulnerable to Stored Cross-Site Scripting via the 'form' parameter. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress in versions up to and including 3.6.1 is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter. Authenticated attackers with vendor-level access and above can append additional SQL queries into existing queries to extract sensitive information from the database.

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress in versions up to and including 4.0.3 is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress in versions up to and including 4.11.1 is vulnerable to arbitrary shortcode execution. Authenticated attackers with subscriber-level access and above can save a shortcode payload to their Biographical Info field, which then executes on any unauthenticated front-end request that resolves that author's description.

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to and including 3.0.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute when a user visits an injected page. The wp_kses_post filter does not strip the payload because angle-bracket characters are not required, letting the unescaped attribute value survive storage and fire as a live event handler in the unauthenticated (guest) rendering branch.

The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-axis column value parameter in all versions up to and including 3.0.6 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts that execute when a user visits an injected page. It requires an administrator to have published a chart whose SQL query returns a column controllable by a lower-privileged user, such as wp_users.display_name, which a Subscriber can populate with a payload via the standard WordPress profile page.

The Broken Link Checker plugin for WordPress in versions up to and including 2.4.14.1 is vulnerable to arbitrary shortcode execution because it does not properly validate a value before running do_shortcode. Unauthenticated attackers can execute arbitrary shortcodes if a submitted comment containing the payload in an href or src attribute is approved through the normal comment moderation workflow; once approved, the shortcode executes automatically via WP-Cron.

The Mail Mint plugin for WordPress in versions up to and including 1.31.4 is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint. Insufficient escaping of the user-supplied filter 'value' before it is appended to a SQL query in SegmentFilterService::get_meta_join_query() at line 797 — the value is string-interpolated into the WHERE fragment in a numeric (unquoted) context and the surrounding $wpdb->prepare() calls do not cover the injected value.

The NotificationX plugin for WordPress in versions up to and including 3.3.3 is vulnerable to Missing Authorization leading to arbitrary content injection. The /notificationx/v1/popup-submit REST route is registered with permission_callback => '__return_true', and the handler PopupNotification::handle_popup_submission() accepts an attacker-controlled nx_id, loads the referenced NotificationX campaign, and copies its source into the new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup.