CVE Vulnerability Catalog

The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'service_type' Cookie in all versions up to and including 1.5.5 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page.

The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content through the 'Remove Microdata' Output Filter in all versions up to and including 2.3.2 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page.

SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to and including 3.8.1. The final_login_ajax_action handler resolves a user and issues an authenticated session by matching the wp_sslcare_otp table only on attacker-supplied phone and cap_data, without verifying the SMS OTP or any server-side single-use state.

The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to generic SQL Injection via the 'exclude_posts' parameter in all versions up to and including 4.1.12 due to insufficient escaping and lack of query preparation. Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database.

The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in all versions up to and including 1.26.1.20 due to insufficient escaping and lack of query preparation. Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database.

The Wild Apricot Login plugin for WordPress in versions up to and including 1.0.18 is vulnerable to authentication bypass via SSO email-collision account binding. When no WildApricot contact-ID mapping is found, the plugin falls back to a network-global email lookup and issues a session cookie for the resolved user without requiring proof of account ownership (password, email verification, or admin approval). An attacker with a WildApricot contact whose email matches a WordPress subsite administrator's email can authenticate as that administrator across the Multisite network.

An authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version 1.3.2-2809). A specially crafted HTTP request can lead to execution of a privileged operation, and an attacker can trigger this vulnerability with an unauthenticated HTTP request.

FUXA (version 1.3.2-2809) has an authorization bypass vulnerability in the /nodered functionality. A specially crafted HTTP request can lead to arbitrary code execution, and an attacker can trigger it with an unauthenticated HTTP request.

An information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version 1.3.2-2809). A specially crafted HTTP request can lead to an information leak, and an attacker can trigger this vulnerability with an unauthenticated HTTP request.

In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search.

The Bot for Telegram on WooCommerce plugin (up to and including 1.3.0) is vulnerable to an authentication bypass leading to account takeover. The /wp-json/woo-telegram/v1/main/ REST endpoint lacks webhook signature verification, allowing an unauthenticated attacker to impersonate any WordPress user, including administrators, knowing only their login name.

In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDIT_SYSTEM_SETTINGS permission can set a notice containing an arbitrary script (PUT /api/preloginnotice), resulting in stored cross-site scripting on the login page; unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or Everyone.

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution.

In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATE_ITEM) can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the service or make requests to attacker-specified locations (SSRF), including cloud instance metadata services.

In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).

In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can execute arbitrary commands with the privileges of the openEQUELLA service account.

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDIT_SYSTEM_SETTINGS permission can upload an HTML file that is then served as text/html from the openEQUELLA origin, resulting in stored cross-site scripting; unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or everyone.

The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.

The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted page.

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.