CVE Vulnerability Catalog

The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress in all versions up to and including 1.10.2 is vulnerable to stored cross-site scripting via the 'repeater[*][version_uid]' parameter and many sibling fields (freeze-mode, cookie-input, ip-input, compare, utm-value, page-url-compare, group-name, custom) due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page.

The CMB2 plugin for WordPress in all versions up to and including 2.13.4 is vulnerable to stored cross-site scripting via the 'cmb43ex1_grp[0][txt]' parameter (a wysiwyg field inside a group whose field id is controlled by integrator config) due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when a user accesses an injected page; this is only exploitable when a site integrator renders the plugin's documented front-end form helper with a wysiwyg field inside a repeatable group on a publicly accessible page.

The VikRentCar Car Rental Management System plugin for WordPress in all versions up to and including 1.4.10 is vulnerable to blind SQL injection via the 'catid' parameter due to insufficient escaping of the user-supplied parameter and lack of sufficient preparation of the existing SQL query. An authenticated attacker with Contributor-level access can append additional SQL queries to extract sensitive information from the database by storing a malicious block via the REST API in a pending post and triggering server-side rendering through preview.

The VikRentCar Car Rental Management System plugin for WordPress in all versions up to and including 1.4.10 is vulnerable to stored cross-site scripting via the 'className' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page; wp_kses_post() applied at save time does not neutralize the payload because the injection lands in an HTML-attribute context and the block-comment JSON encoding of the quote is decoded by do_blocks() at render time.

The Clean Login plugin for WordPress in versions up to and including 1.20.1 is vulnerable to missing authorization due to a missing capability check on the CleanLogin_Shortcode::get_pages_with_shortcodes() function hooked to the save_post action. An authenticated attacker with Contributor-level access can overwrite the plugin's cl_login_url, cl_login_id, cl_register_url, cl_register_id, cl_restore_url, cl_restore_id, cl_edit_url, cl_edit_id, cl_change_password_url, and cl_change_password_id options with the ID and permalink of a post they authored by embedding the plugin's shortcodes in their own post content.

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and sibling 'to'/'first'/'second') shortcode attribute of the [wsm_showTrafficStatsList] shortcode in versions up to, and including, 8.8. User-supplied attributes are insufficiently escaped and concatenated into a SQL query in fnGetHourlyReportByDateNameTimeZone(). An authenticated attacker with Contributor-level access or above can append additional SQL queries to extract sensitive information from the database.

The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.0.0. Due to improper verification that a user is authorized to perform an action, an authenticated attacker with subscriber-level access or above can repeatedly trigger RAG document sync operations that issue paid embedding API calls to OpenAI, Gemini, OpenRouter, or xAI charged to the site administrator's stored API key. This drains AI API credits and causes financial loss.

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6. Due to improper verification that a user is authorized to perform an action, an authenticated attacker with contributor-level access or above can duplicate arbitrary posts — including private, draft, and pending posts authored by Administrators and Editors — into drafts they own, exposing the original post's content, excerpt, title, taxonomies, and metadata. The nonce is a static string not bound to a specific post, making exploitation easier.

The VikRentCar plugin for WordPress in versions up to and including 1.4.8 is vulnerable to cross-site request forgery (CSRF) in the condtext_update_tmpl function due to missing nonce validation. This allows unauthenticated attackers to write arbitrary PHP code to the plugin's template files and achieve remote code execution if they can trick an administrator into clicking a link.

The Prime Slider plugin for WordPress in versions up to and including 4.7.2 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page.

The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary web scripts into pages that execute when a user accesses the injected page. Exploitation requires an administrator to run the plugin's block-conversion migration ("Scan & Convert Blocks" during deactivation), which triggers the vulnerable build_group_block() function.

The MxChat plugin for WordPress in versions up to and including 3.2.25 is vulnerable to stored DOM-based cross-site scripting (XSS) via the 'feedback' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when an administrator visits the Transcripts page.

The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image' parameter (any body field referenced by the ImageHelper node's mix tag). This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. Exploitation requires that an administrator has built a webhook-triggered flow that pipes a webhook body field into an ImageHelper imageToBase64 node, and that the webhook remains in its default configuration (no bearer secret enforced, no IP allowlist set).

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary web scripts into pages that execute when a user accesses the injected page. Because the payload contains no angle brackets, wp_kses_post leaves the shortcode intact on save, allowing the malicious attribute value to survive post submission and fire in any viewer's browser — including an administrator previewing a pending post.

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6. Due to improper verification that a user is authorized to perform an action, an authenticated attacker with contributor-level access or above can retrieve the plugin's 127-character site-wide grw_auth_code authentication secret and use it to impersonate the WordPress site to the RichPlugins backend service at app.richplugins.com.

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[section][fields][row][col][type]' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. An authenticated attacker with shop manager-level access or above can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the 'rp4wp_view' parameter. An authenticated attacker with contributor-level access or above can extract the titles and publication dates of all private posts site-wide, normally restricted to Editor-level users and above. The page's existing authorization check only verifies edit_posts and edit_post on a parent post the attacker owns, both of which any Contributor satisfies, leaving no effective gate against reading other authors' private posts.

The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.0 via the 'rp4wp_create_link' parameter of the hidden 'rp4wp_link_related' admin page. The handle_create_link() handler verifies the nonce and that the current user can edit the parent post, but never checks that the attacker-supplied child post ID is one the user is allowed to read; LinkRepository::insert() stores the arbitrary child ID without validation, and ManageLinks::render() later calls LinkRepository::get_children() in its no-extra-args fast path, which falls through to array_map('get_post', $child_ids) — bypassing read_private_posts/read_post capability checks — and then echoes esc_html($child->post_title) in the parent's editor meta box. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the titles of arbitrary non-public posts (drafts, pending, private, future, trashed) authored by higher-privileged users by linking those post IDs to a draft they own and then reading the resulting meta box.

The Cozy Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'productRating.iconColor' parameter in versions up to and including 2.2.27 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page. The vulnerable code path is only reached when the productRating option is enabled and the associated WooCommerce product has a non-zero rating.

The Cozy Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content (block attribute icon.view / icon.layout / icon.gap)' parameter in versions up to and including 2.2.27 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page. Although wp_kses_post is applied on save, it does not neutralize a quote-only attribute-breakout payload containing no '<' character, leaving the block comment and its decoded JSON attributes intact and exploitable at render time.