CVE Vulnerability Catalog

The s2Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in versions up to and including <= 261011 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page. The payload bypasses wp_kses_post() on save because it contains no literal angle brackets — only backslash-escaped sequences that PHP's date() materializes into HTML tag characters at render time after WordPress's shortcode_parse_atts() applies stripcslashes() to the attribute value.

The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes of the [ttbm-hotel-map] shortcode in versions up to and including 2.3.6. This is due to insufficient input sanitization and output escaping on user-supplied attributes in the ttbm_hotel_map_shortcode() function, which concatenates raw attribute values into double-quoted HTML attributes of an <iframe> tag. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page.

The UiChemy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'actions[save_builder][data][elements][...][settings][slot_{N}_link][url]' parameter in versions up to and including 5.3.0 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page. The injected javascript: payload fires on click rather than on page load, making exploitation contingent on a privileged user such as an Editor or Administrator clicking the attacker-crafted link while reviewing or previewing the Contributor's post.

The IvyForms plugin for WordPress in versions up to and including 1.5.1 is vulnerable to arbitrary file upload via the filterFiletypeAndExt function due to insufficient file type validation and bypass of WordPress's native defenses. Authenticated attackers with custom-level access can configure a file upload field with a dangerous extension, and then any unauthenticated visitor can upload a file via the public REST endpoint, enabling remote code execution.

The Mage Eventpress plugin for WordPress in versions up to and including 5.7.8 is vulnerable to privilege escalation via the mep_grant_shop_manager_access() function, which unconditionally grants manage_options when a request marker (e.g., $_GET['page']) starts with 'mep_' or 'mpwem_'. Authenticated attackers with Shop Manager-level access can elevate their privileges to Administrator by appending the parameter to admin URLs.

The Document Embedder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content (post_content containing block JSON documentSource.doc)' parameter in versions up to and including 2.4.0 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page. The payload is triggered specifically when the victim clicks the embedded document's Download button, which causes the de_track_download AJAX fallback path to programmatically create an anchor with the attacker-controlled href and call .click() — a condition reached because supplying docId=0 causes can_read_document() to return false, bypassing the normal download flow.

The Contact Manager plugin for WordPress in versions up to and including 9.1.2 is vulnerable to arbitrary file upload via the add_message function. An incomplete extension blacklist allows bypassing validation with a trailing dot, enabling unauthenticated attackers to upload executable files and potentially achieve remote code execution.

The easy.jobs plugin for WordPress is vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the 'icon' attribute of the easyjobs/job-list Gutenberg block in versions up to and including 2.8.2 due to insufficient input sanitization and output escaping on user-supplied attributes. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page.

The Hustle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[title]' parameter in versions up to and including 7.8.14.3 due to insufficient input sanitization and output escaping. An authenticated attacker with custom-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page. Exploitation requires that an administrator has explicitly granted the 'Create and Update Modules' (hustle_create / hustle_edit_module) capability to the attacker's role via the plugin's own Settings → Permissions feature; this delegation is not enabled by default.

The Tainacan plugin for WordPress is vulnerable to Directory Traversal in versions up to and including 1.3.0 via the 'tmp_file' parameter. An authenticated attacker with Editor-level access or higher can read the contents of arbitrary files on the server, which can contain sensitive information. The poisoned importer path is persisted to the database and later triggered via a separate GET request to the /source_info endpoint, which passes the attacker-controlled path to fopen() and fgetcsv() and returns parsed file contents in the REST response.

The If-So Dynamic Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversion' Shortcode Attribute in versions up to and including 1.10.2 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page.

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tab_index, empty_notice' parameter in all versions up to, and including, 3.16.2 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. wp_kses_post does not strip the payload on save because the dangerous characters reside within shortcode attribute text between square brackets, which kses treats as plain text rather than HTML markup.

The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. The injected script executes specifically in the administrator's browser session, as the vulnerable branch only renders when an administrator previews or opens the post containing the crafted shortcode.

The Awesome Support – WordPress HelpDesk & Support Plugin is vulnerable to Stored Cross-Site Scripting via the 'wpas_files' parameter in all versions up to, and including, 6.4.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with custom-level access and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. This vulnerability is only exploitable when the "Enable drag-n-drop uploader for ticket form" setting is enabled, as it is disabled by default.

The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Body URL Autolink in all versions up to, and including, 1.9.87 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. This is possible because the ?postie=get-mail endpoint is reachable by unauthenticated users with no capability check, and the email processing path removes WordPress's kses output filters before saving raw markup, allowing the unescaped href attribute value to be stored as post content.

The Product Designer for WooCommerce (Lumise) plugin for WordPress in versions up to and including 2.1.2 is vulnerable to Directory Traversal via the process_checkout function. Unauthenticated attackers can read arbitrary files on the server because the required lumise_security nonce is freely obtainable through the /?lumise=ajax action=init handler.

The Recipe Card Blocks Lite plugin for WordPress before 3.6.4 does not sanitize or cast a block and shortcode attribute before concatenating it into SQL queries. This allows authenticated users with Contributor-level access or above to perform SQL injection attacks.

The WP Roster plugin for WordPress before 2.35 does not perform any capability or nonce checks on one of its AJAX actions. This allows unauthenticated attackers to delete the WordPress user accounts of roster members.

The Customer Engagement System plugin for WordPress before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the supplied API key. This allows unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response timing which ones are reachable.

The Customer Engagement System plugin for WordPress before 2.0.2 does not safely build the SQL statements storing a popup's page and category visibility rules, concatenating request-supplied IDs directly into an INSERT statement without parameter binding or integer casting. This allows an authenticated administrator to inject arbitrary SQL and read the WordPress database contents.