CVE Vulnerability Catalog

The PayPlug for WooCommerce (Official) plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier. This allows unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCommerce orders.

The GeoDirectory plugin for WordPress before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes. This allows users with the Contributor role and above to disclose the content and custom fields of other users' draft, pending, private and trashed listings.

The GeoDirectory plugin for WordPress before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who clicks the badge, including administrators.

The GeoDirectory plugin for WordPress before 2.8.196 does not properly sanitize or escape a post badge click-through link value before outputting it in an anchor element on a listing. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view the listing, including an administrator reviewing moderated content.

The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action. A forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site.

The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present. A forged request that omits the field can cause a logged-in user with the Author role or above to trash or delete attachments.

The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute. This allows users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pending post, views the content.

The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability. This allows users with contributor-level access to read the full content of any private or draft page and to publish it without holding the publish capability.

The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools. This allows authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal MCP WordPress plugin before 1.5.10.

The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the plugin activation capability. This allows users with a delegated role below administrator to change outbound mail delivery and achieve administrator account takeover.

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited. This allows any authenticated user with Author-level access or higher to read, modify, create, delete and re-order the SKU data (including prices, confidential cost prices and stock levels) of any product, including those belonging to other users.

The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect. This allows unauthenticated attackers to redirect users to arbitrary external websites.

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query. This allows users with the Editor role or higher to perform SQL injection attacks.

The Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting it back into an HTML attribute. This leads to Reflected Cross-Site Scripting that is executed in the browser session of a logged-in privileged user who is tricked into submitting a crafted cross-site request.

The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings. Unauthenticated attackers could reassign the login, registration and password-recovery slugs and lock the administrator out of the login interface.

The Copy Anything to Clipboard for WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing it and writing it back into the page through a client-side script. Users with the contributor role and above could perform Stored Cross-Site Scripting attacks against higher-privileged users.

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor can pass to its pagination endpoint. This could allow reading content of non-public post types and recovering values of private custom fields on published posts.

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read. Users with the contributor role and above could read the content of other users' draft, pending, scheduled and private posts and pages.

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface. Users with the contributor role and above could perform Stored Cross-Site Scripting attacks against higher-privileged users who open the affected post in the editor.

The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request. Unauthenticated users could disclose another customer's order key and cancel their unpaid guest order.