CVE Vulnerability Catalog

The Motors plugin by StylemixThemes is vulnerable to Missing Authorization in versions up to and including 1.4.108, allowing exploitation of incorrectly configured access control security levels.

The Grocery Shopping Store plugin by Omegathemes is vulnerable to Authentication Bypass Using an Alternate Path or Channel in versions up to and including 1.3.3, allowing password recovery exploitation.

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler. The vulnerability is due to authorizing access based on a non-secret email address instead of the WooCommerce order_key.

The YITH WooCommerce Affiliates plugin for WordPress is vulnerable to deserialization of untrusted data, allowing object injection. This affects all versions up to and including 3.31.0.

The WPO365 | LOGIN plugin for WordPress is vulnerable to authentication bypass via OIDC nonce replay in all versions up to and including 44.1. This occurs when the use_id_token_parser_v2 option is enabled.

The Molongui Authorship plugin for WordPress is vulnerable to stored DOM-based XSS via the 'comment' parameter (href attribute inside comment content) in all versions up to and including 5.2.12.

The WPAdverts – Classifieds Plugin for WordPress is vulnerable to stored XSS via the 'adverts_location' parameter in all versions up to and including 2.3.4.

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to stored XSS via the 'shipping_first_name' parameter in all versions up to and including 3.16.0.5.

The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to stored XSS via the display_name user field in all versions up to and including 5.1.0.

The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to stored XSS via the comment author name in all versions up to and including 3.4.18.

The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to stored DOM-based XSS via the 'qsm_hidden_questions' parameter in all versions up to and including 11.2.6.

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to stored XSS via the 'attachments[name]' parameter in all versions up to and including 1.8.15.

The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 6.3.9. The plugin does not properly verify that a user is authorized to perform an action.

The Bookly plugin for WordPress is vulnerable to PHP Object Injection through deserialization of untrusted input via the 'value' parameter in versions up to and including 28.2. Authenticated attackers with custom-level access or above can inject a PHP object, but no known gadget chain is available.

The 10Web Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in versions up to and including 2.34.8. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses the page.

The LazyLoad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment_content' parameter in versions up to and including 2.4.0. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts, but require admin approval of the comment.

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id' parameter in versions up to and including 1.2.30. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts.

The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via comment content with the <presto-player> tag in versions up to and including 4.5.1. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts, but require initial comment approval.

The Real Estate Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in versions up to and including 7.3. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. The reCAPTCHA check can be trivially bypassed.

The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number verified during its OTP password reset. This allows unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.