CVE Vulnerability Catalog

The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to. This allows unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control.

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in versions up to and including 4.5.6. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. The injection is triggered by submitting a request to the webhook endpoint with a status_string other than 'Done'.

The Groundhogg plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 4.8.3. The create_support_user() function identifies the support account solely by matching against publicly hardcoded constants, allowing an attacker with an account having login 'groundhogg' and matching email to be promoted to administrator, and to super admin on multisite.

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.

The FV Player 8 plugin for WordPress is vulnerable to arbitrary file upload in all versions up to and including 8.1.7 via the check_mimetype function. This is due to insufficient file type validation in check_mimetype(), which writes attacker-supplied remote file content to the public uploads directory before any MIME or extension check, combined with a missing capability check on new player creation. This allows authenticated attackers with subscriber-level access and above to upload files that may be executable, making remote code execution possible; it requires successfully exploiting a race condition and is only exploitable if the '[fvplayer_editor]' shortcode is present or the "Enable profile videos" setting is enabled.

The FooSales plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to and including 1.43.0. The plugin does not properly validate a user's identity before updating their details, allowing authenticated attackers with Cashier-level access or above to change arbitrary users' email addresses, including administrators, and then reset passwords and gain access.

The Easy Digital Downloads plugin for WordPress up to version 3.6.9 is vulnerable to Stored Cross-Site Scripting (XSS) via PayPal IPN parameters. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

The GeoDirectory plugin for WordPress up to version 2.8.187 is vulnerable to Local File Inclusion (LFI) via the 'design_type' parameter. Unauthenticated attackers can include and execute arbitrary .php files on the server, potentially leading to access control bypass, sensitive data disclosure, or code execution.

The LatePoint plugin for WordPress up to version 5.7.3 is vulnerable to privilege escalation. The lack of an allowlist for setting names/values and missing role validation for the 'default_wp_role_for_customer' setting allows authenticated attackers with 'settings__edit' capability (e.g., agents) to overwrite the default WordPress role to 'administrator', causing new customer accounts to be created with full admin privileges.

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.

The Groundhogg plugin for WordPress up to version 4.9 is vulnerable to privilege escalation. Missing ownership and capability checks in the 'process_edit()' function allow authenticated users with 'edit_contacts' capability (e.g., sales reps) to reassign a contact to any WordPress account, including an administrator, and then use the auto-login URL to authenticate as that administrator.

The LifterLMS plugin for WordPress up to version 10.2.1 is vulnerable to PHP Object Injection via deserialization of untrusted input. Authenticated attackers with 'edit_course' capability (e.g., instructors) can inject a PHP object, which may lead to file deletion, data theft, or code execution if a POP chain is present in another plugin or theme.

The rtMedia plugin for WordPress, BuddyPress and bbPress up to version 4.7.13 is vulnerable to limited file deletion due to insufficient file path validation in the process function. Unauthenticated attackers can delete arbitrary safe files on the server, using a public nonce emitted in frontend JavaScript on pages with rtMedia gallery or upload shortcode.

The Fastcache by Host.it plugin up to version 1.7.4 is vulnerable to Code Injection via the `fastcache_settings[cache_cookie_exclude][]` parameter. The setting is registered without a sanitize_callback, and the buildSiteHtaccessRules() function only applies trim() to cookie values before interpolating them into an Apache RewriteCond line, leaving embedded newlines intact. This allows authenticated administrators to inject arbitrary Apache directives into .htaccess, such as php_value auto_prepend_file, enabling execution of attacker-controlled PHP code on every request.

The Advanced Form Integration plugin up to version 2.9.0 is vulnerable to Authentication Bypass via Unverified Password Change. The adfoin_ultimatememberac_send_data function passes an attacker-controlled field key and value directly to UM()->user()->update_profile() in the 'account' context, which bypasses Ultimate Member's banned-key validation, without any identity verification, ownership check, capability check, or current-password reauthentication. This allows unauthenticated attackers to change the password of any WordPress user, including administrators, via a public Contact Form 7 form.

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped, allowing command injection.

Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that allows an authenticated attacker with access to debug logs to view LUKS passphrases or SMB Active Directory credentials.

Aegisub versions 3.2.0 through 3.4.2 automatically load Automation scripts referenced in ASS subtitle project metadata without asking whether the user trusts the scripts or their authors. Opening a crafted ASS file can execute arbitrary code with the privileges of the Aegisub process; in versions 3.4.0–3.4.2, inconsistent NUL handling also allows a crafted ASS/Lua polyglot to execute itself. The vulnerability is fixed in Aegisub 3.5.0.

Vikunja versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the user_tokens table in plaintext. An attacker with read access to the database can immediately use pending tokens to take over user accounts without knowing passwords. Version 2.4.0 fixes the issue.