CVE Vulnerability Catalog

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 due to improper verification of user permissions. This allows authenticated attackers with contributor-level access and above to permanently delete any reusable social message (nc_reusable_social post), including those authored by administrators or other privileged users.

The Mail logging – WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. Successful exploitation requires a separately installed plugin, such as Contact Form 7, that passes unauthenticated user-controlled input into mail fields whose content PHPMailer includes in its failure error message.

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This allows authenticated attackers with contributor-level access and above to include and execute arbitrary .php files on the server, enabling execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution if .php files can be uploaded and included.

The Smart Manager plugin for WordPress is vulnerable to generic SQL injection via the 'access_privileges' parameter in versions up to and including 8.97.0. Authenticated attackers with subscriber-level access and above can append SQL queries to existing queries to extract sensitive information from the database. Exploitation is only possible when an administrator has saved a role-based deny-list configuration that does not block the internal 'access-privilege' module.

The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to stored DOM-based cross-site scripting via the 'X-Real-IP' HTTP header in versions up to and including 8.16. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The attack requires no authentication, nonce, or capability.

The Simple Membership plugin for WordPress is vulnerable to unauthorized data modification and sensitive information disclosure in versions up to and including 4.8.3 via the resend-activation and email-activation endpoints. Unauthenticated attackers can redirect a pending member's activation email and the follow-up 'registration complete' email containing username and plaintext password to an attacker-chosen address, and then activate the account without consent.

The Strong Testimonials plugin for WordPress is vulnerable to stored cross-site scripting via the 'platform_user_photo' custom field in versions up to and including 3.3.11. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires an administrator to have added custom text fields 'platform' and 'platform_user_photo' to a public testimonial submission form.

The Transliterator plugin for WordPress is vulnerable to stored cross-site scripting via comment content using a predictable {rstr_keep} placeholder in versions up to and including 2.5.8. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The payload survives WordPress comment sanitization because the tags and attributes used are permitted by the core comment kses allow-list.

The SEOPress plugin for WordPress is vulnerable to stored cross-site scripting via author display name in versions up to and including 10.2. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires the 'Track Authors' custom dimension to be configured in Google Analytics 4 or Matomo settings, and the attacker must be able to publish public singular content.

The GD Rating System plugin for WordPress is vulnerable to stored cross-site scripting via 'title' and 'url' render args in gdrts_live_handler AJAX in versions up to and including 3.7.1. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Although the AJAX action requires a per-item nonce, that nonce is publicly emitted in the page's JSON block on every page rendering the rating item.

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use. It authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing unauthenticated attackers to obtain a privileged POS session and thereby read customer and site-user personal data and modify store data.

The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query. This allows unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well. This allows storing markup which the plugin's own script later executes in the browser of any visitor or an administrator reviewing the still-unapproved submission.

The Welcart e-Commerce plugin for WordPress is vulnerable to stored cross-site scripting via settlement notification parameters in versions up to and including 2.12.2. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The IPN endpoint accepts 'rel' and 'option' parameters with no authentication, nonce validation, or signature verification.

The GeoDirectory plugin for WordPress is vulnerable to SQL injection via stored latitude/longitude coordinates of a listing in versions up to and including 2.8.186. Authenticated attackers with subscriber-level access and above can append SQL queries to existing queries to extract sensitive information from the database. Exploitation is possible through the public wp_ajax_nopriv_geodir_widget_listings handler with set_post and sort_by parameters.

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to stored cross-site scripting via the 'author' parameter in versions up to and including 1.0.34. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. This is possible because the plugin's esc_html filter callback decodes HTML-entity-encoded payloads back into live HTML.

The Photo Reviews for WooCommerce plugin for WordPress, up to version 1.2.30, is vulnerable to arbitrary content deletion. The plugin stores attacker-controlled post IDs in review comment meta without verifying ownership, and the deletion handler unconditionally deletes all stored IDs. This allows unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media when an administrator deletes the review or when WordPress's cron empties the comment trash after 30 days.

The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin before 2.4.4's review display settings have never been saved.

The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed content fail with a fatal error for all visitors until the review is removed (a persistent denial of service), when user reviews are enabled.