CVE Vulnerability Catalog

The Livees Checkout WordPress plugin through version 7.0.2 does not perform any capability, nonce, or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and recover their order keys.

The GDPR Data Request Form WordPress plugin through version 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request, provided they can trick a site administrator into performing an action such as clicking on a link.

The Scripts n Styles plugin by unFocus Projects through version 3.5.8 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects Scripts n Styles from n/a through 3.5.8.

The WP Event Manager plugin by Ashok Dudhat through version 3.4.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects WP Event Manager from n/a through 3.4.1.

The Restrict User Access – Membership Plugin with Force by DEV Institute through version 2.8.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects Restrict User Access – Membership Plugin with Force from n/a through 2.8.1.

The Html5 Audio Player plugin by bPlugins through version 2.8.8 has a stored XSS (Cross-site Scripting) vulnerability due to improper neutralization of input during web page generation. This issue affects Html5 Audio Player from n/a through 2.8.8.

The All Bootstrap Blocks WordPress plugin up to version 1.3.31 exposes sensitive system information to unauthorized control spheres. Attackers can exploit this to retrieve embedded sensitive data.

The Asgaros Forum plugin up to version 3.4.0 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Attackers can gain unauthorized access to forum functions.

The AI Translation for Polylang plugin up to version 1.6.2 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Attackers can gain unauthorized access to translation functions.

The Super Payments WordPress plugin before version 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key is empty by default. This allows unauthenticated attackers to forge a valid signature and mark arbitrary WooCommerce orders as paid without payment.

Apache CXF's OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets without validating that the final decoded URI belongs to the RP's origin. Both directly encoded and double-encoded external URLs can trigger the issue.

The Ultimate Member plugin for WordPress in versions up to and including 2.13.1 contains an Incorrect Privilege Assignment vulnerability that allows Privilege Escalation. The issue affects all versions from n/a through 2.13.1.

The ProfilePress (wp-user-avatar) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 4.17.3.

The ProfilePress (wp-user-avatar) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 4.17.3.

The ThemeGrill User Registration (user-registration) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 5.2.7.

The codemstory 워드프레스 결제 심플페이 (pgall-for-woocommerce) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 5.5.17.

The Magepeople inc. Deposits and Partial Payments for WooCommerce (advanced-partial-payment-or-deposit-for-woocommerce) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 4.0.1.

The Crocoblock JetReviews (jet-reviews) plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 3.1.2.

The Mamunur Rashid Classified Listing (classified-listing) plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 6.1.2.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Incorrect Authorization vulnerability. A high-privileged attacker with remote access could exploit it, leading to privilege escalation and unauthorized access.