CVE Vulnerability Catalog

The BlockSpare plugin for WordPress in versions up to and including 4.2.6 is vulnerable to authorization bypass due to incorrect logic in the permission callback, using an AND (&&) operator instead of an OR (||) operator. Authenticated attackers with Subscriber-level access and above can bypass authorization checks and create arbitrary posts.

The Metasync plugin for WordPress in versions up to and including 2.6.23 is vulnerable to unauthorized data modification due to a missing capability check in the save_instant_indexing_settings() function. The function is hooked to admin_init and only checks for $_POST['submit'] before writing attacker-supplied $_POST['metasync_post_types'] into the site-wide 'metasync_options_instant_indexing' option, with no current_user_can() check and no nonce verification.

The Search Atlas SEO plugin for WordPress in all versions up to and including 2.6.23 is vulnerable to authorization bypass because it does not properly verify that a user is authorized to perform an action. This allows authenticated attackers with subscriber-level access or above to overwrite the whitelabel settings password with an attacker-controlled value.

The SSL Zen plugin for WordPress in all versions up to and including 4.7.42 is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter due to insufficient input sanitization and output escaping. The vulnerability is only exploitable when in the system_requirements stage.

The Real3D Flipbook Lite plugin for WordPress in versions up to and including 5.1.1 is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute and other unsanitized attributes handled by on_shortcode(). Attribute values are copied verbatim into flipbook options and emitted via wp_json_encode() inside a <script type="application/json"> block without the JSON_HEX_TAG flag, allowing a literal </script> sequence to break out of the JSON script context.

The AppMySite plugin for WordPress in all versions up to and including 3.15.3 is vulnerable to Stored Cross-Site Scripting via the save_ams_license_key AJAX handler due to insufficient input sanitization and output escaping. The handler performs no capability check and no nonce verification, meaning any authenticated user with Subscriber-level access or above can invoke it to store the malicious payload.

The Create plugin for WordPress in all versions up to and including 2.5.3 is vulnerable to generic SQL Injection via the 'order' parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. The vulnerable advanced-filter SQL branch is only entered when at least one of the following parameters is present: linked_posts, created_after, created_before, missing_fields, post_id, a comma-separated type value, or exclude_type.

The Create plugin for WordPress in all versions up to and including 2.5.3 is vulnerable to generic SQL Injection via the 'order_by' parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. The REST endpoint permission callback defaults to the publish_posts capability, meaning any Author-level user or above can reach the vulnerable code path without any additional preconditions.

The OTP Login & Register Woocommerce plugin for WordPress in all versions up to and including 2.7.3 is vulnerable to Stored Cross-Site Scripting via the 'fb-config' setting due to insufficient input sanitization and output escaping. On multisite installations where administrators do not hold the unfiltered_html capability, this vulnerability can be leveraged to target the network super administrator.

The PDF Builder for WooCommerce plugin for WordPress in all versions up to and including 2.0.11 is vulnerable to authorization bypass because it does not properly verify that a user is authorized to perform an action. This allows authenticated attackers with subscriber-level access or above to retrieve invoice numbers, formatted invoice numbers, and creation timestamps for arbitrary WooCommerce orders by supplying any OrderNumber and InvoiceId values with a garbage nonce.

The WP Customer Reviews plugin for WordPress in all versions up to and including 3.7.8 is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' parameter due to insufficient input sanitization and output escaping.

The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes. This allows unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status. This allows unauthenticated attackers to mark a pending order as paid without paying.

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations. This allows users who hold its own administrator-assigned custom role to read, modify and permanently delete other hosts' records and the WordPress user accounts linked to them.

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request. This allows authenticated users holding a Hydra Booking-assigned host role to modify other hosts' profile data and reassign ownership of another host's record to themselves.

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request. This allows unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own frontend registers them.

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions. This allows any unauthenticated visitor to read another visitor's assistant messages and to inject messages into their in-progress conversation.

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary files. The PHP handler shipped by default with the Debian and Ubuntu Apache packages maps .phar to PHP alongside .php and .phtml, so on that stack the uploaded file is executed and the issue leads to Remote Code Execution and full site takeover. Where the host routes only .php to the PHP handler, the same file is instead served from the site's own origin with its script intact, leading to Stored Cross-Site Scripting.

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validation callback, relying on a blocklist that omits a file-deletion function, allowing users able to manage forms to cause arbitrary files on the server to be deleted. The deletion itself is carried out when the form is submitted, which requires no authentication.

The Nimble Page Builder WordPress plugin through version 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action. This allows any authenticated user (Subscriber+) to disclose the page-builder content of arbitrary non-public (draft, pending, private, scheduled) posts and pages.