CVE Vulnerability Catalog

The School Management – Education & Learning ERP plugin for WordPress up to version 5.4 is vulnerable to SQL Injection via the 'order[0][dir]' parameter. Authenticated attackers with custom-level access and above can append SQL queries to existing ones, extracting sensitive database information. The vulnerability affects multiple AJAX handlers, and missing nonce verification enables CSRF-chained attacks.

The User Login History plugin for WordPress up to version 2.1.7 is vulnerable to SQL Injection via the 'blog_id' parameter. Authenticated attackers with Administrator-level access and above can append SQL queries, extracting sensitive database information. The vulnerability is only exploitable on multisite installations.

The Hospital Management System 1.0 from itsourcecode has a SQL Injection vulnerability in /vieworder.php. Manipulation of the 'delid' argument allows remote SQL injection. The exploit has been publicly disclosed and may be used.

The Visualizer WordPress plugin before 4.0.7 does not properly authorize access to chart configuration, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the plugin's interface denies them, and to retrieve every chart's configuration in a single request. The disclosed configuration can include credentials of a remote data source.

The Masteriyo LMS WordPress plugin before version 2.3.3 does not sanitize and escape a quiz field before output, and grants instructors the ability to store unfiltered HTML, allowing Stored XSS attacks against any visitor, including administrators. Default single-site installations are affected; multisite or DISALLOW_UNFILTERED_HTML sites are not.

The Premium Packages WordPress plugin before version 7.0.7 does not validate withdrawal requests against the user's actual balance, allowing any authenticated user, including a subscriber with no sales, to request arbitrary payouts that an admin may approve.

The ECS WordPress plugin before version 4.3.10 does not perform ownership or post-status checks when reading custom field values from a user-supplied post ID, allowing contributor-level users to read custom fields and metadata from posts they do not own, including private and draft ones.

The SureDash – Community, Courses & Member Dashboard plugin for WordPress up to version 1.10.3 is vulnerable to Stored Cross-Site Scripting via the 'draweropenverposition' attribute. Authenticated attackers with contributor-level access and above can inject arbitrary scripts that execute when a user accesses the injected page. The payload is stored in JSON within an HTML comment, and missing esc_attr() allows breaking out of the attribute.

The Slider Hero plugin for WordPress up to version 9.1.7 is vulnerable to second-order SQL Injection via the qcld_sliderhero_duplicate() function. Slide data is safely stored, but during slider duplication, values are concatenated without preparation, allowing administrators to inject additional SQL queries and extract sensitive data.

The Smash Balloon Social Post Feed – Simple Social Feeds plugin for WordPress up to version 4.9.0 is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute. Authenticated attackers with contributor-level access and above can inject arbitrary scripts that execute when a user accesses the injected page.

The Snippet Shortcodes plugin for WordPress up to version 5.2.0 is vulnerable to Stored Cross-Site Scripting via shortcode attributes. Authenticated attackers with contributor-level access and above can inject arbitrary scripts that execute when a user accesses the injected page.

The Youtube Showcase plugin for WordPress up to version 4.0.4 is vulnerable to Stored Cross-Site Scripting via the 'emd_mb_meta' shortcode. Attachment titles are interpolated into HTML attributes without proper escaping, allowing authenticated attackers with author-level access and above to inject arbitrary scripts.

The Toocheke Companion plugin for WordPress up to version 2.10 is vulnerable to Stored Cross-Site Scripting via the 'series_bg_color' post meta field. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when an administrator views the series list table.

The Manual Image Crop WordPress plugin before version 1.15 lacks capability checks and nonce verification on the authenticated AJAX action for cropping images; any logged-in user can pass. A subscriber can supply an arbitrary attachment ID and overwrite its intermediate-size image (e.g., thumbnail) and mutate its metadata, regardless of ownership. This is a cross-user integrity/defacement issue. The action also has no nonce, making it vulnerable to CSRF.

The WC Vendors plugin for WordPress up to version 2.7.0 is vulnerable to generic SQL Injection via the 'status' parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with shop manager-level access and above to append additional SQL queries, potentially extracting sensitive information from the database.

The ShortPixel Adaptive Images plugin for WordPress up to version 3.11.5 is vulnerable to authorization bypass. Improper verification of user permissions allows authenticated attackers with subscriber-level access and above to modify configuration options of third-party plugins such as ShortPixel Image Optimizer, Autoptimize, WP Rocket, Imagify, and LiteSpeed Cache, as well as the plugin's own API key and account binding.

The StoreEngine plugin for WordPress up to version 2.1.1 is vulnerable to Directory Traversal via the parse_file_path function. This allows authenticated attackers with vendor-level access and above to read the contents of arbitrary files on the server, which may contain sensitive information.

The Divi WordPress theme before version 5.9.0 does not properly escape some Social Media Follow module settings before outputting them in link attributes, allowing users with contributor role or above to store JavaScript that executes when a higher-privileged user, such as an admin, views the post.

The Turnkey bbPress by WeaverTheme plugin for WordPress up to version 1.7.1 is vulnerable to PHP Object Injection via deserialization of untrusted input in the wvrbbp_set_to_serialized_values() function. The function reads raw file contents and passes them directly to unserialize() without validation, allowing authenticated attackers with administrator-level access and above to inject a PHP Object.

A weakness has been identified in DefaultFuction Customer-Relationship-Management-In-C-Project 2.0. It affects the gets function in the Customer Search Module, causing a stack-based buffer overflow. The attack can be initiated remotely, and the exploit has been made public.