CVE Vulnerability Catalog

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes. Unauthenticated attackers can list courses that are not published, including draft, pending, private, scheduled and trashed ones.

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools. Unauthenticated attackers can list every enrolled student's display name and user identifier against the course they are enrolled on, and recover their email addresses through the same handler's search filter.

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers. Unauthenticated attackers can retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, which is content the LearnPress WordPress plugin before 4.4.7 otherwise keeps non-public.

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values. This allows unauthenticated visitors to have markup rendered in the admin entry view that would otherwise be removed, and to attribute their submission to an administrator who never made it.

The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content. This allows any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation.

The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to. This allows any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing their user ID.

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records. This allows attackers to make a logged in admin permanently delete arbitrary posts and pages via a crafted request.

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call. This allows users with the contributor role and above to inject and store JavaScript that executes in the browser of anyone who interacts with the affected widget.

The plugin before 1.66 does not correctly verify comment ownership or moderation status before returning content, allowing unauthenticated users to read comments still awaiting moderation or marked as spam.

The plugin before 1.66 does not check if a post is password protected before including its content in structured data, allowing unauthenticated users to obtain password-protected post content through multiple public output routes.

The Ni WooCommerce Sales Report plugin before 4.2.0 lacks authentication/authorization checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, target individual orders, and search orders by customer name or email.

The Eventin plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.

The WP Import Export Lite plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with import capability (administrators by default) to make the site issue requests to internal hosts and services and read their responses. This is an incomplete fix for CVE-2026-11397.

The WP Import Export Lite plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the browser of a high privileged user, such as an administrator, viewing that screen.

The WP Import Export Lite plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the import permission to perform SQL injection attacks.

The WP Import Export Lite plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission (administrators by default, may also grant to lower roles) to perform SQL injection attacks.

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing users with import permission to disclose sensitive files from the server, including files outside the web root. The same code path also relaxes file-system permissions of any path it is given, whether or not the copy succeeds.

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a capability to delete arbitrary directories and every file within them, including outside the web root.

The Bold Page Builder plugin for WordPress (all versions up to and including 5.9.6) is vulnerable to Stored Cross-Site Scripting via the 'shortcode_content' parameter of the bt_bb_shortcode shortcode. This is due to a bypassable security filter (bt_bb_save_pre) circumvented via null byte injection, combined with insufficient output sanitization of base64-decoded content in the bt_bb_raw_content shortcode handler. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts into pages that execute when users visit them.

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress (all versions up to and including 2.15.22) is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute if they can successfully trick a user into performing an action such as clicking a link.