CVE Vulnerability Catalog

The YaySMTP plugin for WordPress (versions up to and including 2.7.7) is vulnerable to arbitrary file upload via the putFile function. Insufficient file type validation allows an authenticated subscriber-level user to upload an executable file, leading to remote code execution (RCE). The .htaccess protection is ignored by nginx and Apache with AllowOverride None.

The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge payment-confirmation notifications and record arbitrary donations as completed, with attacker-chosen amounts, donor names and messages.

The WP Photo Album Plus plugin for WordPress (versions up to and including 9.3.02.002) is vulnerable to command injection via the 'value' parameter in the 'update-photo' AJAX action. Insufficient shell escaping in the wppa_image_magick_a() function allows an authenticated user with the wppa_upload capability to execute arbitrary OS commands as the web server user. ImageMagick must be enabled.

The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks on installs where the payment key has not been configured.

The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions.

The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed content.

Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, and 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties and to bound the quadratic multibyte-keyword matching performed for each post. An authenticated user can degrade post-processing latency and consume excessive CPU on behalf of other members of any shared channel by storing an oversized notify_props.mention_keys list on their own profile.

The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. An authenticated attacker with Contributor-level access or above can publish, unpublish, or bulk-delete any wpmb_map post, including maps owned by administrators.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints. An authenticated user can learn the channel ID of a private channel another user is actively viewing via the status endpoints without being a member of that channel.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed. A System Console administrator can disclose the plaintext bind password to an attacker-controlled server via the Test Connection / diagnostics feature.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection. An authenticated user with permission to manage outgoing OAuth connections can obtain the secret by pointing the token URL at an attacker-controlled endpoint and triggering validation.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, and 11.8.x <= 11.8.5 fail to enforce DM/GM check on the server side. An authenticated user can quarantine a post belonging to a DM or GM via a direct API call.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, and 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles. An authenticated attacker can escalate a guest account to team or channel admin via a crafted PUT request to the member roles API endpoint.

The User Registration & Membership plugin for WordPress (versions up to and including 5.2.8) is vulnerable to arbitrary shortcode execution because it does not properly validate a value before running do_shortcode. An authenticated attacker with subscriber-level access or above can execute arbitrary shortcodes.

The WP Booking System – Booking Calendar plugin for WordPress (versions up to and including 2.1.0.1) is vulnerable to SQL injection via the 'data[orderby]' parameter due to insufficient escaping and lack of query preparation. An authenticated attacker with administrator-level access can append additional SQL queries to extract sensitive database information; exploitation requires a calendar with more than 200 bookings.

The GeoDirectory – WP Business Directory Plugin for WordPress (versions up to and including 2.8.192) is vulnerable to Stored Cross-Site Scripting via the 'twitterusername' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access can inject arbitrary scripts that execute when a user visits the injected page.

The CP Multi View Events Calendar plugin for WordPress (versions up to and including 1.4.42) is vulnerable to stored cross-site scripting via the 'CalendarTitle' parameter. Insufficient input sanitization and output escaping allows an unauthenticated attacker to inject arbitrary web scripts that execute when a user visits the injected page. This requires the 'Allow edition in frontend?' option to be enabled.

The Premium Packages – Sell Digital Products Securely plugin for WordPress (versions up to and including 7.2.8) is vulnerable to Stored Cross-Site Scripting via the 'note' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access can inject scripts that execute when a user visits the injected page.

The Site Reviews plugin (versions up to and including 8.3.4) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control levels. This may enable unauthorized users to perform actions reserved for higher privileges.

The WebberZone Top 10 – Popular Posts plugin for WordPress (versions up to and including 4.5.2) is vulnerable to Stored Cross-Site Scripting via the 'other_attributes' parameter (parsed to inject instance_id) and undeclared 'is_widget' due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access can inject scripts that execute when a user visits the injected page.