CVE Vulnerability Catalog

The WPeMatico RSS Feed Fetcher plugin for WordPress (versions up to and including 2.9) is vulnerable to Stored Cross-Site Scripting because it removes the wp_filter_post_kses filter before saving RSS feed content. An unauthenticated attacker who publishes or compromises an RSS feed subscribed to by an administrator can inject arbitrary scripts into imported posts.

The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before disclosing order details through its calendar view AJAX actions, allowing users with a role as low as Contributor to view other customers' order information.

The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.

The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.

The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network administrators, allowing an administrator of a single site on a multisite network to change it for the entire network.

The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.

The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.

The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the plugin and the second at which a token was issued. An attacker able to constrain when a staff or administrator token was issued can compute a valid token and access the booking API as that user, including an administrator.

The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions. This allows any authenticated user, such as a subscriber, to trigger a one-way migration that creates published records and permanently deletes the plugin's entire post-type and taxonomy configuration.

The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 1.17.0 via the 'email_address' parameter. This allows authenticated attackers with administrator-level access or higher to extract complete logged mail rows belonging to other users, including recipient addresses, message subjects, full message bodies, and any URLs contained therein, whose addresses match the wildcard. Exploitation requires an administrator to process a personal-data export request for the attacker's email address, and the attacker's address must contain a LIKE wildcard character (such as an underscore) that matches at least one other user's address in the mail log.

The HivePress – Business Directory, Listings & Classified Ads plugin for WordPress (versions up to and including 1.7.32) is vulnerable to Stored Cross-Site Scripting via the 'message' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access can inject scripts that execute in the victim's browser upon successful login via a form on the attacker's listing page.

The WSP MCP AI Agents Connector plugin for WordPress (versions up to and including 2.9.5) is vulnerable to Sensitive Information Disclosure because the wsp_get_posts tool lacks proper capability requirements and the MCP endpoint accepts any logged-in user. An authenticated attacker with subscriber-level access can read titles, URLs, authors, categories, tags, and 40-word excerpts of all unpublished posts.

The HivePress plugin for WordPress (versions up to and including 1.7.32) is vulnerable to stored cross-site scripting via the '<custom user attribute slug>' parameter (e.g., hp_custom_link). Insufficient input sanitization and output escaping allows an unauthenticated attacker to inject arbitrary web scripts that execute when a user visits the injected page. Exploitation requires a custom user attribute configured with a display_format template placing %value% inside an href, src, or style attribute context.

The Photo Engine (Media Organizer & Lightroom) plugin for WordPress (versions up to and including 6.5.6) is vulnerable to authorization bypass because it does not properly verify user permissions. An unauthenticated attacker can permanently delete arbitrary media attachments and upload new files; a subscriber-level user can obtain a wplr_auth_token and perform destructive actions.

The TranslatePress plugin for WordPress (versions up to and including 3.3.7) is vulnerable to stored cross-site scripting via the 'comment' parameter. Insufficient input sanitization and output escaping allows an unauthenticated attacker to inject arbitrary web scripts that execute when a user visits the injected page. Exploitation requires unmoderated comment submission and a secondary language configured.

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress in versions up to and including 1.4.5 is vulnerable to Sensitive Information Exposure via the 'woof_settings[woof_stat][server_options]' parameter. Unauthenticated attackers can extract the external MySQL host, database name, username, and plaintext password from the inline woof_tm_data script object on any public frontend filter page.

The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget. This allows any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.

The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields. This allows any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress in versions up to and including 7.25.00 is vulnerable to Privilege Escalation. The 'start_comms' dispatcher gates access only by comparing a caller-supplied 'apikey' against the stored plugin API key with no capability check and no nonce verification, then writes unvalidated parameters into the WPS_IC_SETTINGS option, allowing unauthenticated attackers to grant any role the 'manage_wpc_settings' capability.