CVE Vulnerability Catalog

The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object, but with no known POP chain in the vulnerable software, it has no impact unless another plugin or theme with a POP chain is installed.

A flaw in cifs-utils allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a CIFS share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. An attacker can inject unauthorized mount options, bypassing permission checks and executing files with root privileges.

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement. This allows unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on.

The Schema & Structured Data for WP & AMP plugin (versions up to and including 1.67) is vulnerable to stored cross-site scripting via the 'saswp_review_text' parameter. Insufficient input sanitization and output escaping allows an unauthenticated attacker to inject arbitrary web scripts that execute when a user visits the injected page. The nonce, the only authorization gate, is publicly printed in the shortcode HTML, making it ineffective.

The Opti-Behavior plugin for WordPress (versions up to and including 1.9.2.1) is vulnerable to stored DOM-based cross-site scripting via the 'country_name' location parameter. Insufficient input sanitization and output escaping allows an unauthenticated attacker to inject arbitrary web scripts that execute when a user visits the injected page. The heatmap recording endpoint accepts unauthenticated requests protected only by a nonce that any visitor can freely obtain.

The Opti-Behavior plugin for WordPress (versions up to and including 1.9.2.1) is vulnerable to stored DOM-based cross-site scripting via the 'targetUrl' parameter. Insufficient input sanitization and output escaping allows an unauthenticated attacker to inject arbitrary web scripts that execute when a user visits the injected page. The ingest endpoint is gated only by a nonce that is publicly emitted to every anonymous visitor.

The Tainacan plugin for WordPress in versions up to and including 1.3.0 is vulnerable to Directory Traversal via the 'guid' parameter. Authenticated attackers with subscriber-level access and above can read the contents of arbitrary files on the server, which can contain sensitive information.

The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password, allowing unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.

The WP Ghost (Hide My WP Ghost) plugin for WordPress (versions up to and including 7.0.12) is vulnerable to stored cross-site scripting via the 'replaceHeadersAndTags' function. Insufficient input sanitization and output escaping allows an unauthenticated attacker to inject arbitrary web scripts that execute when a user clicks on the injected link.

The Tutor LMS – eLearning and online course solution plugin for WordPress in versions up to and including 4.0.8 is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url' parameter. Unauthenticated attackers can inject arbitrary web scripts that execute in the victim's browser whenever the victim accesses a page that includes the malicious payload.

The PilotPress plugin for WordPress (versions up to and including 2.0.43) is vulnerable to privilege escalation via account takeover. The update_cc_details() AJAX handler forwards an attacker-supplied username to ONTRAPORT before the local username_exists() collision check, and aborts without rolling back the remote rename when a collision is detected, allowing an authenticated Subscriber-level attacker to take over an Administrator account.

The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress in versions up to and including 1.19 is vulnerable to Sensitive Information Exposure. The W3TC_DYNAMIC_SECURITY constant is hardcoded to a publicly known value, allowing unauthenticated attackers to learn the W3 Total Cache mfunc security key.

The fanx_fingerprint function in ssl/sslxprint.c of ssldump miscalculates the heap buffer size, resulting in a 3-byte heap-based buffer overflow on every invocation with valid inputs. An attacker can supply a crafted pcap file containing a TLS X.509 certificate to trigger the overflow when ssldump is run with FAN/1 fingerprinting enabled.

The SiteOrigin CSS plugin for WordPress (versions up to and including 1.6.7) is vulnerable to stored DOM-based Cross-Site Scripting via the 'href' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The Quick PayPal Payments: Payment Button & Form plugin for WordPress in versions up to and including 6.0.4 is vulnerable to Stored Cross-Site Scripting via the 'form' parameter. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The NotificationX plugin for WordPress (versions up to and including 3.3.3) is vulnerable to stored Cross-Site Scripting via the 'name' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The User Profile Builder plugin for WordPress (versions up to and including 4.0.3) is vulnerable to privilege escalation via the 'role' parameter handled by the wppb_add_meta_to_user_on_activation() function. An unauthenticated attacker can gain a fully activated WordPress administrator account by submitting role=administrator through the public registration form and clicking the confirmation activation link.

The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress in versions up to and including 3.6.1 is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter. Authenticated attackers with vendor-level access and above can append additional SQL queries into existing queries to extract sensitive information from the database.

The Salon Booking System plugin for WordPress (versions up to and including 10.31.9) is vulnerable to stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The SiteOrigin CSS plugin for WordPress (versions up to and including 1.6.7) is vulnerable to stored DOM-based Cross-Site Scripting via the 'url (comment_author_url)' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.