CVE Vulnerability Catalog

The Amelia (Booking for Appointments and Events Calendar) plugin for WordPress in versions up to and including 2.4.12 is vulnerable to Sensitive Information Exposure via the 'page' parameter. Unauthenticated attackers can extract staff personally identifiable information (full name, email address, phone number, gender, timezone) and administrator-authored internal notes for every published event, because the raw providers array is never stripped before output in the JSON response.

The Acadlix LMS plugin for WordPress (versions up to and including 1.1.9) is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function. Authenticated attackers with subscriber-level access or higher can delete arbitrary files on the server, potentially leading to remote code execution when critical files such as wp-config.php are deleted. The route's permission callback only verifies a generic wp_rest nonce emitted in the public acadlixOptions JavaScript object on every frontend page, effectively reducing the authentication requirement to unauthenticated.

The Newsletters plugin for WordPress in versions up to and including 4.18.1 is vulnerable to time-based SQL Injection via the 'id' parameter due to insufficient escaping of user-supplied input and lack of proper preparation of the existing SQL query. An authenticated attacker with subscriber-level access or higher can append additional SQL queries to existing queries to extract sensitive information from the database. An attacker can obtain the required nonce and subscriberauth cookie without a WordPress account by subscribing through the public newsletter form and opening the management link sent via email; the ownership check verifies only the subscriber_id field and does not validate that the injected id parameter belongs to the authenticated subscriber.

The User Frontend plugin for WordPress (up to 4.3.13) is vulnerable to Privilege Escalation via the 'post_content' parameter in submit_post(). A control byte can bypass the shortcode blocklist, allowing injection of a registration shortcode with 'editor' role. This lets authenticated attackers with Subscriber-level access create an Editor account.

The Uncanny Toolkit for LearnDash plugin for WordPress (up to 3.8.2) is vulnerable to Authentication Bypass via the 'email' parameter in uo_login_action(). A parser-differential flaw allows skipping account verification by using a raw string for lookup and a sanitized string for login. This lets unauthenticated attackers log in to unverified or suspended accounts if they know the credentials.

The Shield Security plugin for WordPress (up to 22.3.2) is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI' parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user visits an injected page. The hidden 'path' column in ForTraffic.php is unescaped, enabling the attack.

The SEOPress plugin for WordPress (up to 10.3) is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter. Insufficient input sanitization and output escaping allow authenticated attackers with Subscriber-level access to inject arbitrary scripts that execute when a user visits an injected page. The payload uses the %%archive_title%% token with HTML, and the plugin substitutes the token after escaping.

The Project Manager – AI Powered Project Management plugin for WordPress (up to 4.1.1) is vulnerable to Remote Code Execution via the 'id' parameter. The unsanitized value is concatenated into a validation rule string and then invoked as a dynamic PHP function without allowlist checks. This allows unauthenticated attackers to execute code on the server.

The PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter (mapped to display_name) in versions up to and including 4.17.0 due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or higher can inject arbitrary scripts that execute when a user visits the injected page. Exploitation requires the attacker's account to have a mapped author term, which is not present by default for new users.

The Content Pilot plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.2.4. The plugin extracts HTML meta descriptions from remotely fetched RSS articles, processes them without proper sanitization, and saves them as post content, allowing an unauthenticated attacker controlling an RSS source to inject arbitrary scripts. These scripts execute when a user visits the injected page.

The WP Data Access plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 5.5.88 via the 'rel_tab' parameter. An unauthenticated attacker can extract all rows and columns of the database table backing any anonymously published app, including user password hashes, email addresses, and password-reset keys. This requires an administrator to have published at least one app with REST API authorization set to 'anonymous'.

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress (up to 6.2) is vulnerable to Stored Cross-Site Scripting via the 'Subject' parameter (e.g., from CF7). Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user visits an injected page. The payload is stored without authentication via any mail-sending feature when Graph Mailer is enabled but OAuth authorization is not completed.

The Rox Appointment Booking plugin for WordPress (up to 1.3.1) is vulnerable to Privilege Escalation via Mass Assignment. The public REST endpoint allows unauthenticated attackers to persist an arbitrary WordPress user ID (wp_user_id) with a controlled email address. When an administrator opens and saves the customer record, the administrator's email is overwritten, enabling account takeover.

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.5.15 due to improper verification of user authorization. An authenticated attacker with subscriber-level access or higher can view the entire Redux options payload, including plaintext password values, API keys, license keys, and SMTP credentials, exposed in the inline JavaScript block on the profile page. The Users extension is loaded automatically for every Redux instance, so any site running Redux Framework is affected.

The User Frontend plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'field_attr[required]' parameter in versions up to and including 4.3.13 due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts that execute if they trick a user into clicking a link. The nonce check is ineffective because the wpuf_nonce value is publicly available to every anonymous visitor.

The Wp Social Login and Register Social Counter plugin for WordPress (up to 3.2.2) is vulnerable to Authentication Bypass. The social login REST callback locates an account by the email returned from the OAuth provider and sets an authentication cookie without a password check, while the only verification guard is a no-op for bundled Facebook and Twitter adapters. This allows unauthenticated attackers to obtain a session as any user, including Administrators, if they control an OAuth account with a matching email.

The WP2LEADS plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in versions up to and including 3.5.6 due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. An authenticated attacker with subscriber-level access or higher can append additional SQL queries to extract sensitive information from the database.

The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/wp-retina-2x/v1/replace REST API endpoint in versions up to and including 7.2.0. An authenticated attacker with Author-level access or higher can replace files that do not belong to them.

The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to 2.29.24 via WP_Object_Cache::_getFilePath. Unauthenticated attackers can extract complete WordPress user records — including plaintext user_login, user_email, hashed user_pass, and user_activation_key — from predictable gzip-serialized cache files at wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz. This vulnerability is only exploitable when the plugin's Object Cache feature is enabled, and requires the attacker to first trigger caching of the target user record (e.g., via an unauthenticated REST API request) before retrieving the resulting cache file.

The Popup Builder plugin for WordPress in versions up to and including 4.4.5 does not properly verify that a user is authorized to perform an action. An unauthenticated attacker can trash all published popups on the site with a single GET request, amplified by a second flaw in SGPopup::find() that causes the trash branch to fire against every popup simultaneously.