CVE Vulnerability Catalog

The User Frontend plugin for WordPress (up to 4.3.13) is vulnerable to Privilege Escalation via the 'post_content' parameter in submit_post(). A control byte can bypass the shortcode blocklist, allowing injection of a registration shortcode with 'editor' role. This lets authenticated attackers with Subscriber-level access create an Editor account.

The Uncanny Toolkit for LearnDash plugin for WordPress (up to 3.8.2) is vulnerable to Authentication Bypass via the 'email' parameter in uo_login_action(). A parser-differential flaw allows skipping account verification by using a raw string for lookup and a sanitized string for login. This lets unauthenticated attackers log in to unverified or suspended accounts if they know the credentials.

The Shield Security plugin for WordPress (up to 22.3.2) is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI' parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user visits an injected page. The hidden 'path' column in ForTraffic.php is unescaped, enabling the attack.

The SEOPress plugin for WordPress (up to 10.3) is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter. Insufficient input sanitization and output escaping allow authenticated attackers with Subscriber-level access to inject arbitrary scripts that execute when a user visits an injected page. The payload uses the %%archive_title%% token with HTML, and the plugin substitutes the token after escaping.

The Project Manager – AI Powered Project Management plugin for WordPress (up to 4.1.1) is vulnerable to Remote Code Execution via the 'id' parameter. The unsanitized value is concatenated into a validation rule string and then invoked as a dynamic PHP function without allowlist checks. This allows unauthenticated attackers to execute code on the server.

The PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter (mapped to display_name) in versions up to and including 4.17.0 due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or higher can inject arbitrary scripts that execute when a user visits the injected page. Exploitation requires the attacker's account to have a mapped author term, which is not present by default for new users.

The Content Pilot plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.2.4. The plugin extracts HTML meta descriptions from remotely fetched RSS articles, processes them without proper sanitization, and saves them as post content, allowing an unauthenticated attacker controlling an RSS source to inject arbitrary scripts. These scripts execute when a user visits the injected page.

The WP Data Access plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 5.5.88 via the 'rel_tab' parameter. An unauthenticated attacker can extract all rows and columns of the database table backing any anonymously published app, including user password hashes, email addresses, and password-reset keys. This requires an administrator to have published at least one app with REST API authorization set to 'anonymous'.

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress (up to 6.2) is vulnerable to Stored Cross-Site Scripting via the 'Subject' parameter (e.g., from CF7). Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user visits an injected page. The payload is stored without authentication via any mail-sending feature when Graph Mailer is enabled but OAuth authorization is not completed.

The Rox Appointment Booking plugin for WordPress (up to 1.3.1) is vulnerable to Privilege Escalation via Mass Assignment. The public REST endpoint allows unauthenticated attackers to persist an arbitrary WordPress user ID (wp_user_id) with a controlled email address. When an administrator opens and saves the customer record, the administrator's email is overwritten, enabling account takeover.

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.5.15 due to improper verification of user authorization. An authenticated attacker with subscriber-level access or higher can view the entire Redux options payload, including plaintext password values, API keys, license keys, and SMTP credentials, exposed in the inline JavaScript block on the profile page. The Users extension is loaded automatically for every Redux instance, so any site running Redux Framework is affected.

The User Frontend plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'field_attr[required]' parameter in versions up to and including 4.3.13 due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts that execute if they trick a user into clicking a link. The nonce check is ineffective because the wpuf_nonce value is publicly available to every anonymous visitor.

The Wp Social Login and Register Social Counter plugin for WordPress (up to 3.2.2) is vulnerable to Authentication Bypass. The social login REST callback locates an account by the email returned from the OAuth provider and sets an authentication cookie without a password check, while the only verification guard is a no-op for bundled Facebook and Twitter adapters. This allows unauthenticated attackers to obtain a session as any user, including Administrators, if they control an OAuth account with a matching email.

The WP2LEADS plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in versions up to and including 3.5.6 due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. An authenticated attacker with subscriber-level access or higher can append additional SQL queries to extract sensitive information from the database.

The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/wp-retina-2x/v1/replace REST API endpoint in versions up to and including 7.2.0. An authenticated attacker with Author-level access or higher can replace files that do not belong to them.

The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to 2.29.24 via WP_Object_Cache::_getFilePath. Unauthenticated attackers can extract complete WordPress user records — including plaintext user_login, user_email, hashed user_pass, and user_activation_key — from predictable gzip-serialized cache files at wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz. This vulnerability is only exploitable when the plugin's Object Cache feature is enabled, and requires the attacker to first trigger caching of the target user record (e.g., via an unauthenticated REST API request) before retrieving the resulting cache file.

The Popup Builder plugin for WordPress in versions up to and including 4.4.5 does not properly verify that a user is authorized to perform an action. An unauthenticated attacker can trash all published popups on the site with a single GET request, amplified by a second flaw in SGPopup::find() that causes the trash branch to fire against every popup simultaneously.

The Product Filter for WooCommerce by WBW plugin is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' JSON parameter in versions up to 3.4.6 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability persists in versions that received the 3.4.3 patch because absint() was applied only to the getVar() read path, leaving the wpf_fid value read from the JSON-decoded filterSettings payload entirely unsanitized.

The Mail logging & Catcher plugin for WordPress in versions up to and including 2.2.0 is vulnerable to Sensitive Information Exposure via the 'message' parameter. An authenticated attacker with subscriber-level access or above can extract valid administrator password-reset keys from stored email logs and complete the password-reset flow to escalate to administrator.

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in versions up to 2.10.7 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. This requires HTML Minify to be enabled with the default 'mfunc' entry present in the ignored-comment stems list, and exploitation depends on the attacker predicting the md5(time()) placeholder namespace by reading the server clock via the HTTP Date response header within the applicable time window.