CVE Vulnerability Catalog

The Piraeus Bank WooCommerce Payment Gateway plugin version 3.2.0 has a broken authentication vulnerability that does not require authentication. This means an unauthenticated attacker can gain unauthorized access to functions or data.

The Booking calendar, Appointment Booking System plugin version 3.2.36 and earlier has an insecure direct object references (IDOR) vulnerability that does not require authentication. This means an unauthenticated attacker can access objects (e.g., bookings) without authorization.

The CTX Feed plugin version 6.6.47 and earlier has an arbitrary file download vulnerability exploitable by users with the Shop manager role. This means a shop manager can download arbitrary files from the server that they should not have access to.

The Contact Form by Supsystic plugin version earlier than 1.10.0 has a bypass vulnerability that does not require authentication. This means an unauthenticated attacker can bypass security mechanisms and gain unauthorized access.

Cross Site Scripting (XSS) vulnerability in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions up to 4.3.9. The attack requires subscriber-level privileges.

Broken Access Control vulnerability in GiveWP versions up to 4.16.5.1. The attack does not require authentication.

Broken Access Control vulnerability in GiveWP versions earlier than 4.16.6. The attack does not require authentication.

Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both types of keys (filekeys and dirkeys) were manually enabled in the volume flags simultaneously. This issue is fixed in version 1.20.17.

Privilege Escalation vulnerability in MasterStudy LMS versions up to 3.7.41. The attack requires subscriber-level privileges.

Cross Site Scripting (XSS) vulnerability in GeoDirectory versions up to 2.8.172. The attack requires contributor-level privileges.

Broken Access Control vulnerability in Appointment Hour Booking versions up to 1.5.91. The attack does not require authentication.

Missing Authorization vulnerability in MultiVendorX dc-woocommerce-multi-vendor allows exploiting incorrectly configured access control security levels. This issue affects MultiVendorX from n/a through 5.0.20.

Cross Site Scripting (XSS) vulnerability in WP Tab Widget versions up to 1.2.11. The attack requires contributor-level privileges.

Cross Site Scripting (XSS) vulnerability in the Table of Contents Block in versions up to 1.5.0. A user with Contributor role can inject malicious script.

Cross Site Scripting (XSS) vulnerability in Typing Effect in versions up to 1.3.7. A user with Contributor role can inject malicious script.

Cross Site Scripting (XSS) vulnerability in Wufoo Shortcode in versions up to 1.55. A user with Contributor role can inject malicious script.

Cross Site Scripting (XSS) vulnerability in Video Conferencing with Zoom in versions up to 4.6.8. A user with Contributor role can inject malicious script.

Cross Site Scripting (XSS) vulnerability in Login With Ajax in versions up to 4.5.1. A user with Contributor role can inject malicious script.

Cross Site Scripting (XSS) vulnerability in WPZOOM Forms – Contact Form Plugin for Gutenberg in versions up to 2.0.4. A user with Contributor role can inject malicious script.

Cross Site Scripting (XSS) vulnerability in Frontend Admin by DynamiApps in versions up to 3.29.10. A user with Contributor role can inject malicious script.