CVE Vulnerability Catalog

The ProfilePress plugin for WordPress up to version 4.16.19 is vulnerable to arbitrary shortcode execution. This is due to improper validation before running do_shortcode. Authenticated attackers with subscriber-level access can execute arbitrary shortcodes, and partial mitigations can be bypassed via various render paths.

The Kubio AI Page Builder plugin for WordPress up to version 2.8.5 is vulnerable to authorization bypass. Improper permission verification allows authenticated attackers with contributor-level access to overwrite front-page configuration, rewrite navigation menus, replace template parts, and overwrite global data. The nonce is available to all block editor users, making it ineffective.

The Fullscreen Galleria plugin for WordPress up to version 1.6.12 is vulnerable to generic SQL Injection via the 'href' attribute in post content. Insufficient escaping and lack of query preparation allow authenticated attackers with contributor-level access to append additional SQL queries to extract sensitive information.

The Quiz and Survey Master (QSM) plugin for WordPress up to version 11.2.1 is vulnerable to generic SQL Injection via the 'randon_category' quiz option. Insufficient escaping and lack of query preparation allow authenticated attackers with custom-level access to append additional SQL queries to extract sensitive information.

The Serious Slider plugin for WordPress up to version 1.4.0 is vulnerable to Stored Cross-Site Scripting via the 'theme' shortcode attribute. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access to inject arbitrary web scripts that execute when a user accesses an injected page.

The NEX-Forms plugin for WordPress up to version 9.2.4 is vulnerable to generic SQL Injection via the 'additional_params' parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with admin-level access to append additional SQL queries. This is a second-order vulnerability triggered during CSV export.

The WC Product Table Lite plugin for WordPress up to version 5.6.0 is vulnerable to CSS Injection via the 'laptop_scroll_offset' shortcode attribute exposed through the unauthenticated AJAX handler. Lack of value validation and CSS escaping allows unauthenticated attackers to inject arbitrary CSS rules, leading to data exfiltration, UI redressing, and phishing.

The Loco Translate plugin for WordPress up to version 2.8.7 is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments. Insufficient input sanitization and output escaping allow authenticated attackers with translator-level access to inject arbitrary web scripts that execute when a user accesses an injected page.

The Advanced File Manager plugin for WordPress up to version 5.4.12 is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires control of a domain with a prefix matching the backend URL and an authenticated admin visiting the page with the File Manager open.

The Appointment Booking Calendar plugin for WordPress up to version 1.6.12.10 is vulnerable to Insecure Direct Object Reference via the ssa_past_appointments parameter due to missing validation on a user-controlled key. Authenticated attackers with contributor-level access can access appointment records of arbitrary users, including ownership tokens and full customer PII. The REST endpoint is registered unconditionally and only requires edit_posts capability.

The Everest Forms plugin for WordPress up to version 3.5.2 is vulnerable to authorization bypass due to improper verification of user permissions. Authenticated attackers with delegated form management access can activate arbitrary already-installed WordPress plugins, including previously deactivated or vulnerable ones, without holding the activate_plugins capability. This requires holding a delegated Everest Forms capability, which administrators can assign to non-administrators.

The Bookly plugin for WordPress up to version 27.7 is vulnerable to Insecure Direct Object Reference in the appointment() method of the Mobile Staff Cabinet API. The handler loads an Appointment by the attacker-supplied id without verifying that the appointment's staff_id matches the authenticated staff member. Authenticated attackers with staff-level mobile cabinet access can read appointment details of other staff members, including internal notes and customer data, by enumerating sequential IDs.

The Gravity Booster plugin for WordPress up to version 5.26 is vulnerable to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. Authenticated attackers with editor-level permissions can inject arbitrary web scripts that execute when a user accesses an injected page. This only affects multi-site installations and those where unfiltered_html has been disabled.

The Quiz and Survey Master plugin for WordPress up to version 11.2.1 is vulnerable to Stored Cross-Site Scripting via the 'question_title' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page.

The PPWP plugin for WordPress up to version 1.9.20 is vulnerable to Insecure Direct Object Reference via the ppw_free_set_password AJAX action due to missing validation on a user-controlled key. Authenticated attackers with Contributor-level access can update the password on any password-protected post and subsequently access the content.

The Admin Custom Login plugin for WordPress up to version 3.6.4 is vulnerable to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level permissions can inject arbitrary web scripts that execute when a user accesses an injected page. This only affects multi-site installations and those where unfiltered_html has been disabled.

A security flaw has been discovered in Dolibarr up to 23.0.3. The unknown function in the User Cloning component of htdocs/user/card.php is affected. Manipulation of the ID argument results in LDAP injection. The attack can be launched remotely. The exploit has been publicly released and may be used. A patch is available.

A vulnerability was identified in OpenBoxes up to 0.9.6. The buildZebraTemplate function in DocumentController.groovy is affected, leading to improper neutralization of special elements used in a template engine. The attack can be initiated remotely. The exploit is publicly available. Upgrading to version 0.9.8-hotfix1 or 0.9.8 fixes the issue.

A vulnerability was found in OpenBoxes up to 0.9.7 in the Role Interceptor component, in the needManager function of RoleInterceptor.groovy. Manipulation can lead to improper privilege management. The attack can be performed remotely, and the exploit is publicly disclosed.

A vulnerability was found in OpenBoxes up to 0.9.7 in the Upload function of ProductController.groovy in the Product Upload Endpoint component. Manipulating the params.url argument results in server-side request forgery. The attack can be carried out remotely, and the exploit is public.