CVE Vulnerability Catalog

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to sensitive information disclosure due to an insecure direct object reference (IDOR) in all versions up to and including 3.3.2 via the enqueue_paypal_insights_script_on_order_received() function due to missing validation on a user-controlled key.

The Jeg Kit for Elementor plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3.1.1 via the enqueue_scripts() method in class/dashboard/class-dashboard.php. It injects a JkitDashboardOption JavaScript object containing full plugin inventory, system environment details, and potentially third-party API credentials.

The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 3.1 due to missing nonce validation on the ms_update AJAX action. This allows unauthenticated attackers to modify child theme CSS styles via a forged request if they can trick an administrator into clicking a link.

The Support Genix WordPress plugin before version 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension, including other users' private ticket attachments.

The Admin Columns for ACF Fields WordPress plugin through version 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of higher-privileged users who view the affected post-list screen.

The Codeless Page Builder WordPress plugin through version 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript. This executes in the session of any higher-privileged user (e.g., administrator) who views the content.

The YOP Poll WordPress plugin before version 7.0.6 does not validate the connection's origin IP address and trusts client-controlled forwarding headers when enforcing per-IP vote restrictions. This allows unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll.

The Event Tickets and Registration WordPress plugin before version 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders.

The Authora: Easy login with mobile number WordPress plugin before version 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered mobile number they know (including administrators) or to create arbitrary accounts.

The Pixel Tag Manager for WooCommerce WordPress plugin before version 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's stored credentials.

The Download Manager WordPress plugin before version 3.3.66 does not properly escape a package's title before outputting it in front-end templates. Users with the Author role or higher can store a title that results in arbitrary JavaScript execution in the browser of any user, including unauthenticated visitors, who views a page displaying the package.

The Podlove Podcast Publisher WordPress plugin before version 4.5.3 does not perform nonce validation on some administrative create and delete actions. Attackers can create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page.

The Pixelavo WordPress plugin before version 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page. This action forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows an unauthenticated visitor to inject arbitrary conversion events into the administrator's Facebook ads account and exhaust the configured API quota.

The Buckaroo Woocommerce Payments Plugin WordPress plugin before version 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds. Any authenticated user, including Subscribers, can trigger refunds against captured orders.

The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in several unauthenticated AJAX handlers, allowing unauthenticated attackers to change order status and overwrite payment metadata.

The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-in administrator.

The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users (such as administrators, who do not hold the unfiltered_html capability on multisite) to store JavaScript that executes in the browser of any visitor who views the form.

The SureForms plugin for WordPress up to version 2.8.1 has a Stored Cross-Site Scripting vulnerability via the 'headingWrapper' parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary scripts.

The Pinpoint Booking System – Version 2 plugin for WordPress up to version 2.9.9.6.9 has a blind SQL Injection vulnerability via the 'field' parameter due to insufficient escaping and query preparation. Authenticated attackers with administrator access can append additional SQL queries and extract sensitive data from the database.

The SendPulse Email Marketing Newsletter plugin for WordPress up to version 2.2.5 has a Stored Cross-Site Scripting vulnerability via the _sp_form_code Post Meta field due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access and above can inject arbitrary scripts, bypassing the allow-list check.