CVE Vulnerability Catalog

The Appointment Booking Plugin WordPress plugin before 5.6.8 does not restrict which booking fields an unauthenticated visitor can set, allowing assignment of privileged fields like approval status and bypassing the booking approval workflow.

The MotoPress Hotel Booking WordPress plugin before 6.0.4 fails to perform a capability check before returning full customer details in an AJAX action. Any authenticated user with low privileges (Subscriber and above) can read personal data including name, email, phone, and address of any customer.

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitize and escape a search parameter on an admin page before using it in a SQL query. Users with booking-management roles can perform SQL injection attacks.

The Sync Post With Other Site WordPress plugin before 1.9.3 incorrectly enforces page-editing capability in a REST route due to an operator-precedence flaw. An authenticated user with post-editing capability (e.g., Contributor) can create, publish, and overwrite arbitrary Pages, including content by higher-privileged users.

The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform capability or nonce checks before storing an option value, and does not escape that value on output. Unauthenticated users can store arbitrary JavaScript that executes in the context of any administrator viewing the settings page.

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute. Users with GiveWP Worker role and above can inject arbitrary web scripts that execute on the public donation form viewed by visitors.

The Tutor LMS WordPress plugin before 4.0.0 does not properly verify user access to the course a Q&A thread belongs to before returning or writing to that thread. Authenticated users with subscriber-level access and above who can access any single course can read Q&A threads of other courses and inject replies.

The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions. Unauthenticated users can modify limited post metadata (a like counter and associated identifier list) on arbitrary posts, including inflating the counter and growing stored metadata without bound.

The LifterLMS WordPress plugin before version 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in. This allows any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by supplying the post type.

The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses.

The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier.

The LifterLMS WordPress plugin before version 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it. This allows users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course.

The Essential Addons for Elementor WordPress plugin before version 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature. This allows unauthenticated users to disclose the title, price, and SKU of draft, pending, and private products that are otherwise withheld from public view.

The Essential Addons for Elementor WordPress plugin before version 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it. This allows users with Contributor-level access and above to inject JavaScript that will be executed (Stored Cross-Site Scripting) when the page is viewed, including in the session of an administrator previewing or visiting the post.

The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitize uploaded SVG/SVGZ files, which it adds to the list of allowed upload types. Users with the upload_files capability (Author and above) can upload files containing malicious JavaScript, leading to Stored Cross-Site Scripting.

The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user. Any logged-in user can read another customer's booking details, including billing address information, by supplying an arbitrary booking identifier.

The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid. Unauthenticated attackers can forge a notification that flips an arbitrary pending booking to a paid and booked state at an attacker-chosen amount.

The Fluent Forms WordPress plugin before 6.2.6 does not sanitize and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered. Users with a role as low as Contributor (with delegated form-management permission, but lacking unfiltered_html, e.g., in a multisite setup) can perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who loads the form, including administrators previewing it.

The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers. Unauthenticated attackers can spoof their IP address to bypass the plugin's own brute-force protection and to downgrade its firewall by matching a hardcoded whitelisted IP range.

The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion operations. Authenticated users with low privileges (such as Subscribers) can create, rename, and delete arbitrary taxonomy terms.