CVE Vulnerability Catalog

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.

Unauthenticated Cross Site Scripting (XSS) vulnerability in FV Player 8 plugin up to version 8.1.8. Allows unauthorized users to inject malicious scripts into pages viewed by other users.

The WordPress plugin "Social Share Icons & Social Share Buttons" (ultimate-social-media-plus) up to version 3.7.5 is vulnerable to Reflected Cross-site Scripting due to improper neutralization of input during web page generation.

The WordPress plugin SiteVault – Backup, Restore, Migration & Cloning (up to version 1.5.19) contains a Code Injection vulnerability that allows Remote Code Inclusion. Improper control of code generation lets an attacker execute arbitrary code within the application context.

The Jannah plugin for WordPress by TieLabs contains a Reflected XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions before 7.6.8.

SQL Injection vulnerability in Events Manager plugin up to version 7.4.6, requiring subscriber privileges. Allows a user with subscriber role to inject malicious SQL queries into the database.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Qode Real Estate plugin up to version 1.1.7.3. Allows unauthorized users to inject malicious scripts into pages viewed by other users.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Qode Music plugin up to version 2.1.8.2. Allows unauthorized users to inject malicious scripts into pages viewed by other users.

Unauthenticated Sensitive Data Exposure vulnerability in Web Plura Backup & Restore Manager plugin up to version 0.2.25. Allows unauthorized users to access sensitive data.

The Swish Migrate and Backup plugin in versions up to 1.4.0 exposes sensitive data without authentication. An unauthenticated attacker can access confidential information.

The Jetpack VideoPress plugin in versions up to 3.6 has a subscriber broken access control vulnerability. A subscriber-level user can perform actions beyond their permissions.

The PeepSo plugin versions up to 9.0.5.4 allow a subscriber to delete arbitrary files on the server.

The Jotform – AI Chatbot plugin versions up to 3.8.2 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability.

Missing Authorization vulnerability in Pubjet through 5.4.8 allows Exploiting Incorrectly Configured Access Control Security Levels.

The Wordable plugin versions up to 8.2.10 have a Broken Access Control vulnerability that allows a subscriber to access functions they should not have permissions for.

The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin in versions up to and including 1.5.3 contains a SQL Injection vulnerability exploitable by a Subscriber-level user. Only a low-privileged account is required.

The WPSection plugin versions up to 1.5.1 have a Broken Access Control vulnerability that allows a subscriber to access functions they should not have permissions for.

The Everest Backup plugin versions up to 2.3.13 contain an unauthenticated Remote Code Execution (RCE) vulnerability.

The AIWU plugin in versions up to and including 1.5.9 contains a privilege escalation vulnerability exploitable by a Subscriber-level user. Only a low-privileged account is required.

The Additional Order Filters for WooCommerce plugin versions up to 1.24 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability.