CVE Vulnerability Catalog

The Photo Block plugin versions up to 1.7.1 contain a Server-Side Request Forgery (SSRF) vulnerability, allowing authors to send requests to internal network resources.

The Photo Gallery by Supsystic plugin versions up to 1.16.3 contain a Cross-Site Scripting (XSS) vulnerability, allowing administrators to inject malicious scripts into pages.

The WP Accessibility Helper (WAH) plugin versions up to 0.6.6 contain an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability, allowing attackers to perform unauthorized actions on behalf of an administrator.

The WP-Polls plugin versions up to 2.77.3 contain a Cross-Site Scripting (XSS) vulnerability, allowing administrators to inject malicious scripts into pages.

The Keyboard Shortcuts extension for Joomla! (from regularlabs.com) has an XSS vulnerability – shortcut configuration accepts arbitrary inline JavaScript.

The Modals Pro extension for Joomla! improperly handles gallery paths, allowing directory enumeration beyond the intended scope.

The CDN for Joomla Pro extension improperly validates file paths during versioning, allowing checks for file existence outside the site directory.

The GeoIP extension for Joomla! trusts spoofable forwarded client-IP headers, allowing GeoIP rule bypass.

The Cache Cleaner Pro extension for Joomla! allows path traversal outside the web root via custom purge and log paths.

The Joomla Extension Cache Cleaner from regularlabs.com has inconsistent CSRF token checks and privilege checks. Administrator URL purges did not consistently require a valid token and cache-management permission.

The WCPOS – Point of Sale (POS) plugin for WooCommerce for WordPress up to version 1.9.8 is vulnerable to Directory Traversal via the 'type' parameter. Authenticated attackers with shop manager-level access or above can read arbitrary files on the server, including sensitive information. Successful exploitation requires supplying context=edit in the request, which bypasses content-stripping logic and returns the file verbatim in the REST API response.

The Premium Packages plugin for WordPress up to version 7.0.4 has an SQL injection vulnerability via the 'orderby' parameter. Insufficient escaping allows authenticated attackers with admin-level access to append SQL queries, potentially extracting sensitive database information.

Missing access control in the GutenKit Blocks plugin for WordPress (up to version 2.4.12). Unauthenticated attackers can retrieve private Mailchimp configuration data (lists, fields, metadata) via REST API endpoints.

The Grid/List View for WooCommerce plugin for WordPress up to version 3.0.9 has a Stored XSS vulnerability in the 'position' shortcode attribute. Insufficient sanitization allows authenticated attackers with contributor-level access or higher to inject scripts. The all_page="1" attribute expands the attack surface to all pages.

The WP Encryption plugin for WordPress (up to version 7.8.6.6) is vulnerable to Directory Traversal via the 'imploded' parameter. Authenticated attackers with administrator access can read arbitrary files on the server, including sensitive information. Although file content is encoded, configuration files like .htaccess can be overwritten, enabling DoS or redirect attacks. This only affects the premium version.

The Tickera plugin for WordPress is vulnerable to generic SQL injection via the 'tc_event_filter' parameter in versions up to and including 3.6.0.1. This is due to insufficient escaping and lack of query preparation, allowing authenticated attackers with staff-level access or higher to append additional SQL queries.

The Brands for WooCommerce plugin for WordPress up to version 3.8.8 is vulnerable to Stored Cross-Site Scripting via the 'br_brand_tooltip' Term Meta field. Insufficient input sanitization and output escaping allow authenticated attackers with custom-level access and above to inject arbitrary scripts that execute on every page visit. Even Shop Manager users (without unfiltered_html) can exploit this.

The Brands for WooCommerce plugin for WordPress up to version 3.8.8 has a Stored XSS vulnerability in the 'style' shortcode attribute. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject scripts.

The Tickera – Sell Tickets & Manage Events plugin for WordPress versions up to 3.6.0.1 contain a generic SQL injection vulnerability via the 'tc_order_status_filter' parameter, allowing authenticated users with staff-level access and above to append additional SQL queries, potentially leading to extraction of sensitive data from the database.

The Lpagery plugin for WordPress up to version 2.5.7 has a Stored XSS vulnerability in the lpagery_add_filter_text_template_post() function. The function echoes the raw post title inside a JavaScript string without proper encoding, allowing authenticated attackers with contributor-level access or higher to inject scripts. The attack requires an admin to visit a page with the ?lpagery_template=<post_id> parameter.