| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via panels_data Parameter in all versions up to, and including, 2.34.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the nonce and edit_post capability checks enforced during save are both satisfied by Contributor-level users for their own posts, and the panels_data value is stored as post meta — outside the scope of WordPress's unfiltered_html carve-out — meaning no wp_kses fallback prevents the unsanitized WP_Widget_Custom_HTML content from being persisted and later rendered verbatim on the frontend. |
| The HD Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.2.0 to 2.2.1. This is due to missing or incorrect nonce validation on the hdq_validate_nonce function. This makes it possible for unauthenticated attackers to delete or modify quizzes and questions, create new quizzes, and change plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
| The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'search' parameter in all versions up to, and including, 4.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with marketer-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. |
| Contributor SQL Injection in WP Post Author <= 3.9.1 versions. |
| Contributor SQL Injection in WP Job Portal <= 2.5.2 versions. |
| Unauthenticated PHP Object Injection in Uncanny Automator <= 7.3.1.2 versions. |
| Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions. |
| Unauthenticated SQL Injection in wpDataTables <= 7.4 versions. |
| Subscriber SQL Injection in Tourfic <= 2.22.5 versions. |
| Administrator SQL Injection in Popup box <= 6.0.1 versions. |
| Subscriber Insecure Direct Object References (IDOR) in Majestic Support <= 1.1.7 versions. |
| Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions. |
| The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level access and above to permanently delete arbitrary posts and pages. When the Frontend File Manager Plugin WordPress plugin through 23.6's "Allow guest uploads" setting is enabled by an administrator, the same deletion primitive becomes reachable by unauthenticated users. |
| Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions. |
| Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions. |
| Unauthenticated Cross Site Scripting (XSS) in weMail <= 2.1.2 versions. |
| Contributor SQL Injection in wpForo Forum <= 3.0.9 versions. |
| Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.3 versions. |
| Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions. |
| Contributor SQL Injection in Contest Gallery <= 30.0.0 versions. |
