CVE Catalog

A stored cross-site scripting vulnerability has been identified in the CHR Designer Responsive jQuery Slider plugin for WordPress, affecting versions through 1.1.1. This vulnerability arises from improper input sanitization during web page generation, allowing malicious scripts to be injected and executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the WordPress Gallery and Lightbox plugin, affecting versions through 1.0.14. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A reflected cross-site scripting vulnerability has been identified in the Thorsten Krug Multilang Contact Form plugin, affecting versions through 1.5. This issue arises from improper input sanitization during web page generation, allowing attackers to inject malicious scripts that are executed when users visit the affected site.

A DOM-based cross-site scripting vulnerability has been identified in the Bold Pagos En Linea WordPress plugin, affecting versions through 3.1.4. This issue arises from improper input neutralization during web page generation, allowing malicious actors to inject and execute harmful scripts on the site.

A stored cross-site scripting vulnerability has been identified in the Codexpert CoDesigner WooCommerce Builder for Elementor, affecting versions through 4.7.17.2. This vulnerability arises from improper input neutralization during web page generation, allowing malicious scripts to be injected and executed when users visit the affected site.

A broken access control vulnerability has been identified in the bPlugins LLC Button Block WordPress plugin, affecting versions through 1.1.5. This vulnerability allows users to access functionalities that are not properly restricted by access control lists (ACLs), potentially leading to unauthorized actions.

A path traversal vulnerability allowing PHP local file inclusion has been identified in the ElementInvader Addons for Elementor plugin, affecting versions through 1.2.6. This vulnerability could enable a malicious actor to include local files from the target website and display their contents, potentially leading to a complete database takeover if sensitive files containing database credentials are accessed.

A SQL injection vulnerability has been identified in the ComMotion Course Booking System, affecting versions through 6.0.5. This vulnerability allows for improper neutralization of special elements used in SQL commands, enabling malicious actors to manipulate database queries and potentially access or modify database information.

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WordPress Background Control plugin, specifically in versions through 1.0.5. This vulnerability allows for path traversal, potentially leading to arbitrary file deletion.

A remote code execution vulnerability has been identified in the Web Ready Now WR Price List Manager for WooCommerce, affecting versions through 1.0.8. This vulnerability allows unrestricted upload of files with dangerous types, such as web shells, which can be executed on the web server.

A DOM-based cross-site scripting vulnerability has been identified in the Nativery Developer WordPress plugin, affecting versions through 0.1.6. This issue arises from improper input sanitization during web page generation, allowing malicious actors to inject and execute harmful scripts on the affected site.

A stored cross-site scripting vulnerability has been identified in the WordPress wp-pano plugin, affecting versions through 1.17. This issue allows for improper neutralization of input during web page generation, enabling the injection of malicious scripts that are executed when users visit the affected site.

A broken access control vulnerability has been identified in the WordPress WP News Sliders plugin, affecting versions through 1.0. This vulnerability arises from missing authorization checks, which could allow an unprivileged user to perform actions reserved for higher privileged users.

A reflected cross-site scripting vulnerability has been identified in the Lijit Search WordPress plugin, specifically in versions through 1.1. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A reflected cross-site scripting vulnerability has been identified in the WordPress WP Bulletin Board plugin, affecting versions through 1.1.4. This issue allows attackers to inject malicious scripts that are executed when users visit the affected page.

A broken authentication vulnerability has been identified in the WPChill Htaccess File Editor plugin, affecting versions through 1.0.19. This vulnerability allows attackers to exploit improperly configured access control, potentially performing actions reserved for higher-privileged users.

A stored cross-site scripting vulnerability has been identified in the Creative Brahma Multifox WordPress theme, affecting versions through 1.3.7. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A reflected cross-site scripting vulnerability has been identified in the Zarinpal Paid Download WordPress plugin, affecting versions through 2.3. This issue allows attackers to inject malicious scripts that could be executed when users visit the affected site.

A reflected cross-site scripting vulnerability has been identified in the WP Order By WordPress plugin, affecting versions through 1.4.2. This issue arises from improper input sanitization during web page generation, allowing attackers to inject malicious scripts that are executed when users visit the affected site.

A reflected cross-site scripting vulnerability has been identified in the WordPress WP Post Corrector plugin, specifically in versions through 1.0.2. This issue allows attackers to inject malicious scripts that are executed when users visit the affected page.

A stored cross-site scripting vulnerability has been identified in the WordPress HelpDesk & Support Ticket System Plugin – Octrace Support, affecting versions through 1.2.7. This vulnerability allows attackers to inject malicious scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the WordPress Ajax Contact Form plugin, specifically in versions through 1.2.5.1. This issue arises from improper input sanitization during web page generation, allowing malicious scripts to be injected and executed when users visit the affected site.

A reflected cross-site scripting vulnerability has been identified in the CodeBard Help Desk WordPress plugin, affecting versions through 1.1.2. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the BoldGrid Post and Page Builder plugin, specifically in versions through 1.27.4. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A DOM-based cross-site scripting vulnerability has been identified in the WordPress Elementor AI Addons plugin, affecting versions through 2.2.1. This issue arises from improper input neutralization during web page generation, allowing malicious actors to inject and execute scripts on the affected site.

A reflected cross-site scripting vulnerability has been identified in the WordPress WP Headmaster plugin, specifically in versions through 0.3. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A reflected cross-site scripting vulnerability has been identified in the WordPress Amber plugin, specifically in versions through 1.4.4. This issue allows attackers to inject malicious scripts that are executed when users visit the affected page.

A reflected cross-site scripting vulnerability has been identified in the WordPress turboSMTP plugin, affecting versions through 4.6. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A reflected cross-site scripting vulnerability has been identified in the GSheetConnector for Forminator Forms WordPress plugin, affecting versions through 1.0.11. This vulnerability allows attackers to inject malicious scripts that are executed when users visit the affected site.

A reflected cross-site scripting vulnerability has been identified in the Mighty Digital Partners WordPress plugin, affecting versions through 0.2.0. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A reflected cross-site scripting vulnerability has been identified in the WordPress Post Carousel & Slider plugin, affecting versions through 1.0.4. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the AwoThemes Social Media Engine plugin for WordPress, affecting versions through 1.0.2. This vulnerability arises from improper input sanitization during web page generation, allowing malicious scripts to be injected and executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the SetMore Appointments WordPress theme, specifically in the Custom Post Types version range prior to and including 1.1. This vulnerability arises from improper input sanitization during web page generation, allowing malicious scripts to be injected and executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the Tor Foundation Columns WordPress plugin, affecting versions through 0.8. This issue arises from improper input sanitization during web page generation, allowing malicious scripts to be injected and executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the HireHive Job Plugin for WordPress, affecting versions through 2.9.0. This vulnerability allows attackers to inject malicious scripts that are executed when users visit the affected site.

A DOM-based cross-site scripting vulnerability has been identified in the WordPress Navigation Du Lapin Blanc plugin, affecting versions through 1.1.1. This vulnerability arises from improper input neutralization during web page generation, allowing malicious actors to inject and execute harmful scripts on the website.

A stored cross-site scripting vulnerability has been identified in the S-DEV SEO WordPress plugin, affecting versions through 1.88. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A cross-site scripting (XSS) vulnerability has been identified in the WordPress Twitter Bootstrap Collapse (Accordion) Shortcode plugin, specifically in versions through 1.0. This issue arises from improper input sanitization during web page generation, allowing for DOM-based XSS attacks. Malicious scripts could be injected and executed in the context of the user's browser.

A DOM-based cross-site scripting vulnerability has been identified in the WordPress WP ViewSTL plugin, affecting versions through 1.0. This issue arises from improper input neutralization during web page generation, allowing malicious actors to inject and execute harmful scripts on the site.

A stored cross-site scripting vulnerability has been identified in the TechnoWich WP ULike WordPress plugin, affecting versions through 4.7.6. This vulnerability allows attackers to inject malicious scripts that are executed when users visit the affected site.

A broken access control vulnerability has been identified in the MagePeople WpTravelly plugin, affecting versions through 1.8.5. This vulnerability allows users to access functionalities that are not properly restricted by access control lists (ACLs), potentially leading to unauthorized actions.

A privilege escalation vulnerability has been identified in the WPExperts User Management plugin for WordPress, affecting versions through 1.2. This vulnerability allows users with low privileges to escalate their rights, potentially leading to full control of the website.

A stored cross-site scripting vulnerability has been identified in the WordPress Posts Footer Manager plugin, affecting versions through 2.1.0. This issue allows for improper neutralization of input, enabling the injection of malicious scripts that could be executed when users visit the site.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the WordPress Build Private Store For WooCommerce plugin, specifically in versions through 1.0. This vulnerability allows attackers to trick users with higher privileges into performing actions they did not intend to.

A missing authorization vulnerability has been identified in the Infomaniak VOD WordPress plugin, specifically in versions through 1.5.9. This vulnerability allows unprivileged users to exploit improperly configured access control, potentially leading to unauthorized actions that require higher privileges.

A stored cross-site scripting vulnerability has been identified in the MojofyWP Product Carousel For WooCommerce – WoorouSell plugin, affecting versions through 1.1.0. This vulnerability allows for improper neutralization of input during web page generation, enabling the injection of malicious scripts that could be executed when guests visit the site.

A stored cross-site scripting vulnerability has been identified in the WordPress SEO Bulk Editor plugin, affecting versions through 1.1.0. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A Server-Side Request Forgery (SSRF) vulnerability exists in the Faizaan Gagan Course Migration for LearnDash plugin, specifically in version 1.0.2. This vulnerability allows attackers to make the server perform requests to arbitrary domains, potentially leading to the exposure of sensitive information from other services running on the system.

A stored cross-site scripting vulnerability has been identified in the AGILELOGIX Free Google Maps WordPress plugin, affecting versions through 1.0.1. This vulnerability allows attackers to inject malicious scripts that are executed when users visit the affected site.

A reflected cross-site scripting vulnerability has been identified in the Gallery Ape Photo Gallery WordPress plugin, affecting versions through 2.2.8. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.