Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 33

Export CSV
CVE-2024-10777

AnyWhere Elementor <= 1.2.11 - Authenticated (Contributor+) Post Disclosure

The AnyWhere Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.11 via the 'INSERT_ELEMENTOR' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpvibes
Products
Wordpress Anywhere Elementor
CVE-2024-5325

Form Vibes <= 1.4.10 - Authenticated (Subscriber+) SQL Injection via fv_export_data

The Form Vibes plugin for WordPress is vulnerable to SQL Injection via the ‘fv_export_data’ parameter in all versions up to, and including, 1.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wpvibes
Products
Form Vibes
CVE-2024-5309

Form Vibes – Database Manager for Forms <= 1.4.12 - Missing Authorization in Multiple Functions

The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the fv_export_csv, reset_settings, save_settings, save_columns_settings, get_analytics_data, get_event_logs_data, delete_submissions, and get_submissions functions in all versions up to, and including, 1.4.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform multiple unauthorized actions. NOTE: This vulnerability is partially fixed in version 1.4.12.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wpvibes
Products
Form Vibes
CVE-2023-3088

WP Mail Log <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting via Email

The WP Mail Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wpvibes
Products
Wp Mail Log
CVE-2024-1358

Elementor Addon Elements <= 1.12.12 - Directory Traversal to Local File Inclusion

The Elementor Addon Elements plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.12.12 via the render function. This makes it possible for authenticated attackers, with contributor access or higher, to include the contents of arbitrary PHP files on the server, which may expose sensitive information.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Webtechstreet Wpvibes
Products
Elementor Addon Elements Anywhere Elementor
CVE-2021-24767

Redirect 404 Error Page to Homepage or Custom Page with Logs < 1.7.9 - Log Deletion via CSRF

The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow attacker to make a logged in admin delete them via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wpvibes
Products
Redirect 404 Error Page To Homepage Or Custom Page With Logs
CVE-2022-3764

Form Vibes < 1.4.5 - Admin+ SQLi

The plugin does not filter the "delete_entries" parameter from user requests, leading to an SQL Injection vulnerability.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wpvibes
Products
Form Vibes
CVE-2023-0443

AnyWhere Elementor < 1.2.8 - Freemius API Key Disclosure

The AnyWhere Elementor WordPress plugin before 1.2.8 discloses a Freemius Secret Key which could be used by an attacker to purchase the pro subscription using test credit card numbers without actually paying the amount. Such key has been revoked.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wpvibes
Products
Anywhere Elementor
CVE-2023-5672

WP Mail Log < 1.1.3 – Contributor+ LFI in wml_logs/send_mail endpoint

The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion, and allowing an attacker to leak the contents of arbitrary files.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wpvibes
Products
Wp Mail Log
CVE-2023-5674

WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs/send_mail endpoint

The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.

CVSS 3.1 · 8.8 High EPSS 10.8% KEV · Not listed
Vendors
Wpvibes
Products
Wp Mail Log
CVE-2023-5673

WP Mail Log < 1.1.3 – Contributor+ Arbitrary File Upload to RCE

The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file extensions uploading files to attach to emails, allowing attackers to upload PHP files, leading to remote code execution.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Wpvibes
Products
Wp Mail Log
CVE-2023-5645

WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs endpoint

The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wpvibes
Products
Wp Mail Log
CVE-2023-5644

WP Mail Log < 1.1.3 – Incorrect Authorization in REST API Endpoints

The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Wpvibes
Products
Wp Mail Log