CVE-2022-3383

Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select

The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied input and passes it through call_user_func(). This makes it possible for authenticated attackers, with administrative capabilities, to execute code on the server.

CVSS 3.1 · 7.2 High EPSS 3.1% KEV · Not listed

Vendors

Ultimatemember

Products

Ultimate Member

CVE-2024-4194

Album and Image Gallery plus Lightbox <= 2.0 - Unauthenticated Arbitrary Shortcode Execution

The The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Essentialplugin Wponlinesupport

Products

Album And Image Gallery Plus Lightbox Album And Image Gallery Plus Lightbox

CVE-2024-4037

WP Photo Album Plus <= 8.7.02.003 - Unauthenticated Arbitrary Shortcode Execution

The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.7.02.003. This is due to the plugin allowing unauthenticated users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Opajaap Wppa

Products

Wp Photo Album Plus Wp Photo Album Plus

CVE-2024-11600

Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.6.0 - Authenticated (Administrator+) Remote Code Execution

The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.6.0 via the 'write_config' function. This is due to a lack of sanitization on an imported JSON file. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed

Vendors

Visualmodo

Products

Borderless

CVE-2023-6553

Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server.

CVSS 3.1 · 9.8 Critical EPSS 97.8% KEV · Not listed

Vendors

Backupbliss

Products

Backup Migration

CVE-2023-6494

WPC Smart Quick View for WooCommerce <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wpclever

Products

Wpc Smart Quick View For Woocommerce

CVE-2023-5843

Ads by datafeedr.com <= 1.1.3 - Unauthenticated (Limited) Remote Code Execution

The Ads by datafeedr.com plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.1.3 via the 'dfads_ajax_load_ads' function. This allows unauthenticated attackers to execute code on the server. The parameters of the callable function are limited, they cannot be specified arbitrarily.

CVSS 3.1 · 9 Critical EPSS 2.6% KEV · Not listed

Vendors

Datafeedr

Products

Ads By Datafeedr.com

CVE-2023-5201

OpenHook <= 4.3.0 - Authenticated (Subscriber+) Remote Code Execution via Shortcode

The OpenHook plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.3.0 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server. This requires the [php] shortcode setting to be enabled on the vulnerable site.

CVSS 3.1 · 9.9 Critical EPSS 1.7% KEV · Not listed

Vendors

Rickbeckman

Products

Openhook

CVE-2023-4994

Allow PHP in Posts and Pages <= 3.0.4 - Authenticated (Subscriber+) Remote Code Execution via Shortcode

The Allow PHP in Posts and Pages plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.0.4 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Hitreach

Products

Allow Php In Posts And Pages

CVE-2021-4434

Social Warfare <= 3.5.2 - Remote Code Execution

The Social Warfare plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.5.2 via the 'swp_url' parameter. This allows attackers to execute code on the server.

CVSS 3.1 · 10 Critical EPSS 1.9% KEV · Not listed

Vendors

Warfareplugins

Products

Social Warfare

CVE-2020-36708

Epsilon Framework Themes (Various Versions) - Function Injection

The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.7, MedZone Lite <= 1.2.4, Regina Lite <= 2.0.4, Transcend <= 1.1.8, Affluent <= 1.1.0, Bonkers <= 1.0.4, Antreas <= 1.0.2, Sparkling <= 2.4.8, and NatureMag Lite <= 1.0.4. This is due to epsilon_framework_ajax_action. This makes it possible for unauthenticated attackers to call functions and achieve remote code execution.

CVSS 3.1 · 9.8 Critical EPSS 65.3% KEV · Not listed

Vendors

Colorlib Cpothemes Machothemes

Products

Activello Bonkers Illdy and 13 more

CVE-2024-10970

Motors – Car Dealer, Classifieds & Listing <= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title

The The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.4.43. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Stylemixthemes

Products

Motors - Car Dealer\, Classifieds \& Listing

CVE-2024-7559

File Manager Pro <= 8.3.7 - Authenticated (Subscriber+) Arbitrary File Upload

The File Manager Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in the mk_file_folder_manager AJAX action in all versions up to, and including, 8.3.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Filemanagerpro Filemanagerpro.io

Products

File Manager Pro File Manager Pro

CVE-2024-9846

Enable Shortcodes inside Widgets,Comments and Experts <= 1.0.0 - Unauthenticated Arbitrary Shortcode Execution

The The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Aftabhusain

Products

Enable Shortcodes Inside Widgets\,comments And Experts

CVE-2024-13792

WooCommerce Food - Restaurant Menu & Food ordering <= 3.3.2 - Unauthenticated Arbitrary Shortcode Execution via ids

The WooCommerce Food - Restaurant Menu & Food ordering plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Exthemes

Products

Woocommerce Food

CVE-2024-10261

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.0 - Unauthenticated Arbitrary Shortcode Execution

The The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.13.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Cozmoslabs

Products

Membership \& Content Restriction - Paid Member Subscriptions Paid Member Subscriptions

CVE-2024-8271

FOX – Currency Switcher Professional for WooCommerce <= 1.4.2.1 - Unauthenticated Arbitrary Shortcode Execution

The The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.4.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode in the 'woocs_get_custom_price_html' function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Pluginus Realmag777

Products

Fox - Currency Switcher Professional For Woocommerce Fox-currency Switcher Professional

CVE-2024-10899

WooCommerce Product Table Lite <= 3.8.6 - Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site Scripting

The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The same 'id' parameter is vulnerable to Reflected Cross-Site Scripting as well.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Wcproducttable

Products

Woocommerce Product Table Woocommerce Product Table Lite

CVE-2024-7425

WP All Export Pro <= 1.9.1 - Authenticated (ShopManager+) Arbtirary Options Update

The WP ALL Export Pro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to improper user input validation and sanitization in all versions up to, and including, 1.9.1. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Soflyy

Products

Wp All Export

CVE-2024-8481

Special Text Boxes <= 6.2.4 - Unauthenticated Arbitrary Shortcode Execution

The The Special Text Boxes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.2.4. This is due to the plugin adding the filter add_filter('comment_text', 'do_shortcode'); which will run all shortcodes in comments. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Minimus Simplelib

Products

Special Text Boxes Special Text Boxes