Chamber Dashboard Business Directory Vulnerabilities

[en] The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to unauthorized data export due to a missing capability check on the cdash_watch_for_export() function in all versions up to, and including, 3.3.11. This makes it possible for unauthenticated attackers to export business directory informat...

Affected:

up to 3.3.11

Fix:

No patched version reported

Disclosed:

Nov 25, 2025

CVE-2025-13414 on NVD →

The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to unauthorized data export due to a missing capability check on the cdash_watch_for_export() function in all versions up to, and including, 3.3.11. This makes it possible for unauthenticated attackers to export business directory information,...

CVSS:

5.3

Affected:

up to 3.3.11

Fix:

No patched version reported

Disclosed:

Nov 24, 2025

CVE-2025-13414 on NVD →

The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary...

CVSS:

6.4

Affected:

up to 3.3.11

Fix:

No patched version reported

Disclosed:

Apr 4, 2025

CVE-2025-32162 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Morgan Kay Chamber Dashboard Business Directory allows DOM-Based XSS. This issue affects Chamber Dashboard Business Directory: from n/a through 3.3.11.

Affected:

up to 3.3.11

Fix:

No patched version reported

Disclosed:

Apr 4, 2025

CVE-2025-32162 on NVD →

The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cdash_add_demo_data() function in versions up to, and including, 3.3.10. This makes it possible for authenticated attackers, with subscriber-level access and above, t...

CVSS:

4.3

Affected:

up to 3.3.10

Fixed in:

3.3.11

Disclosed:

Jan 16, 2025

CVE-2025-23917 on NVD →

[en] The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'business_categories' shortcode in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Affected:

up to 3.3.10

Fixed in:

3.3.10

Disclosed:

Jan 16, 2025

CVE-2024-11452 on NVD →

[en] Missing Authorization vulnerability in Chandrika Guntur, Morgan Kay Chamber Dashboard Business Directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chamber Dashboard Business Directory: from n/a through 3.3.8.

Affected:

up to 3.3.11

Fixed in:

3.3.11

Disclosed:

Jan 16, 2025

CVE-2025-23917 on NVD →

The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'business_categories' shortcode in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authe...

CVSS:

6.4

Affected:

up to 3.3.8

Fixed in:

3.3.10

Disclosed:

Jan 15, 2025

CVE-2024-11452 on NVD →

The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to Cross-Site Scripting in versions before 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

CVSS:

6.1

Affected:

up to 3.3.1

Fixed in:

3.3.1

Disclosed:

Aug 31, 2020

CVE-2020-24699 on NVD →

[en] The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS.

Affected:

up to 3.3.1

Fixed in:

3.3.1

Disclosed:

Aug 31, 2020

CVE-2020-24699 on NVD →

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 3.3.2

Fixed in:

3.3.2

CVE-2023-33999 on NVD →