CVE Vulnerability Catalog

The WP Directory Kit plugin for WordPress (up to and including 1.6.0) is vulnerable to generic SQL Injection via the 'idfield' parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. An unauthenticated attacker can append additional SQL queries into already existing queries to extract sensitive information from the database.

The WP Activity Log plugin for WordPress (versions up to and including 5.6.1) is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page.

A flaw was found in konflux-ci that allows privilege escalation when the user interface proxy automatically disables TLS certificate verification for connections to internal backend services in environments lacking a default service certificate authority. Because the proxy attaches a cluster-scoped authentication token with user impersonation rights to these requests, an adjacent network attacker capable of intercepting traffic can capture the credentials to gain full administrative control of the cluster.

A flaw was found in konflux-ci that allows an attacker with repository write access to achieve arbitrary code execution within the CI/CD workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest synchronization scripts to dynamically evaluate unvalidated script output. Successful exploitation allows compromise of CI/CD pipelines, theft of sensitive authentication tokens and deployment credentials, and unauthorized access to production systems.

A flaw was found in konflux-ci that allows an attacker with permission to trigger automated workflow runs to cause information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing injection of malicious filter commands. As a result, sensitive information such as API credentials, deployment keys, and internal notes may be exposed in workflow logs.

A flaw was found in konflux-ci where CI automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potentially allowing them to modify source code or release artifacts.

The FeedWordPress plugin for WordPress (versions up to and including 2026.0517) is vulnerable to Stored Cross-Site Scripting via syndicated RSS/Atom feed content. The SyndicatedPost::sanitize_content() function only strips the 'target' attribute, and SyndicatedPost::insert_post() deliberately removes WordPress's wp_filter_kses and wp_filter_post_kses filters before persisting imported feed items. This allows unauthenticated attackers who control an external feed that a site has already subscribed to to inject arbitrary web scripts into pages.

The User Frontend plugin for WordPress (up to 4.3.13) is vulnerable to Privilege Escalation via the 'post_content' parameter in submit_post(). A control byte can bypass the shortcode blocklist, allowing injection of a registration shortcode with 'editor' role. This lets authenticated attackers with Subscriber-level access create an Editor account.

The Shield Security plugin for WordPress (up to 22.3.2) is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI' parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user visits an injected page. The hidden 'path' column in ForTraffic.php is unescaped, enabling the attack.

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress (up to 6.2) is vulnerable to Stored Cross-Site Scripting via the 'Subject' parameter (e.g., from CF7). Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user visits an injected page. The payload is stored without authentication via any mail-sending feature when Graph Mailer is enabled but OAuth authorization is not completed.

The Rox Appointment Booking plugin for WordPress (up to 1.3.1) is vulnerable to Privilege Escalation via Mass Assignment. The public REST endpoint allows unauthenticated attackers to persist an arbitrary WordPress user ID (wp_user_id) with a controlled email address. When an administrator opens and saves the customer record, the administrator's email is overwritten, enabling account takeover.

The Wp Social Login and Register Social Counter plugin for WordPress (up to 3.2.2) is vulnerable to Authentication Bypass. The social login REST callback locates an account by the email returned from the OAuth provider and sets an authentication cookie without a password check, while the only verification guard is a no-op for bundled Facebook and Twitter adapters. This allows unauthenticated attackers to obtain a session as any user, including Administrators, if they control an OAuth account with a matching email.

The Mail logging & Catcher plugin for WordPress in versions up to and including 2.2.0 is vulnerable to Sensitive Information Exposure via the 'message' parameter. An authenticated attacker with subscriber-level access or above can extract valid administrator password-reset keys from stored email logs and complete the password-reset flow to escalate to administrator.

The FunnelKit Automations plugin for WordPress and WooCommerce in versions up to and including 3.8.5.2 is vulnerable to time-based SQL Injection via the 'bwfan_cart_id' parameter. An unauthenticated attacker can inject additional SQL queries during a guest checkout, with the injection firing when a scheduled Action Scheduler job later reloads the stored meta.

The User Submitted Posts plugin for WordPress in versions up to and including 20260916 is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'user-submitted-content' parameter. An unauthenticated attacker can inject arbitrary web scripts that execute when a user accesses an injected page.

The ThirstyAffiliates plugin for WordPress in versions up to and including 3.12.1 is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter. An unauthenticated attacker can inject arbitrary web scripts that execute when a user accesses an injected page.

The Shipping Zones by Drawing for WooCommerce plugin in versions up to and including 3.3.0 is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter. An unauthenticated attacker can inject arbitrary attributes into the Google Maps link in the admin order view, executing when an administrator opens the order.

The Welcart e-Commerce plugin for WordPress in versions up to and including 2.12.5 is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter. An unauthenticated attacker can inject arbitrary web scripts that execute when an administrator opens the order in the WordPress admin panel.

The VikRentCar Car Rental Management System plugin for WordPress in versions up to and including 1.4.10 is vulnerable to Stored Cross-Site Scripting via the 'optionals' parameter. An unauthenticated attacker can inject arbitrary web scripts that execute when a user accesses an injected page.

The Relevanssi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in versions up to 4.28.5 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. This requires comment indexing and highlighting enabled, and the payload fires when a visitor reaches a singular page via a Relevanssi search-result permalink with the highlight query parameter.