CVE Vulnerability Catalog

The Essential Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar widget in all versions up to and including 6.6.2 due to insufficient input sanitization and output escaping on event titles sourced from The Events Calendar.

The User Frontend plugin for WordPress versions up to 4.3.1 contains an Insecure Direct Object Reference (IDOR) vulnerability in the payment_page() function. Missing validation on the 'user_id' parameter allows unauthenticated attackers to activate a free subscription pack for any user, overwriting their existing paid subscription and causing loss of paid features.

The Smash Balloon Social Photo Feed – Easy Social Feeds plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 6.11.1. Missing or incorrect nonce validation in the maybe_connection_data function allows unauthenticated attackers to overwrite the site's Instagram and Facebook oEmbed access tokens.

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'additional' parameter in all versions up to and including 2026.1 due to insufficient input sanitization and output escaping.

A stored cross-site scripting (XSS) vulnerability has been discovered in Limatek System Inc. LimRAD NAC due to improper input neutralization during web page generation. This flaw allows an attacker to inject malicious scripts that execute in other users' browsers.

The Themehunk Login Registration plugin for WordPress up to version 1.0.2 allows privilege escalation. Unauthenticated attackers can create accounts with the editor role when public registration is enabled by manipulating the 'role' parameter in a REST request.

The Recurio – Ultimate Subscription for WooCommerce plugin up to version 1.1.3 is vulnerable to generic SQL injection via the 'data' parameter due to insufficient escaping and lack of query preparation. Authenticated attackers with shop manager-level access or higher can append additional SQL queries to extract sensitive information.

The Website Builder by SeedProd plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the `seedprodnestedmenuwidget` shortcode. This vulnerability affects all versions up to and including 6.20.2 due to insufficient input sanitization and output escaping on user-supplied attributes.

A vulnerability in Nomysem software from NOMYSOFT Informatics Education and Consulting Inc. exposes sensitive information due to incompatible policies. The flaw allows accessing functionality not properly constrained by ACLs. This issue affects versions up to 08072026.

The vulnerability in a PDF parser allows injection of malicious external XML entities that point to local paths. An attacker can access any local files within the user's permission range.

The PRC file header parsing logic trusts the constructed file structure description information, assumes that the underlying array contains elements and reads them, leading to out-of-bounds reads and application crashes.

During PRC parsing, there is a lack of boundary verification for the entity index, leading to an out-of-bounds read of the entity array. This causes the application to crash.

The application opens a PDF containing an abnormal color space whose attributes reference a valid but semantically malformed function. The function's output is not validated; when subsequently read, it produces an illegal pointer that accesses an out-of-bounds region, crashing the application.

A vulnerability in the renderer causes an abnormal image object to enter the wrong processing branch, leading to the use of an invalid image buffer pointer during scan line conversion, resulting in application crash.

During page opening and form formatting, a JavaScript reentrancy causes an inconsistent document status. Using outdated page information, the application attempts to access invalid addresses, leading to a crash.

The vulnerability in a PDF viewing application occurs when JavaScript performs operations on the page and document, causing page-related objects to lose synchronization. The renderer still trusts the outdated page count, leading to out-of-bounds access and application crash.

The Wp Js Detect plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0.9. Missing nonce validation in the plugin_settings function allows unauthenticated attackers to update notification text and CSS settings, injecting unsanitized content echoed on the frontend. The attack requires tricking a site administrator into clicking a link.

The Bulk Order Update for WooCommerce plugin for WordPress up to version 1.6 is vulnerable to arbitrary file read. Unauthenticated attackers can read the first line of any file on the server, such as /etc/passwd, via the bouw_fetch_csv_data() AJAX handler.

The User Management plugin for WordPress up to version 1.2 inclusive contains an authorization bypass vulnerability. Unauthenticated attackers can modify the export field configuration stored in the uiewp_export_field option, controlling which user fields (e.g., password hashes) are included in CSV exports and how columns are mapped during imports.

The Chatra Live Chat + ChatBot + Cart Saver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 1.0.12 due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts that execute when users access affected pages.