CVE Vulnerability Catalog

The JSON API User plugin for WordPress up to version 4.1.0 is vulnerable to Stored Cross-Site Scripting. An attacker with subscriber-level access or higher can inject malicious scripts via the 'content' parameter of the post_comment API endpoint and self-approve the comment, bypassing moderation.

The MotoPress Appointment Booking plugin for WordPress up to version 2.4.4 contains an authorization bypass vulnerability via user-controlled key. Unauthenticated attackers can overwrite customer data (name, email, phone, customer_id) in unconfirmed victim bookings by exploiting a publicly accessible REST endpoint.

The CM Business Directory plugin for WordPress up to version 1.5.7 is vulnerable to Stored Cross-Site Scripting via Business Address Meta Fields. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access to inject arbitrary web scripts that execute when users visit affected pages.

The Ultimate Member plugin for WordPress is vulnerable to stored XSS via the 'about_me' parameter in versions up to 2.11.4 inclusive due to insufficient input sanitization and output escaping.

The Ninja Forms - File Uploads plugin for WordPress up to version 3.3.29 inclusive contains an authorization bypass vulnerability. Unauthenticated attackers can read all debug log entries stored in the wp_nf3_log table or permanently delete all rows from that table.

The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in all versions up to and including 3.9.30 via the wpie_import_upload_file_from_url AJAX action. After wp_safe_remote_get() fails (blocking private IPs), the plugin falls back to GuzzleHttp\Client::request() with no SSRF protection and disabled TLS verification. This allows authenticated attackers with administrator-level access to make requests to arbitrary internal services, such as cloud metadata endpoints.

An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to send a crafted Intent that causes ASUS Router App to open a specified URL.

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL injection via the 's' parameter in all versions up to and including 4.3.5. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. Authenticated attackers with administrator-level access and above can append additional SQL queries to extract sensitive information from the database.

The weDocs plugin for WordPress up to version 2.3.0 contains a stored XSS vulnerability via the 'connectorWidth' block attribute. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary scripts that execute when a user visits an affected page.

The weDocs plugin for WordPress up to version 2.3.0 contains a stored XSS vulnerability via the 'sectionTitleTag' and 'articleTitleTag' block attributes. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary scripts that execute whenever a user visits an injected page.

The weDocs plugin for WordPress up to version 2.3.0 has a missing authorization vulnerability in the do_migration() function. Authenticated attackers with Subscriber-level access can trigger a data migration from BetterDocs to weDocs, creating and modifying 'docs' custom post type entries and deactivating BetterDocs plugins.

The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container.

The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks.

In WatchGuard Fireware OS on a FireCluster, under exceptional circumstances, a hard-coded encryption key may be used to encrypt saved credentials for Access Portal resources. This vulnerability does not affect devices without Access Portal support or standalone Fireboxes not in a FireCluster.

The SIP Proxy module of WatchGuard Fireware OS is vulnerable to Stored XSS. This is an additional unmitigated attack path for CVE-2025-6947.

A Stored Cross-Site Scripting (XSS) vulnerability was found in the spamBlocker module of WatchGuard Fireware OS due to improper input neutralization during web page generation. This is an additional unmitigated attack vector for the previously disclosed CVE-2025-1071.

Stored XSS vulnerability in the Autotask Technology Integration module of WatchGuard Fireware OS. This is an additional unmitigated attack vector for CVE-2025-13938.

The ConnectWise Technology Integration module of WatchGuard Fireware OS is vulnerable to Stored XSS. This is an additional unmitigated attack path for CVE-2025-13937.

The Tigerpaw Technology Integration module of WatchGuard Fireware OS is vulnerable to Stored XSS. This is an additional unmitigated attack path for CVE-2025-13936.

A vulnerability in the Fireware Management Web UI allows an authenticated administrator to trigger a denial-of-service (DoS) condition by sending crafted data to the put_data endpoint, which performs unsafe deserialization.