CVE Vulnerability Catalog

The VikRentCar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'poplink' parameter in versions up to 1.4.9 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. The handler requires only a WordPress nonce (vikwp_nonce), which the plugin emits to unauthenticated visitors on the public booking-confirmation page.

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in versions up to 2.10.7 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. Exploitation requires a previously active Pro license with REST caching enabled that has since become inactive while Disk Enhanced page caching remains configured, and the attacker must hold a previously approved commenter identity.

The PDF Invoices & Packing Slips for WooCommerce plugin is vulnerable to Stored Cross-Site Scripting via the 'billing_address.first_name / last_name / company, customer_note' parameters in versions up to 5.16.4 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. This is an incomplete fix for CVE-2026-92244: the wp_kses() allow-list introduced in 5.16.2 correctly blocks raw-tag payloads but is bypassed by entity-encoded payloads (e.g., <img onerror=…>) that contain no literal angle-bracket characters and are therefore passed through unmodified before the trailing decode rematerializes them.

The SureCart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in versions up to 4.9.4 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. Successful execution requires the injected comment to be visible on a page that loads SureCart's web-component bundle (e.g., a page containing a SureCart Buy Button block), and the comment must be auto-approved or approved by a moderator.

WordPress Core versions 4.7 through 7.1.3 are vulnerable to Remote Code Execution due to predictable, web-accessible staging paths used during full-package core upgrades. This allows unauthenticated attackers to execute code on the server during the upgrade window.

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data. This allows unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the plugin's stored settings.

The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login. This allows an attacker who already knows a user's password to brute force the second factor and take over the account.

The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server. This allows users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls and disclose protected files.

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / shortcode attribute desc_below_form (and placeholder as the marker-smuggling helper)' parameter in all versions up to, and including, 1.9.26 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData.extra' parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5.6.4 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

A command injection vulnerability in the Orchestrator component of SoftIron HyperCloud allows an authenticated user with management plane access to execute arbitrary operating system commands on hypervisor hosts as the privileged orchestration user. Attacker-controlled virtual machine template content (e.g., the VM DESCRIPTION field) is delivered to hosts through a shell here-document whose terminator is not quoted, enabling shell expansion and here-document terminator injection during VM lifecycle operations such as deploy, migrate, and network setup. The issue affects versions 1.0 through 2.6.17 and is fixed in 2.6.18.

The File Force Download module for Drupal 7 versions 7.1.0 through 7.1.2 returned Content-Disposition headers without access checks for files outside the private scheme. An unauthenticated visitor could retrieve files in the temporary:// scheme or other stream wrappers by appending download=1 to the URL.

In Shopify App (Rails engine) from 22.1.0 until 23.0.3, token-exchange authenticated controllers can expose a request-derived shop context instead of the identity from a verified Shopify ID token or active session. current_shopify_domain can resolve to the sanitized shop query parameter, so a request authenticated for one shop can be treated as another requested shop.

In Coop prior to 1.0.2, the SAML strategy verify callback resolved the authenticated user by email alone using kyselyUserFindByEmail, without binding the lookup to the organization in /saml/login/:orgId/callback. An attacker who administers an organization and controls its SAML IdP signing key can submit an assertion for a victim email to another organization's callback when that target organization has registered the same signing certificate.

In Coop prior to 1.0.0, an unauthenticated actor can query Query.allOrgs through /api/v1/graphql on a publicly accessible deployment and obtain data for all organizations, including IDs, names, email addresses, website URLs and on-call alert email addresses. The usersWhoCanReviewEveryQueue field also exposes reviewing users' IDs, email addresses, names, roles, permissions and creation dates.

In OpenSearch SQL in the 2.x line from 2.8.0.0 until 2.19.6.0 and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted cursor parameter to the plugins/sql endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server.

In TAKO AI Agent for Okta prior to 3.0.1-beta, any authenticated user with a valid fctr_session cookie can submit arbitrary Python source in the script_code field of POST /api/react/execute-script without administrator privilege. The source is stored with skip_discovery=True, bypasses validate_generated_code (e.g. via dynamic getattr chains through __builtins__) and is executed by asyncio.create_subprocess_exec() as the application process user, root by default in the container.

In Refitter prior to 2.1.2, the header parameter name in parameters[].name with in: header is emitted verbatim into a Refit [Header("<name>")] attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass default validation without --skip-validation and break out of the parameter-list position, generating valid C# with a file class and [ModuleInitializer] method that executes attacker code when the compiled assembly is loaded.

Refitter prior to 2.1.2 emits OpenAPI `paths` object keys verbatim into Refit route attributes without escaping quotation marks. A crafted single-line, slash-prefixed path can close the attribute, interface, and namespace and inject a top-level class with a `[ModuleInitializer]` method that executes attacker code when the generated assembly is loaded. The issue is fixed in version 2.1.2.