CVE Vulnerability Catalog

The Page Builder by SiteOrigin plugin for WordPress up to version 2.34.3 contains a stored XSS vulnerability via the panels_data parameter. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary scripts that execute when users access the compromised page.

The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activate_plugin function. This allows authenticated attackers with Subscriber-level access or above to activate a limited set of plugins.

The WP Full Stripe Free plugin for WordPress up to version 8.4.3 lacks authorization in the wpfs_update_failed_payment_status AJAX action. Unauthenticated attackers with a valid Stripe Payment Intent ID can manipulate payment records in the database, marking successful payments as failed and overwriting error codes.

The Gutenverse plugin for WordPress is vulnerable to stored XSS via admin settings in all versions up to 3.8.0 due to insufficient input sanitization and output escaping.

The Dokan plugin for WordPress up to version 5.0.4 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'id' parameter. Authenticated attackers with subscriber-level access can read other vendors' products, including unpublished drafts and pending listings.

The Dokan plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Product SKU field in all versions up to and including 5.0.4 due to insufficient input sanitization and output escaping. This allows authenticated attackers with custom-level access or higher to inject arbitrary web scripts that execute when users access affected pages.

The Masteriyo LMS plugin for WordPress up to version 2.2.1 contains an authorization bypass vulnerability. Authenticated attackers with student-level access or higher can modify the content of course announcements created by instructors or administrators.

The Surbma | Infusionsoft Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.0.1. This is due to insufficient input sanitization and output escaping on the 'account' and 'id' shortcode attributes, which are concatenated directly into a <script> tag's src attribute. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute whenever a user visits an injected page.

The Product Specifications for WooCommerce plugin for WordPress up to version 0.8.9 is vulnerable to unauthorized data modification, creation, and deletion. This is due to missing capability checks and nonce verification in the __invoke() methods of the AttributeGroupController and AttributeController classes, allowing authenticated attackers with Subscriber-level access or higher to manipulate product specification groups and attributes.

The Shariff for WordPress plugin through version 1.0.11 does not sanitize or escape the shariff_infourl setting before outputting it in the frontend HTML via the generateshariff() function. This allows high-privilege users such as administrators to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).

The MaxButtons plugin for WordPress up to version 9.8.5 is vulnerable to Reflected Cross-Site Scripting via the 'view' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts.

The NEX-Forms plugin for WordPress up to version 9.2.2 contains an authorization bypass vulnerability. Unauthenticated attackers can enumerate sequential report IDs and download complete form submission data, including names, email addresses, phone numbers, postal addresses, payment details, and uploaded file paths.

The HD Quiz plugin for WordPress versions 2.2.0 to 2.2.1 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation in the hdq_validate_nonce function. Unauthenticated attackers can exploit this to delete or modify quizzes and questions, create new quizzes, and change plugin settings by tricking a site administrator into performing an action like clicking a link.

The Post Map for Google Maps plugin for WordPress up to version 1.2.6 is vulnerable to Stored Cross-Site Scripting via the 'cpm_point' Post Meta due to insufficient input sanitization and output escaping.

The Groundhogg plugin for WordPress (versions up to 4.5.5) is vulnerable to generic SQL injection via the 'query[select]' parameter. Insufficient escaping and lack of prepared statements allow authenticated attackers with Sales Representative-level access or higher to append additional SQL queries, potentially extracting sensitive database information.

The Groundhogg plugin for WordPress (CRM, newsletters, and marketing automation) in versions up to and including 4.5.5 is vulnerable to generic SQL injection via the 'search' parameter. This is due to insufficient escaping of user-supplied input and lack of proper preparation of SQL queries.

The Ivory Search WordPress plugin up to version 5.5.15 is vulnerable to stored XSS via the 'menu_title' and 'menu_magnifier_color' settings due to insufficient input sanitization and output escaping.

A vulnerability in HCL Traveler for Microsoft Outlook (HTMO) allows unauthorized access to sensitive application data, which could be exploited by an attacker to launch further attacks and cause unexpected application behavior.

In Kestra prior to versions 1.0.45 and 1.3.21, the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{executionId}/file/preview) contains an access control bypass that allows any authenticated user to read output files from any other execution within the same tenant, bypassing execution-level and namespace-level isolation.

A stored cross-site scripting (XSS) vulnerability in Koha Library Management System versions 0 through 25.11 allows an authenticated remote attacker with admin privileges to inject arbitrary scripts via the item type check-in message field.