CVE Vulnerability Catalog

Missing nonce validation in the msp-options.php script of the WP Meta Sort Posts plugin for WordPress allows CSRF attacks. An unauthenticated attacker can change plugin settings (msp_loop_file and msp_nav_location) via a forged request if they trick an admin into clicking a link.

The WP Emoticon Rating plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.1. Missing nonce validation allows unauthenticated attackers to update settings and inject malicious web scripts via a forged request, provided they trick a site administrator into clicking a link.

Missing nonce validation in the handleSaveGeneralSettings function of the WpMobi plugin for WordPress allows CSRF attacks. An unauthenticated attacker can modify General Settings and inject arbitrary web scripts into the admin's browser via the reflected app_name attribute, even if validation fails.

The WP-Ultimate-Map plugin for WordPress in versions up to and including 1.1 is vulnerable to Cross-Site Request Forgery. Missing nonce validation on process_init() allows unauthenticated attackers to change plugin settings (zoom-level, focus-lat, focus-lng, sel_places, sel_routes) and inject arbitrary web scripts via a forged request, provided they trick an admin into clicking a link. Additionally, the zoom-level value is stored unsanitized and later echoed into an HTML attribute and inline JavaScript without escaping.

The FastPicker plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0.2. Missing nonce validation in the settingsPage function allows unauthenticated attackers to modify plugin settings, including toggling webhook integration and changing FastPicker and KDZ API URLs.

The AJAX Report Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 2.0.4. Missing nonce validation in the rc_options_page function allows unauthenticated attackers to modify plugin settings, including link text, markup, messages, comment threshold, cookie duration, reporter-comment toggle, and notification email details.

The kk blog card plugin for WordPress is vulnerable to Stored XSS via the 'blog-card' shortcode up to version 1.3. The 'href' and 'type' attributes are not properly sanitized, allowing authenticated attackers with contributor-level access or higher to inject arbitrary scripts.

The Global Body Mass Index Calculator plugin for WordPress up to version 1.2 is vulnerable to Stored XSS via the 'gbmicalc' shortcode. The GBMI_Calc_Widget::widget() function uses @extract($args) and echoes shortcode attributes unescaped into HTML style and body contexts.

The WP ApplicantStack Jobs Display plugin for WordPress up to version 1.1.1 is vulnerable to Stored XSS via shortcode attributes due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary scripts.

The RomanCart Ecommerce plugin for WordPress up to version 2.0.8 is vulnerable to Stored XSS via the 'blclass' attribute (and others) of the romancart_button shortcode. The romancart_button_shortcode() function lacks proper input sanitization and output escaping.

The Extra Settings for RocketChat plugin for WordPress up to version 0.1 is vulnerable to Stored XSS via the 'title' attribute of the 'rocketchat' shortcode. The rxstg_shortcode() function lacks input sanitization, allowing authenticated attackers with contributor-level access or higher to inject scripts.

The Helpfulcrowd Product Reviews plugin for WordPress up to version 1.2.9 contains an Authorization Bypass via PHP Type Juggling. The helpfulcrowd_validate_token() function uses a loose comparison operator (!=) instead of strict (!==) when validating the token parameter, and the REST route /wp-json/helpfulcrowd/v1/update-settings is registered with permission_callback set to __return_true, making it reachable by unauthenticated users. Submitting a JSON boolean true as the token value causes PHP's loose comparison to evaluate as equal to the non-empty base64-encoded secret string, bypassing the check entirely. This allows unauthenticated attackers to invoke helpfulcrowd_settings_endpoint() and write arbitrary attacker-controlled key-value pairs directly into the helpfulcrowd_options WordPress database option via update_option() without sanitization or allowlist filtering, enabling full unauthenticated modification of the plugin's stored configuration.

The ePaperFlip Publisher plugin for WordPress up to version 1 is vulnerable to Stored XSS via the 'publicationid' attribute of the 'epaperflip_embed' shortcode. The attribute is injected directly into inline JavaScript without proper sanitization or escaping.

Permission control vulnerability in the file preview module. Successful exploitation may affect service confidentiality.

Permission control vulnerability in the print module. Successful exploitation may affect integrity and confidentiality.

Permission control vulnerability in the clone module. Successful exploitation may affect service confidentiality.

Permission management vulnerability in the network management module. Successful exploitation may affect service integrity.

Spring Framework versions 7.0.0 through 7.0.7 and 6.2.0 through 6.2.18 are vulnerable to Server-Side Request Forgery (SSRF) due to incorrect host parsing in UriComponentsBuilder. Applications relying on UriComponentsBuilder to parse and validate external URLs may be exposed to sending requests to internal resources.

Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, and 5.3.0-5.3.48.

Applications accepting user-supplied SpEL expressions may be vulnerable to DoS if evaluation triggers unbounded cache growth. Affects Spring Framework versions 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, 5.3.0-5.3.48.