CVE Vulnerability Catalog

The WP Job Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'degreetitle' parameter in all versions up to, and including, 2.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of a webmention source URL in versions up to, and including, 5.10.1. This is due to insufficient input sanitization, allowing unauthenticated attackers to inject arbitrary web scripts that execute after an administrator approves the pending webmention comment.

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in all versions up to, and including, 1.2.31. The delete_reviews_image() function trusts attachment IDs supplied via the wcpr_image_upload_id POST parameter stored in comment meta without ownership or capability checks, allowing unauthenticated attackers to permanently delete any WordPress media library attachment.

The Hustle plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.14.3. Due to improper verification of user authorization, authenticated attackers with custom-level access can overwrite the site's active ESP integration credentials (AWeber, Constant Contact, Infusionsoft, ConvertKit, or HubSpot API keys) with attacker-controlled values, diverting lead submissions to the attacker's ESP tenant, and for HubSpot, irreversibly delete OAuth tokens.

The PDF Invoices & Packing Slips for WooCommerce plugin is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoice_number' parameter (via document filename). Unauthenticated attackers can extract another customer's complete invoice PDF, including billing identity, shipping address, private order notes, line items, prices, dates, order ID, and invoice number, delivered directly to the attacker's email as an order confirmation attachment.

The Discussion Board – WordPress Forum Plugin is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 via the user profile Website (user_url) field. Due to insufficient output escaping in the ctdb_filter_comment_author_name() callback, authenticated attackers with subscriber-level access and above can inject arbitrary web scripts that execute when a user accesses a Discussion Board topic containing the attacker's reply.

The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed. This allows unauthenticated attackers to change the payment status of any order in the store regardless of the payment method it was placed with.

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the '__construct' function in all versions up to, and including, 2.20.4. This makes it possible for unauthenticated attackers to delete theme files on the server.

The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export. This allows unauthenticated users to read the content of draft and private posts.

The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page. This allows unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID.

The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser. This could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content.

The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart. This allows them to create orders for any product at an arbitrary total of their choosing.

The NextGEN Gallery plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts created through its registration form. Authenticated users with Author-level access and above can cause newly registered accounts, including those created by unauthenticated visitors, to be granted a higher role such as Editor. This is an incomplete fix of CVE-2026-5193: the role-validation control added in 6.6.0 can be circumvented, so versions 6.6.0 through 6.8.7 remain affected.

The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its stored configuration. Users with the Contributor role and above can view secret payment-gateway API credentials, both live and test secret keys, which grant full access to the site owner's payment account.

The Ninja Forms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.

The Ninja Forms plugin for WordPress (versions up to and including 3.15.5) is vulnerable to arbitrary shortcode execution. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode, enabling unauthenticated attackers to execute arbitrary shortcodes.

The Field Collection module for Drupal 7 (versions 7.x-1.0 through 7.x-1.2) has an improper authorization flaw. field_collection_item_access() grants edit and delete access to any user with the 'edit field collections' permission without verifying access to the host entity.

A vulnerability in secp256k1-native (native C implementation for Ruby) causes GCC 14.3.0, 15.1.0, and 15.2.0 at -O2 to reconstruct branchless selections into conditional jumps (je/jne), leaking timing information about the secret scalar. The flaw affects native builds, not the pure-Ruby path.

In i18next before version 26.3.4, deepExtend in src/utils.js checks property existence with the in operator and recurses into inherited built-ins reached through Object.prototype. If an application explicitly passes attacker-controlled resource data to addResourceBundle with both deep: true and overwrite: true, keys such as hasOwnProperty, toString and valueOf can select shared inherited built-in function objects, and a nested value can overwrite a property of those objects process-wide. For example, making Object.prototype.hasOwnProperty.call non-callable causes subsequent uses, including i18next internals, to throw TypeError, resulting in unrecoverable denial of service and limited integrity impact.