CVE Vulnerability Catalog

The LearnPress – Backup & Migration Tool plugin for WordPress up to version 4.1.4 is vulnerable to PHP object injection via deserialization of untrusted input. Exploitation requires administrator access and a POP chain in another installed plugin or theme.

The LearnPress – Backup & Migration Tool plugin for WordPress up to version 4.1.4 is vulnerable to arbitrary file read via directory traversal through the 'import-user-file' parameter. Authenticated attackers with administrator-level access and above can read the contents of arbitrary files on the server, which may contain sensitive information.

The Quick Playground plugin for WordPress up to version 1.3.4 has a path traversal vulnerability in the qckply_data() function, which passes the filename parameter directly to file_get_contents() without validation, allowing authenticated administrators to read arbitrary files on the server.

The Master Addons For Elementor plugin for WordPress up to version 3.1.0 is vulnerable to Stored Cross-Site Scripting via the 'jtlma_custom_js' Page Setting due to insufficient input sanitization and output escaping.

The Page-list plugin for WordPress versions up to and including 6.2 has an authorization vulnerability. The pagelist_unqprfx_ext_shortcode() function accepts attacker-controlled post_status, post_type, and show_meta_key attributes and passes them to get_pages() and get_post_meta() without capability checks. This allows authenticated attackers with contributor-level access or above to disclose titles, content, and metadata of private and draft pages by inserting the shortcode into their draft and previewing it.

The LatePoint – Calendar Booking Plugin for WordPress is vulnerable to CSRF in all versions up to 5.6.0. Missing nonce validation on the change_status function allows unauthenticated attackers to change the status of arbitrary invoices via a forged request.

The RSS Aggregator by Feedzy plugin for WordPress up to version 5.1.7 contains an authorization bypass vulnerability. Lack of permission verification allows users with Contributor access and above to create and execute RSS import jobs, delete posts, clear error logs, and enumerate taxonomy terms and meta keys. The nonce is leaked in the feedzyjs script.

The Simple SEO Slideshow plugin for WordPress up to version 1.2.8 has a stored XSS vulnerability via shortcode attributes. Authenticated attackers with contributor-level access can inject arbitrary scripts that execute on every page visit. WordPress KSES does not strip malicious shortcode attribute values on post save.

The Express Payment For Stripe plugin for WordPress up to version 1.28.0 has a stored XSS vulnerability via the 'type' attribute of the [stripe-express] shortcode. The attribute value is concatenated into an HTML attribute without esc_attr(), allowing authenticated attackers with contributor-level access to inject arbitrary scripts.

The Event Monster plugin for WordPress up to version 2.1.0 has a vulnerability due to insufficient verification of data authenticity. The capture_payment() AJAX handler trusts client-supplied payment data (including transaction ID, amount, and status) without server-side verification against PayPal API or any payment gateway, and without nonce or capability checks. This allows unauthenticated attackers to forge payment records, mark bookings as Completed, and receive confirmation emails with valid QR code tickets without making any payment.

Missing nonce validation in the funp_ajax_modify_notes function of the Frontend User Notes plugin for WordPress allows CSRF attacks. An unauthenticated attacker can trick a logged-in user into visiting a malicious page, causing unauthorized overwriting of that victim's own note content via a forged request to wp_update_post().

The Quiz and Survey Master (QSM) plugin for WordPress up to version 11.1.2 is vulnerable to time-based blind SQL injection via the 'order' parameter. An authenticated attacker with admin privileges can append additional SQL queries and extract sensitive data from the database.

An authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper handling of externally supplied parameters within formatting functions. An attacker may inject crafted format strings into event subscription requests or notification generation path to disrupt normal service execution. Successful exploitation may cause the event notification service to terminate unexpectedly, resulting in loss of real-time alarm functionality and disruption of event notifications.

Format string vulnerability in the ONVIF AddScopes function in Tapo C520WS v2. User-controlled input is improperly passed to formatting functions. An attacker can inject format specifiers, causing the ONVIF service to crash and resulting in DoS.

The Tapo C520WS v2 device has a stack-based buffer overflow vulnerability in the ONVIF DeleteUsers service due to insufficient boundary checks when handling multiple user deletion parameters. An authenticated attacker can send a crafted request with an excessive number of identifiers to overflow stack memory.

A stack-based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF CreateUsers service, where the device fails to properly validate the number of XML user nodes during request processing. An authenticated attacker can send a specially crafted ONVIF request containing an excessive number of user entries to trigger memory corruption.

The Charitable – Donation Plugin for WordPress up to version 1.8.11.1 contains an Insecure Direct Object Reference (IDOR) vulnerability in the profile avatar update flow. The save_avatar() function deletes an attachment based on ID from the 'avatar' meta without ownership verification, and process_picture() returns raw values, allowing meta poisoning and arbitrary attachment deletion. Attack requires Subscriber-level access or higher.

The Alba Board plugin for WordPress up to version 2.1.3 has an authorization bypass vulnerability – it does not properly verify user permissions. Authenticated attackers with subscriber-level access can read private alba_card data (title, description, assignee, due date, tags, comments) intended only for Administrators and Editors. Additionally, the handler is registered via wp_ajax_nopriv_ and the nonce is exposed on pages with the [alba_board] shortcode, allowing unauthenticated users to exploit it as well.

Vulnerability in the IDNA library for Python (versions prior to 3.15) to DoS via specially crafted domains. Payloads like `"\u0660" * N` or `"\u30fb" * N + "\u6f22"` use the `valid_contexto` function before length rejection, causing long processing times for high N. This is similar to CVE-2024-3651 but the original fix was incomplete. Version 3.14 introduced early rejection of long inputs, and 3.15 extended this to other functions. A workaround is to enforce a 253-character limit before passing the domain to `idna.encode()`.

HAX CMS versions prior to 26.0.0 have an improper session termination vulnerability where authentication tokens remain valid after user logout. Attackers with valid tokens can maintain persistent access to CMS functionality, bypassing session termination.