CVE Vulnerability Catalog

The Ak Framework plugin for WordPress (included in the Newsy theme) up to 2.9.8 is vulnerable to privilege escalation due to missing capability checks in the ajax_refresh_nonce and ak_admin_ajax handlers before passing attacker-controlled option names and values to update_option(). An unauthenticated attacker can update arbitrary WordPress options, including users_can_register and default_role, to gain administrator privileges.

The Independent Analytics Pro plugin for WordPress up to 2.15.5 is vulnerable to stored cross-site scripting via the 'utm_campaign' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when a user visits an injected page. Exploitation requires the Pro build to be active, and the attacker must first visit a frontend page to obtain a signed payload, then replay it with a crafted utm_campaign against the /iawp/search endpoint.

The JS Help Desk plugin for WordPress (versions up to and including 5.0.1) is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function. An authenticated attacker with administrator-level access can delete arbitrary files on the server, potentially leading to remote code execution if a critical file such as wp-config.php is deleted. Exploitation requires a two-step sequence: saving a traversal-crafted value in the support_custom_img configuration field, then triggering deletion by uploading a new support custom image.

The Redux Framework plugin for WordPress (versions up to and including 4.5.15) is vulnerable to stored cross-site scripting via the multi_media field. The field's renderer prints the stored value into an href attribute, a hidden input value, and an HTML element without escaping, and user_meta_save() checks permissions against a user ID from the request body, allowing a Subscriber to write a field declared for manage_options. An authenticated attacker with Subscriber-level access can inject arbitrary scripts into their own profile that execute when an administrator views that profile.

The Ad Inserter plugin for WordPress (versions up to and including 2.8.19) is vulnerable to arbitrary shortcode execution because it allows users to execute an action without properly validating a value before running do_shortcode. An unauthenticated attacker can execute arbitrary shortcodes. Exploitation requires an administrator to have configured an ad block containing a dynamic tag such as {title}, {tag}, {category}, or {smart-tag} with display enabled on search pages.

The Database Cleaner plugin for WordPress in versions up to and including 1.4.7 does not restrict which database tables can be deleted. An authenticated attacker with Administrator-level access can delete core WordPress tables.

Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine allows Cross Site Request Forgery.This issue affects AI Engine: from n/a through 3.8.8.

Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.

Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, allowing anonymous callers to perform configuration-mutating operations such as logging out the Plex integration, persisting an attacker-selected API key, binding an attacker-controlled Plex account token, and other `write_config()` operations. Missing OAuth state validation and attacker-controlled server URLs further enable server-side request forgery and credential exposure.

In Frappe Learning Management System (LMS) prior to version 2.54.2, unpublished certificate records can be retrieved and viewed by users who should not have access. This can expose certificate details belonging to other users. The issue does not allow modifying data or gaining elevated privileges.

In Frappe Learning Management System (LMS) prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a REST bypass, an authenticated student can record a passing or perfect quiz result without their answers being verified, unlocking course completion and certificates. The student can also create a submission attributed to another user, exhausting that user's allowed attempts.

Prior to version 1.6.4, `Product (Artikel)` and `Category` management store the `name` parameter without adequate backend sanitization and render raw database strings through unescaped Blade output in dynamic table cells, including `article/index.blade.php` and `category/index.blade.php`. An authenticated attacker can save malicious input through product creation or category forms. When another user, including a worker or administrator, opens the corresponding product sheet, category listing or dashboard, the stored JavaScript executes in that user's browser context. This can enable cross-user script execution, session theft and administrative takeover. This issue is fixed in version 1.6.4.

In Frappe Learning Management System (LMS) prior to version 2.52.1, the course/certificate checkout flow accepts client-controlled pricing. An authenticated user can complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue that does not expose other users' data or grant elevated privileges.

In DBHub prior to version 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. A double dash followed by a non-whitespace character can hide a subsequent write or destructive DDL statement from the validator while the database interprets the dashes as minus operators and executes both statements. Anyone able to influence the assistant's SQL, including through prompt injection, can bypass read-only mode to modify or drop database data.

In ZAC prior to version 5.2.0, by-id read endpoints in ZaakRestService.kt omit assertPolicy authorization. An authenticated low-privileged municipal user who knows a case or decision UUID can read decisions, audit history, and BPMN workflow state across unauthorized case types. The advisory also identifies the afzender endpoint as exposing mailbox configuration without a policy check.

In SecureDrop from version 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterface keeps a mutable session key prefix that changes with each request. An attacker who already has access to the Journalist Interface onion address, the required authentication, and a recent nonexpired API session token can reuse that token against the web UI until its natural expiry (at most eight hours).

In Frappe Learning Management System (LMS) prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting.

A Cross Site Scripting (XSS) vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary code via the Profile editing functionality and chat messaging component. The provided description lacks details on the attack vector.

The APIExperts Square for WooCommerce (woosquare) plugin contains a Cross-Site Request Forgery (CSRF) vulnerability. The issue affects versions from n/a through 4.7.5. This may allow an attacker to force an authenticated user to perform unwanted actions.

The Events Calendar (the-events-calendar) plugin contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions from n/a through 6.18.2. This may enable unauthorized access to features or data.