CVE Vulnerability Catalog

The PZ Frontend Manager plugin for WordPress up to version 1.0.6 contains a missing authorization vulnerability in the pzfm_user_request_action_callback() function. This AJAX function lacks capability checks and nonce verification, allowing authenticated attackers with Subscriber-level access or higher to delete arbitrary WordPress users, including administrators.

The Pinterest Site Verification plugin using Meta Tag for WordPress versions up to 1.8 contains a stored cross-site scripting vulnerability via the 'post_var' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.

The Whole Enquiry Cart for WooCommerce plugin for WordPress versions up to 1.2.1 contains a stored cross-site scripting vulnerability via the 'woowhole_success_msg' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level access can inject arbitrary web scripts that execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

The AM LottiePlayer plugin for WordPress up to version 3.6.0 is vulnerable to Stored Cross-Site Scripting via uploaded SVG files due to insufficient input sanitization and output escaping. Authenticated attackers with Author-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.

In the Ado::Sessions library for Perl up to version 0.935, insecure session IDs are generated. The IDs are based on the rand() function, epoch time, and PID, making them predictable. Ado is no longer maintained and has been removed from the CPAN index.

Amon2::Plugin::Web::CSRFDefender versions 7.00 through 7.03 for Perl generate an insecure session id. The generate_session_id function attempts to read from /dev/urandom, but if unavailable, generates bytes using SHA-1 seeded with rand(), PID, and epoch time. PID comes from a small set, and time may be guessed. The rand() function is unsuitable for cryptographic purposes.

The Plus Addons for Elementor plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in the Progress Bar shortcode due to insufficient input sanitization and output escaping. This affects versions up to and including 6.4.9.

Cross-site scripting vulnerability exists in MATCHA SNS 1.3.9 and earlier. If exploited, an arbitrary script may be executed in the web browser of the user who accessed the website using the product.

The LatePoint plugin for WordPress up to version 5.3.0 contains a Stored XSS vulnerability via the 'button_caption' parameter in the [latepoint_resources] shortcode. Attackers with contributor-level access or higher can inject arbitrary scripts that execute when a user visits the page.

The Prime Slider plugin for Elementor up to version 4.1.10 contains a Stored XSS vulnerability via the 'follow_us_text' setting in the Mount widget. Insufficient input sanitization and output escaping allow attackers with author-level access or higher to inject arbitrary scripts.

The LearnPress – WordPress LMS Plugin is vulnerable to Stored Cross-Site Scripting via the 'skin' attribute of the learn_press_courses shortcode in all versions up to and including 4.3.3. Insufficient input sanitization and output escaping on the 'skin' attribute allows authenticated attackers (Contributor-level and above) to inject arbitrary web scripts.

Missing authorization in the MainWP Child Reports plugin for WordPress (up to version 2.2.6). Authenticated attackers with Subscriber access can obtain activity log entries (including action summaries, user info, IP addresses) via the Heartbeat API.

The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress up to version 3.3.13 lacks authorization in its webhook handler. Unauthenticated attackers can modify subscription settings, downgrading paid plans to Trial and changing store type and expiration dates.

The Investi plugin for WordPress up to version 1.0.26 has a stored XSS vulnerability via the 'maximum-num-years' attribute of the 'investi-announcements-accordion' shortcode. The attribute is not properly sanitized, allowing authenticated attackers with contributor-level access to inject arbitrary scripts.

The TableOn WordPress plugin up to version 1.0.4.4 contains a stored XSS vulnerability via shortcode attributes 'class', 'help_link', 'popup_title', and 'help_title'. These attributes are not properly sanitized or escaped before being inserted into HTML, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary scripts.

The Strong Testimonials plugin for WordPress versions up to 3.2.21 contains a stored cross-site scripting vulnerability via the testimonial_view shortcode due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.

The LightPress Lightbox plugin for WordPress up to version 2.3.4 contains a stored XSS vulnerability via the `group` attribute in the `[gallery]` shortcode. Lack of proper escaping allows authenticated attackers with Contributor-level access and above to inject arbitrary scripts that execute when a page is viewed.

The Blubrry PowerPress plugin for WordPress versions up to 11.15.15 contains a stored cross-site scripting vulnerability via the 'powerpress' and 'podcast' shortcodes due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.

The latest version of parisneo/lollms contains an insufficient session expiration vulnerability. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This is due to the absence of logic to reject requests after inactivity and the excessively long default session duration of 31 days. Attackers can maintain persistent access to a compromised account even after the victim resets their password.

In Go, context was not properly tracked across template branches for JS template literals, leading to incorrect escaping. Template actions within JS template literals also did not track brace depth, causing improper escaping. These issues could lead to XSS vulnerabilities.