CVE Vulnerability Catalog

The AI Copilot plugin up to version 1.5.2 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. An attacker can perform operations without proper permissions.

The Sticky Notes for WP Dashboard plugin up to version 1.2.4 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. This could enable unauthorized operations on the admin dashboard.

The WordPress plugin EasyTest – Simplify A/B Testing through 1.0.1 contains a missing authorization vulnerability allowing exploitation of incorrectly configured access control security levels.

An HTML Injection vulnerability in TrueConf server 5.5.2.10813 in the conference description field allows an attacker to inject arbitrary HTML in the Create/Edit conference functionality. The payload will be triggered when the victim opens the Conference Info page ([conference url]/info).

In the Linux kernel, a potential null-ptr-deref exists in device_add(). The bug occurs on the error path when dev->driver is set but the driver is not yet bound to the device, causing klist_remove() to access an uninitialized knode_driver pointer.

A vulnerability was determined in aizuda snail-job up to 1.7.0 on macOS. Affected by this vulnerability is the function FurySerializer.deserialize of the component API. This manipulation of the argument argsStr causes deserialization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

The ShopMagic plugin for WooCommerce contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 4.7.2.

DOM-Based XSS vulnerability in Essential Addons for Elementor (WordPress plugin) allows an attacker to manipulate the DOM in the victim's browser. Affects versions up to and including 6.5.3.

A missing authorization vulnerability in the Demo Importer Plus plugin (versions up to and including 2.0.8) allows exploitation of incorrectly configured access control security levels. An unauthorized user can perform actions requiring permissions.

Stored XSS vulnerability in Auto Listings (WordPress plugin) allows an attacker to permanently inject malicious script that executes on every page view. Affects versions up to and including 2.7.1.

A DOM-Based Cross-site Scripting vulnerability in the Combo Offers WooCommerce plugin (versions up to and including 4.2) arises from improper neutralization of input during web page generation. An attacker can inject a malicious script that executes in the user's browser.

DOM-Based XSS vulnerability in Blog Filter (WordPress plugin) allows an attacker to manipulate the DOM in the victim's browser. Affects versions up to and including 1.7.3.

The FiveStar plugin (fivestar) contains an authorization bypass through user-controlled key vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 1.7.

The Arcane plugin for WordPress contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 3.6.6.

The Backpack Traveler theme by Mikado-Themes contains an authorization bypass vulnerability through a user-controlled key. This allows exploiting incorrectly configured access control security levels and affects versions up to and including 2.10.3.

The Struktur plugin (struktur) contains an authorization bypass through user-controlled key vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 2.5.1.

A missing authorization vulnerability in the BoldGrid weForms plugin (versions up to and including 1.6.25) allows exploitation of incorrectly configured access control security levels. An unauthorized user can perform actions they should not have permission to do.

A missing authorization vulnerability in the Product Delivery Date for WooCommerce – Lite plugin (versions up to and including 3.2.0) allows exploitation of incorrectly configured access control security levels. An unauthorized user can perform actions requiring permissions.

The PopupKit plugin by Roxnor contains a vulnerability that allows exposure of sensitive system information to unauthorized parties. The issue affects versions up to and including 2.1.5.

A vulnerability in the Poptics plugin (versions up to and including 1.0.20) involves exposure of sensitive system information to an unauthorized control sphere. An attacker can retrieve embedded sensitive data.