CVE Vulnerability Catalog

The myLCO plugin for WordPress (versions up to and including 0.8.1) is vulnerable to Reflected Cross-Site Scripting via the $_SERVER['PHP_SELF'] parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into clicking a link.

The Accessiy By CodeConfig Accessibility plugin for WordPress (versions up to and including 1.0.0) is vulnerable to unauthorized page creation due to missing authorization checks in the Settings::createPage() function. Authenticated attackers with Subscriber-level access and above can create arbitrary published pages via the ccpcaCreatePage AJAX action.

The Accessiy By CodeConfig Accessibility plugin for WordPress (versions up to and including 1.0.2) is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. Authenticated attackers with subscriber-level access and above can modify the plugin's global accessibility settings.

The Application Passwords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'reject_url' parameter in all versions up to and including 0.1.3 due to insufficient input sanitization and output escaping on user-supplied URLs, allowing javascript: URI schemes to be embedded.

The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woomotiv_limit' parameter in all versions up to, and including, 3.6.3 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can successfully trick a user into performing an action such as clicking a link.

The g-FFL Cockpit plugin for WordPress (versions up to and including 1.7.1) is vulnerable to Sensitive Information Exposure via the /server_status REST API endpoint due to a lack of capability checks. Unauthenticated attackers can extract information about the server.

The g-FFL Cockpit plugin for WordPress (versions up to and including 1.7.1) is vulnerable to unauthorized modification of data due to IP-based authorization that can be spoofed in the handle_enqueue_only() function. Unauthenticated attackers can delete arbitrary products.

The List Attachments Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_list' parameter in the [list-attachments] shortcode in all versions up to and including 0.4.1a due to insufficient input sanitization and output escaping.

The Canadian Nutrition Facts Label plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'percentage' field in the Nutrition Label custom post type in all versions up to, and including, 3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Listar – Directory Listing & Classifieds WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/listar/v1/place/save' REST API endpoint in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update listing details.

The Listar – Directory Listing & Classifieds WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the '/wp-json/listar/v1/place/delete' REST API endpoint in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.

The Search, Filters & Merchandising for WooCommerce plugin is vulnerable to unauthorized modification of data due to a missing capability check on the 'wcis_save_email' endpoint in all versions up to and including 3.0.67.

The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'existing_terms_orderby' parameter in the AI preview AJAX endpoint in all versions up to, and including, 3.40.1. This is due to insufficient escaping on user-supplied parameters and lack of SQL query parameterization. This makes it possible for authenticated attackers, with Contributor-level access and above who have AI metabox permissions, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, cause performance degradation, or enable data inference through time-based techniques.

The weDocs plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.1.14. This is due to the plugin not properly verifying that a user is authorized to perform an action in the create_item_permissions_check function. This allows authenticated attackers with Subscriber-level access and above to modify global plugin settings.

The Link Whisper Free plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the type parameter in all versions up to, and including, 0.8.8 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can successfully trick a user into performing an action such as clicking a link.

A vulnerability was detected in xerrors Yuxi-Know up to 0.4.0. The function OtherEmbedding.aencode in /src/models/embed.py is affected. Manipulation of the argument health_url results in server-side request forgery. The attack can be initiated remotely and the exploit is public.

An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.

Frappe Learning Management System (LMS) prior to 2.41.0 has a flaw in server-side authorization logic that allowed authenticated users to perform actions beyond their assigned roles across multiple features. Because affected endpoints relied on client-side or UI-level checks instead of enforcing permissions on the server, users with low-privileged roles (such as students) could perform operations intended only for instructors or administrators via directly using the APIs. This vulnerability is fixed in 2.41.0.

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.14.6 and 1.15.2, a bug in the permission logic allowed users with "Can share" permission to modify the permissions of other recipients. This vulnerability is fixed in 1.14.6 and 1.15.2.

Nextcloud Tables (versions prior to 0.8.7 and 0.9.4) allows authenticated users to view metadata of columns in other tables of the Tables app by modifying the numeric ID in a request. This vulnerability is fixed in 0.8.7 and 0.9.4.