CVE Vulnerability Catalog

The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Accordion Block's attributes in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Gutenify – Visual Site Builder Blocks & Site Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block attributes in all versions up to, and including, 1.5.9 due to insufficient input sanitization and output escaping on user-supplied attributes. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts into pages that execute when a user visits the injected page.

SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate the string to redirect a user to a malicious site. Attack complexity is high and authentication is required.

SolarWinds Observability Self-Hosted contains an XSS vulnerability in the SolarWinds Platform affecting user-created URL fields. Exploitation requires authentication from a low-level account.

The Local Syndication plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 1.5a via the url parameter in the [syndicate_local] shortcode. This is due to the use of wp_remote_get() instead of wp_safe_remote_get(), allowing authenticated attackers with Contributor-level access or above to make requests to arbitrary locations, scan internal networks, and access internal resources.

The Download Panel plugin for WordPress is vulnerable to unauthorized settings modification due to a missing capability check on the 'wp_ajax_save_settings' AJAX action in all versions up to and including 1.3.3. The dlpn_save_settings() function lacks capability verification, allowing authenticated attackers with Subscriber-level access or above to arbitrarily modify plugin settings.

The ACF Flexible Layouts Manager plugin for WordPress (versions up to and including 1.1.6) lacks a capability check on the 'acf_flm_update_template_with_pasted_layout' function. An unauthenticated attacker can update custom field values on individual posts and pages.

The Top Friends plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.3. Missing nonce validation in the top_friends_options_subpanel() function allows unauthenticated attackers to modify plugin settings via a forged request.

The CSV to SortTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csv' shortcode in all versions up to, and including, 4.2 due to insufficient input sanitization and output escaping on user-supplied attributes. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts into pages that execute when a user visits the injected page.

The Project Honey Pot Spam Trap plugin for WordPress (all versions up to and including 1.0.1) is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the printAdminPage() function. An unauthenticated attacker can update settings and inject malicious web scripts via a forged request if they can trick a site administrator into performing an action such as clicking a link.

The Like-it plugin for WordPress (all versions up to and including 2.2) is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the likeit_conf() function. An unauthenticated attacker can update settings and inject malicious web scripts via a forged request if they can trick a site administrator into performing an action such as clicking a link.

The Permalinks Cascade plugin for WordPress in versions up to and including 2.2 is vulnerable to Missing Authorization. The handleTPCAdminAjaxRequest function does not properly verify that a user is authorized to perform an action, allowing authenticated attackers with subscriber-level access and above to perform unauthorized administrative actions such as enabling or disabling automatic pinging settings and modifying page exclusion settings.

The WP Admin Microblog plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.1.1. Missing or incorrect nonce validation on the 'wp-admin-microblog' page allows unauthenticated attackers to send messages on behalf of an administrator.

The ArtiBot Free Chat Bot for WebSites WordPress plugin in versions up to and including 1.1.7 is vulnerable to Reflected Cross-Site Scripting via PostMessage due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they trick a user into clicking a link.

The everviz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'everviz' shortcode attributes in versions up to, and including, 1.1. This is due to the plugin not properly sanitizing user input or escaping output when building a '<div id=...>' from the 'type' and 'hash' attributes. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts into pages that execute when a user visits the injected page.

A stack buffer overflow vulnerability exists in the Supermicro BMC shared library. An authenticated attacker with access to the BMC can exploit the stack buffer via a crafted header and achieve arbitrary code execution in the BMC firmware operating system.

The VK All in One Expansion Unit plugin for WordPress in versions up to and including 9.112.1 is vulnerable to Stored Cross-Site Scripting via the '_veu_custom_css' parameter. This is due to insufficient input sanitization and output escaping on the user-supplied Custom CSS value. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts that execute when a user accesses an injected page.

The VK All in One Expansion Unit plugin for WordPress in versions up to and including 9.112.1 is vulnerable to Stored Cross-Site Scripting via the 'vkExUnit_cta_url' and 'vkExUnit_cta_button_text' parameters. This is due to a logic error in the CTA save function that reads sanitization callbacks from the wrong variable ($custom_field_name instead of $custom_field_options), causing sanitization to never be applied. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts that execute when a user accesses an injected page.

Stack-based buffer overflow in the SMASH-CLP shell. An authenticated attacker with SSH access to the BMC can exploit a stack buffer overflow via a crafted SMASH command, overwrite the return address and registers, and achieve arbitrary code execution on the BMC firmware operating system.

The Post Type Switcher plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 4.0.0 due to missing validation on a user-controlled key. This allows authenticated attackers with Author-level access and above to modify the post type of arbitrary posts and pages they do not own, including those created by administrators.