CVE Vulnerability Catalog

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.11 via the wpematico_test_feed() function. This allows authenticated attackers with Subscriber-level access and above to make web requests to arbitrary locations originating from the web application, potentially querying and modifying information from internal services.

The Popup and Slider Builder by Depicter plugin for WordPress (versions up to and including 4.0.4) is vulnerable to arbitrary file uploads due to missing capability checks in the "depicter-media-upload" AJAX route. An authenticated attacker with Contributor-level access or higher can upload limited files to the server.

The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticated users, such as subscriber, to reset the password of arbitrary accounts, including administrators.

Improper handling of insufficient permissions or privileges in Samsung Account prior to version 15.5.00.18 allows local attackers to access data in Samsung Account. User interaction is required for triggering this vulnerability.

Out-of-bounds write in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. This could lead to crashes or potential code execution.

An out-of-bounds read in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. The vulnerability affects the image codec library.

Insecure default configuration in USB connection mode prior to SMR Nov-2025 Release 1 allows privileged physical attackers to access user data. User interaction is required to trigger this vulnerability.

An out-of-bounds write in handling opcode in the fingerprint trustlet prior to SMR Nov-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.

The MelAbu WP Download Counter Button WordPress plugin through version 1.8.6.7 does not validate the path of files to be downloaded, which could allow an unauthenticated attacker to read or download arbitrary files.

The ElementInvader Addons for Elementor WordPress plugin before 1.4.1 allows unauthenticated users to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form action.

The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing attackers to conduct reflected XSS attacks against logged-in users.

The Spectra Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS field in all versions up to and including 2.19.14 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or higher can inject arbitrary scripts that execute when a user visits the injected page.

The SMS for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'paged' parameter in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into performing an action such as clicking a link.

The Paid Membership Subscriptions plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability and validation check in the PMS_AJAX_Checkout_Handler::process_payment() function in all versions up to and including 2.16.4. An unauthenticated attacker can trigger stored auto-renew charges for arbitrary members.

The Everest Forms (Pro) plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input in the mime_content_type() function. This makes it possible for unauthenticated attackers to inject a PHP Object when a form is present with a non-required signature field and an image upload field.

The Features plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'features_revert_option' AJAX endpoint in all versions up to, and including, 0.0.2. This allows authenticated attackers with Subscriber-level access and above to revert options.

LinkAce versions 2.3.1 and below contain a Stored Cross-Site Scripting (XSS) vulnerability in the social media sharing functionality. An authenticated user can inject arbitrary JavaScript via the title field with malicious HTML. The code executes in the browser of a user viewing the link details page.

A denial-of-service vulnerability exists in Secure Access Windows client versions 12.0 to 14.10, fixed in version 14.12. If a local networking policy is active, an attacker on an adjacent network may send a crafted packet and crash the client system.

LinkAce versions 2.3.1 and below have authenticated RSS feed endpoints in FeedController that fail to implement proper authorization checks, allowing any authenticated user to access all links, lists, and tags from all users regardless of ownership or visibility settings. This is fixed in version 2.4.0.

LinkAce is a self-hosted archive to collect website links. Versions 2.3.1 and below allow any authenticated user to export the entire database of links from all users, including private links that should only be accessible to their owners. The HTML and CSV export functions in the ExportController class retrieve all links without applying ownership or visibility filtering, bypassing access controls. This is fixed in version 2.4.0.