CVE Vulnerability Catalog

Cross-Site Request Forgery (CSRF) vulnerability in blubrry PowerPress Podcasting powerpress allows Cross Site Request Forgery. This issue affects PowerPress Podcasting: from n/a through <= 11.13.12.

The Email Template Customizer for WooCommerce plugin by VillaTheme up to version 1.2.17 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Attackers can inject malicious scripts that execute in the victim's browser.

The wpresidence plugin by WpEstate has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 5.3.2.

A stored cross-site scripting vulnerability in Rehub theme (before 19.9.9.1) allows script injection during web page generation.

Stored XSS vulnerability in the Eduma theme by ThimPress. Lack of input neutralization during web page generation allows persistent injection of malicious scripts.

The Super Store Finder plugin for WordPress (versions up to 7.5) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick a logged-in user into performing unwanted actions.

The Blog Designer PRO WordPress plugin versions up to and including 3.4.8 has a missing authorization vulnerability that allows accessing functionality not properly constrained by ACLs. This could enable unauthorized actions.

The Keras.Model.load_model method, including when executed with safe_mode=True, is vulnerable to arbitrary local file loading and Server-Side Request Forgery (SSRF) via a specially crafted .keras archive with a StringLookup layer pointing to a local or remote path.

The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action install_extension without verifying user capabilities or using a nonce. As a result, any authenticated user — including those with the Subscriber role — can install and activate additional Doppler Forms WordPress plugin through 2.5.1 (limited to those whitelisted by the main Doppler Forms WordPress plugin through 2.5.1).

The WooCommerce plugin by Automattic up to version 10.0.2 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Attackers can inject malicious scripts that execute in the victim's browser.

The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to and including 4.23.81 due to a missing capability check combined with information exposure in several GOTMLS_* AJAX actions. An authenticated attacker with Subscriber-level access and above can read arbitrary files on the server.

The Popup box plugin for WordPress (versions up to 5.5.4) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick a logged-in user into performing unwanted actions.

Insufficient sanitization of uploaded SVG files in DNN (DotNetNuke) before version 10.1.1. This is an incomplete fix for CVE-2025-48378, not covering all XSS scenarios.

DNN (formerly DotNetNuke) prior to 10.1.1 allows unauthenticated users to upload files in the out-of-box experience for HTML editing. This opens a potential vector to other security issues and is not needed on most implementations. This vulnerability is fixed in 10.1.1.

FastMCP versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page (oauth_callback.py) where unescaped user-controlled values are inserted into the generated HTML, allowing arbitrary JavaScript execution in the callback server origin. The issue is fixed in version 2.13.0.

Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting (XSS) vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in {{ & }} were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser when the field is displayed. The issue has been fixed in v9.11.1.

PrivateBin is an online pastebin with zero knowledge of pasted data. Versions 1.7.7 through 2.0.1 allow persistent HTML injection via the unsanitized attachment filename (attachment_name) when attachments are enabled. An attacker can modify attachment_name before encryption so that, after decryption, arbitrary HTML is inserted unescaped near the file size hint, enabling redirects and site defacement and related phishing attacks. Script execution is normally blocked by the recommended CSP.

Discourse is an open source discussion platform. Versions before 3.6.2 and 3.6.0.beta2 were missing the default Cache-Control response header (no-store, no-cache) on error responses. This may cause unintended caching by proxies, potentially leading to cache poisoning attacks.

Consul and Consul Enterprise's event endpoint is vulnerable to denial of service (DoS) due to lack of a maximum value on the Content Length header.

Consul and Consul Enterprise's key/value endpoint is vulnerable to denial of service (DoS) due to incorrect Content Length header validation.