CVE Vulnerability Catalog

The Mixlr Shortcode plugin for WordPress up to version 1.0.1 is vulnerable to Stored Cross-Site Scripting via the 'mixlr' shortcode. Insufficient input sanitization and output escaping on the 'url' attribute allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.

The JB News Ticker plugin for WordPress (all versions up to and including 1.0) is vulnerable to stored cross-site scripting (XSS) via the 'id' shortcode attribute of the 'jbticker' shortcode. This is due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or higher can inject arbitrary scripts into pages.

The This-or-That plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'thisorthat' shortcode in versions up to and including 1.0.4. The vulnerability is due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an injected page.

The Email Tracker plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.3.15 due to insufficient escaping and lack of preparation on the SQL query. This allows authenticated attackers with Administrator-level access and above to append additional SQL queries to extract sensitive information from the database.

A low-privileged remote attacker can upload arbitrary data masked as a PNG file to the affected device via the webserver API because only the file extension is verified.

The Simple Banner plugin for WordPress up to version 3.0.10 is vulnerable to Stored Cross-Site Scripting via the 'pro_version_activation_code' parameter. The plugin fails to properly sanitize input and escape output, allowing authenticated attackers with administrator-level access to inject arbitrary web scripts. This only affects multi-site installations and installations where unfiltered_html has been disabled.

The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 11.1.2. This is due to missing or incorrect nonce validation on the adminEnableGdprAjax() function. This makes it possible for unauthenticated attackers to modify GDPR settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.38 via the save_refund_request() function. This makes it possible for authenticated attackers with subscriber-level access and above to submit refund requests for arbitrary orders that they do not own.

A vulnerability in the Meta Tag Manager WordPress plugin before version 3.3. It does not restrict which roles can create http-equiv refresh meta tags, potentially allowing unauthorized redirects.

The WordPress Welcart e-Commerce plugin (versions up to and including 2.11.22) is vulnerable to stored cross-site scripting (XSS) via the 'order_mail' setting due to insufficient sanitization of the order_mail field and lack of output escaping. An authenticated attacker with Editor-level permissions or above can inject arbitrary scripts via the General Setting page.

The NS Maintenance Mode for WP WordPress plugin through version 1.3.1 lacks authorization in its subscriber export function, allowing unauthenticated attackers to download a list of subscribers containing their names and email addresses.

A high severity path traversal (arbitrary write) vulnerability in Jira Software Data Center and Server allows an attacker to modify any filesystem path writable by the Jira JVM process. It was introduced in versions 9.12.0 and 10.3.0 and remains in 11.0.0, with a CVSS score of 8.7.

Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension: from 1.43 before 1.44.

Vulnerability in Oracle VM VirtualBox (Core component) affects versions 7.1.12 and 7.2.2. A high-privileged authenticated attacker can exploit it locally, potentially leading to unauthorized access to critical data or all data accessible in VirtualBox.

Vulnerability in Oracle VM VirtualBox (Core component) affects versions 7.1.12 and 7.2.2. A high-privileged authenticated attacker can exploit it locally, potentially leading to unauthorized access to critical data or all data accessible in VirtualBox.

Oracle ZFS Storage Appliance Kit version 8.8 contains a vulnerability in the Object Store component. A high privileged attacker with network access via HTTP can exploit it to cause a hang or frequently repeatable crash (complete DOS). CVSS 4.9 (Availability impact).

Oracle ZFS Storage Appliance Kit version 8.8 contains a vulnerability in the Remote Replication component. A high privileged attacker with network access via HTTP can exploit it to cause a hang or frequently repeatable crash (complete DOS). CVSS 4.9 (Availability impact).

Vulnerability in Oracle ZFS Storage Appliance Kit (component: Remote Replication) affecting version 8.8. A high-privileged attacker with network access via HTTP can cause a hang or frequently repeatable crash (complete DoS) of the appliance.

Oracle ZFS Storage Appliance Kit version 8.8 contains a vulnerability in the Core component. A high privileged attacker with network access via HTTP can exploit it to cause a hang or frequently repeatable crash (complete DOS). CVSS 4.9 (Availability impact).

Vulnerability in Oracle ZFS Storage Appliance Kit version 8.8, in the Filesystems component. A high privileged attacker with network access via HTTP can cause a hang or frequently repeatable crash (complete DoS) of the appliance. CVSS 4.9 (Availability impact).