CVE Vulnerability Catalog

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /filebird/v1/fb-wipe-clear-all-data function in all versions up to, and including, 6.4.9. This makes it possible for authenticated attackers, with author-level access and above, to reset all of the plugin's configuration data.

The LearnPress WordPress LMS Plugin up to version 4.2.9.2 is vulnerable to data modification due to missing capability checks on Admin Tools REST endpoints, which have permission_callback set to __return_true. This allows unauthenticated attackers to perform destructive database operations, including dropping indexes on any table (including WordPress core tables), creating duplicate configuration entries, and degrading site performance.

The Gutenberg Essential Blocks – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titleTag' attribute in all versions up to and including 5.7.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts.

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' parameter in all versions up to, and including, 3.17.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rev_slider_vc' shortcode in all versions up to, and including, 8.6 due to insufficient input sanitization and output escaping on user supplied attributes. This is only exploitable when RevSlider is also installed.

The SecurePoll extension in MediaWiki contains a stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects the master version of the extension.

The XX2WP Integration Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mxp_fb2wp_display_embed' shortcode in all versions up to and including 1.9.9. This is due to improper sanitization of user input and output of the 'post_id' parameter.

The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wishlist_quickview' AJAX action in all versions up to, and including, 5.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view other user's wishlist data and information.

The Media Library Assistant plugin for WordPress is vulnerable to limited file reading in all versions up to, and including, 3.29 via the mla-stream-image.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary ai/eps/pdf/ps files on the server, which can contain sensitive information.

The Cargo extension for MediaWiki is vulnerable to Stored XSS due to improper input neutralization during web page generation. This affects the master version of the extension.

The FlexDiagrams extension for MediaWiki is vulnerable to Stored XSS due to improper input neutralization during web page generation. This affects the master version of the extension.

The CentralAuth extension for MediaWiki exposes sensitive information to unauthorized actors, leading to resource leak exposure. This affects versions from master before 1.39.

The GrowthExperiments extension for MediaWiki has an incorrect default permissions vulnerability, leading to resource leak exposure. This affects versions from master before 1.39.

The GrowthExperiments extension for MediaWiki is vulnerable to Stored XSS due to improper input neutralization during web page generation. This affects versions from master before 1.39.

The CirrusSearch extension for MediaWiki has an allocation of resources without limits or throttling vulnerability, enabling HTTP DoS. This affects versions from master before 1.43.

The ImageRating extension for MediaWiki is vulnerable to Stored XSS due to improper input neutralization during web page generation. This affects versions from master before 1.39.

The UploadWizard extension for MediaWiki is vulnerable to Stored XSS due to improper input neutralization during web page generation. This affects versions from master before 1.39.

The AdvancedSearch extension for MediaWiki contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This affects versions from master before 1.39.

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 5.7.1 via the eb_save_ai_generated_image function. This allows authenticated attackers with Author-level access or above to make web requests to arbitrary locations.

The BlueSky skin for MediaWiki contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This affects versions from master before 1.39.