CVE Vulnerability Catalog

The Trinity Audio – Text to Speech AI audio player plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'range-date' parameter in all versions up to and including 5.20.2 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if a user is tricked into clicking a link.

The Trinity Audio – Text to Speech AI plugin for WordPress up to version 5.20.2 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation in the '/admin/inc/post-management.php' file. Unauthenticated attackers can activate/deactivate posts via a forged request if they trick a site administrator into clicking a link.

The Contest Gallery plugin for WordPress up to version 27.0.2 is vulnerable to Stored Cross-Site Scripting via form field parameters due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access or higher can inject scripts.

The Majestic Before After Image plugin for WordPress up to version 2.0.1 is vulnerable to Stored Cross-Site Scripting (XSS) via the 'before_label' and 'after_label' parameters due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page.

The WDesignKit plugin for WordPress up to version 1.2.16 has a missing authorization in the wdkit_handle_review_submission function. Unauthenticated attackers can submit feedback data to external services.

The WP Photo Album Plus plugin for WordPress up to version 9.0.11.006 is vulnerable to Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the wppa_user_upload function. Authenticated attackers with Subscriber-level access can inject arbitrary web scripts in photo album descriptions.

In fetchmail before 6.5.6, the SMTP client can crash during authentication upon receiving a 334 status code in a malformed context. The issue relates to handling unexpected SMTP server responses.

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the registerAssociateFormsWithCampaign function in all versions up to and including 4.10.0. This allows unauthenticated attackers to associate any donation forms with any campaign.

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' functions due to a missing capability check. This allows unauthenticated attackers to extract data from private and draft donation forms, as well as archived campaigns.

The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to and including 1.0.9. This is due to missing capability checks and nonce verification on functions hooked to 'init'. This allows unauthenticated attackers to deactivate the plugin, tamper with OAuth configuration, and trigger test connections that expose sensitive data.

Mastra, a TypeScript framework for building AI agents, versions 0.13.8 through 0.13.20-alpha.0, is vulnerable to a directory traversal that discloses directory listings. The path traversal check is bypassed by subsequent directory suggestion logic, allowing an attacker to list arbitrary directories on the user's filesystem, including the home directory. Fixed in version 0.13.20.

KUNO CMS versions 1.3.13 and below have validation flaws in file upload functionality that can be exploited for stored XSS. Validation only checks Content-Type headers, allowing SVG files with malicious scripts. Fixed in version 1.3.14.

Minecraft RCON Terminal, a VS Code extension for Minecraft server management, versions 0.1.0 through 2.0.6 stores passwords in plaintext in settings.json. This issue is fixed in version 2.1.0.

In Liferay Portal and Liferay DXP, sensitive user data may be included in the Freemarker template. This weakness permits an unauthorized actor to access confidential information that should remain restricted.

OpenSupports udostępnia punkt końcowy, który pozwala na edytowanie listy 'nadzorowanych użytkowników' dla dowolnego konta, nie weryfikując, czy aktor jest właścicielem tej listy. Pracownik na poziomie 1 może zmodyfikować relację nadzoru innej osoby, co pozwala jej na przeglądanie zgłoszeń dodanych 'nadzorowanych' użytkowników.

OpenSupports 4.11.0 exposes two unauthenticated diagnostic endpoints with permission 'any', allowing arbitrary backend-initiated network connections to an attacker-supplied destination. This enables unauthenticated SSRF for internal network scanning and service interaction.

Claude Code is an agentic coding tool. Versions below 1.0.120 failed to account for symlinks when checking permission deny rules. If a user explicitly denied Claude Code access to a file and Claude Code had access to a symlink pointing to that file, it was possible for Claude Code to access the file.

NiceGUI, a Python-based UI framework, versions 2.24.2 and below are at risk for Cross-Site Scripting (XSS) when developers render unescaped user input into the DOM using ui.html(). Lack of HTML or JavaScript sanitization allows attackers to execute arbitrary JavaScript in the user's browser. Applications that do not pass untrusted input into ui.html() are not affected. This issue is fixed in version 3.0.0.

An improper authentication vulnerability in QNAP Authenticator. An attacker with physical access can exploit the vulnerability to compromise the security of the system. The vulnerability is fixed in version 1.3.1.1227 and later.

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. A remote attacker who gains an administrator account can exploit the vulnerability to obtain secret data or modify memory. The vulnerability has been fixed in QTS 5.2.6.3195 build 20250715 and later and QuTS hero h5.2.6.3195 build 20250715 and later.