CVE Vulnerability Catalog

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data. This allows unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the plugin's stored settings.

The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page. This allows unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID.

The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser. This could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content.

The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments. This allows unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.

The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login. This allows an attacker who already knows a user's password to brute force the second factor and take over the account.

The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart. This allows them to create orders for any product at an arbitrary total of their choosing.

The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server. This allows users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls and disclose protected files.

The NextGEN Gallery plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / shortcode attribute desc_below_form (and placeholder as the marker-smuggling helper)' parameter in all versions up to, and including, 1.9.26 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts created through its registration form. Authenticated users with Author-level access and above can cause newly registered accounts, including those created by unauthenticated visitors, to be granted a higher role such as Editor. This is an incomplete fix of CVE-2026-5193: the role-validation control added in 6.6.0 can be circumvented, so versions 6.6.0 through 6.8.7 remain affected.

The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its stored configuration. Users with the Contributor role and above can view secret payment-gateway API credentials, both live and test secret keys, which grant full access to the site owner's payment account.

The Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData.extra' parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5.6.4 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Ninja Forms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.

The Ninja Forms plugin for WordPress (versions up to and including 3.15.5) is vulnerable to arbitrary shortcode execution. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode, enabling unauthenticated attackers to execute arbitrary shortcodes.

A command injection vulnerability in the Orchestrator component of SoftIron HyperCloud allows an authenticated user with management plane access to execute arbitrary operating system commands on hypervisor hosts as the privileged orchestration user. Attacker-controlled virtual machine template content (e.g., the VM DESCRIPTION field) is delivered to hosts through a shell here-document whose terminator is not quoted, enabling shell expansion and here-document terminator injection during VM lifecycle operations such as deploy, migrate, and network setup. The issue affects versions 1.0 through 2.6.17 and is fixed in 2.6.18.

The File Force Download module for Drupal 7 versions 7.1.0 through 7.1.2 returned Content-Disposition headers without access checks for files outside the private scheme. An unauthenticated visitor could retrieve files in the temporary:// scheme or other stream wrappers by appending download=1 to the URL.

The Field Collection module for Drupal 7 (versions 7.x-1.0 through 7.x-1.2) has an improper authorization flaw. field_collection_item_access() grants edit and delete access to any user with the 'edit field collections' permission without verifying access to the host entity.

The pow-auth Assent library's Sign in with Apple strategy trusts the browser-supplied 'user' parameter, which the client controls. That parameter is merged over the verified ID token claims, allowing an unauthenticated remote attacker to impersonate another user. Affects versions from 0.1.25 before 0.3.2.