CVE Vulnerability Catalog

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter (also function, plugin, post_type, post_status, ids, loggedout, and POST post_title) in all versions up to and including 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

A flaw was found in spice-server where the GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback. An authenticated malicious SPICE client during VM live migration can trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.

Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.

The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by tricking the user into opening a crafted URL and clicking the Reset button or submitting an empty search.

The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This allows unauthenticated attackers or authenticated attackers holding any POS role to append additional SQL queries to extract sensitive information from the database.

IKAS Technology Inc. Ikas E-Commerce Infrastructure contains an observable response discrepancy vulnerability that allows account footprinting. This issue affects Ikas E-Commerce Infrastructure through 2026-07-13.

The DoubleScale | All-in-One CRM plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store_upload function. This is due to a fail-open extension allow-list in extension_is_allowed() that returns true when wp_check_filetype() yields an empty type for unrecognized extensions such as .php, combined with magic-byte-only MIME detection and no capability check beyond is_user_logged_in().

The SureCart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Server-Side Request Forgery (SSRF) is reported in the ticket sales chart PDF export functionality of Wegow. An authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generated by selecting Download PDF, causing the export.highcharts.com service to send HTTP requests to attacker-controlled external resources and embed their responses in the generated PDF.

The User Registration PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3. This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet guards the wrong directory path.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter. This allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the RelayState.

The WPConsent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms allows Object Injection. This issue affects Gravity Forms: from n/a before 3.1.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez allows Reflected XSS. This issue affects Houzez: from n/a through 4.4.0.

The YaySMTP plugin for WordPress (versions up to and including 2.7.7) is vulnerable to arbitrary file upload via the putFile function. Insufficient file type validation allows an authenticated subscriber-level user to upload an executable file, leading to remote code execution (RCE). The .htaccess protection is ignored by nginx and Apache with AllowOverride None.

The WP Photo Album Plus plugin for WordPress (versions up to and including 9.3.02.002) is vulnerable to command injection via the 'value' parameter in the 'update-photo' AJAX action. Insufficient shell escaping in the wppa_image_magick_a() function allows an authenticated user with the wppa_upload capability to execute arbitrary OS commands as the web server user. ImageMagick must be enabled.

The CP Multi View Events Calendar plugin for WordPress (versions up to and including 1.4.42) is vulnerable to stored cross-site scripting via the 'CalendarTitle' parameter. Insufficient input sanitization and output escaping allows an unauthenticated attacker to inject arbitrary web scripts that execute when a user visits the injected page. This requires the 'Allow edition in frontend?' option to be enabled.

The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.