CVE Vulnerability Catalog

The Gravity Forms plugin for WordPress in versions up to and including 3.1.2 is vulnerable to Stored Cross-Site Scripting via the List Field due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses the injected page. Successful exploitation requires the administrator to click the injected link in the entry detail view and confirm a dialog, triggering the admin JavaScript bundle's delegated data-dialog-callback handler.

The Gravity Forms plugin for WordPress in versions up to and including 3.1.1 is vulnerable to Stored Cross-Site Scripting via Post Excerpt, Post Custom Field, and Rich-Text Paragraph field values due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses the injected page. These fields allow raw HTML submissions via allow_html(), and an entity-encoded payload stored in a data-dialog-confirm attribute evades wp_kses_post() at save time but is decoded into executable markup by insertAdjacentHTML() in the admin JavaScript.

The Formidable Forms plugin for WordPress in versions up to and including 6.35 is vulnerable to Arbitrary Plugin Installation via the 'file_url' parameter. This is due to insufficient URL prefix validation in validate_url_is_in_s3_bucket() and a permission callback relying solely on a shared token obtainable by any user with the delegable frm_view_forms capability, without checking install_plugins or activate_plugins. Authenticated attackers with subscriber-level access and above can install arbitrary plugins, provided the site is free-only (Formidable Pro is not installed).

The Food Store – Online Food Delivery & Pickup plugin for WordPress in versions up to and including 1.5.5 is vulnerable to Stored Cross-Site Scripting via the 'service_time' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses the injected page. Exploitation requires the 'Enable Checkout Service Fields' option to be turned off (a non-default configuration) while 'Enable Pickup/Delivery Service' remains enabled.

The AI Engine – The Chatbot, AI Framework & MCP plugin for WordPress in versions up to and including 3.8.6 is vulnerable to Missing Authorization. The MCP module's OAuth 2.1 Dynamic Client Registration endpoint (/wp-json/mcp/v1/oauth/register) is registered with a permission_callback of __return_true, allowing an unauthenticated user to register an active OAuth client with an attacker-controlled redirect URI. Once an administrator approves the attacker's client on the OAuth consent screen, the attacker can obtain an administrator-bound MCP access token and gain full administrator-level control; the consent page lacks X-Frame-Options or CSP frame-ancestors, enabling clickjacking.

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a logged-in administrator views the statistics pages.

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login. This allows anyone who holds a user's current authenticator code to log in as that user, including an administrator, without the password.

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine. This allows unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server. This is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4.

The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via its export and re-import workflow. The flaw is caused by a CSV escape-character mismatch between the exporter (fputcsv with default backslash escape) and the importer (fgetcsv with double-quote escape), allowing a crafted value in a Subscriber's Biographical Info field to inject a second row that creates an arbitrary Administrator account.

A flaw was found in glib-networking where the client-side session cache for TLS 1.3 does not limit the number of session tickets retained for a single host. A malicious server can send excessive session ticket messages, causing unbounded memory growth in the client application, leading to memory exhaustion and a Denial of Service (DoS).

Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.

Memory corruption in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.

Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

Memory corruption in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.

Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.