CVE Vulnerability Catalog

The JoomSport plugin for WordPress is vulnerable to generic SQL Injection via the 'team_id' parameter in all versions up to, and including, 5.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable code path is reached when the season has no associated joomsport_tournament term, which is the default state for newly created seasons.

Checkmk versions <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL) contain improper certificate validation. The bundled trust stores from "certifi" and "webpki-roots" include a root CA that trusts eMudhra (emSign) intermediate certificates whose private keys are public.

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the HTML Minify option (O_OPTM_HTML_MIN) is enabled and a companion plugin renders stored comment content into a raw-text context such as a JSON-LD script block on the same page.

A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorization information. This may allow unauthorized parties to obtain or misuse the exposed credentials.

A server-side request forgery (SSRF) vulnerability exists in the Foxit official website's HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources.

A broken access control vulnerability exists in the Foxit official website's HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users.

The HT Mega Addons for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' attribute of <a> inside .htmega-tab-nav in all versions up to and including 3.2.7 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires a co-installed plugin such as wpDiscuz with its rich editor enabled, an HT Mega Tabs widget on the same page as the comment section, and a victim clicking the injected anchor link.

The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:group/media:description' XML element in imported feeds in all versions up to and including 5.2.12 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires an administrator to configure a Feed-to-Post import pointing at an attacker-controlled feed URL and trigger the import.

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbp_reply_content' parameter in all versions up to and including 7.9.1 due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires an administrator to enable Viewport Images (VPI) and configure a VPI filename matching an image the attacker can embed in user-generated content.

The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due to the /wp-json/mapster-wp-maps/save-mapmaker REST route being registered with a permission_callback that unconditionally returns true (no capability check, no nonce), together with the mapster_write_config_to_acf() helper only sanitizing string config values with sanitize_text_field() — which strips HTML tags but leaves quote characters intact — and the mapster_wp_map shortcode renderer in mapster_wordpress_maps_shortcode_display() concatenating the stored loading_background_color value into a single-quoted inline style attribute without esc_attr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to and including 13.2.1 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires the affected post page to include an Advanced HTML Element block with Split Text animation enabled wrapping a Latest Comments block that displays comment excerpts.

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to and including 13.2.1 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires an administrator to have published a page containing a Text Animated block with Content set to Blocks, a Latest Comments block with excerpts enabled nested inside it, and at least one Animated Texts value configured.

The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to and including 3.6.5 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts that execute when a user accesses an injected page.

The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search-string' parameter in all versions up to and including 3.42 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into performing an action such as clicking a link. Exploitation requires a publicly accessible page with an [mla_gallery] shortcode configured with pagination output mode and an mla_link_href template reflecting a {+request:...+} token, along with enough attachments to trigger pagination.

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feature.properties[<template-token>]' parameter in all versions up to and including 5.4 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires a site administrator to have previously configured a public map using the [leaflet-map]+[leaflet-geojson]+[choropleth] shortcode combination whose GeoJSON src URL is controlled by the attacker.

A flaw was found in polkit where processing input beginning with a null byte triggers an arithmetic error in the authentication agent helper. This causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read that can crash the application and cause a Denial of Service (DoS).

A cross-site scripting (XSS) vulnerability exists in the ICTBroadcast software, affecting the demo environment. The 'editForm[extension_username]' parameter in the 'login.php' endpoint is reflected in the response without proper filtering, allowing an attacker to execute arbitrary JavaScript in the victim's browser when the victim visits a malicious URL.

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form maps a submitted field to its Reply-To, From, or Cc header. This allows unauthenticated users to inject arbitrary email headers, such as additional Bcc or Cc recipients, into the notification email.

The Radius Xenia M2M Platform is affected by insufficient validation of user-supplied input in the password recovery functionality of the web management interface. An unauthenticated remote attacker could supply crafted SQL queries through input fields, potentially gaining unauthorized access to sensitive information, enumerating the database structure, or modifying database records.

This CVE was rejected because of VUL-2026-008368, as it is the same issue reported earlier. No further technical details are provided in the supplied description.