CVE Vulnerability Catalog

The Customer Email Verification for WooCommerce plugin in versions up to and including 2.8.2 is vulnerable to Authentication Bypass via a Predictable Email-Verification Token. The authenticate_user_by_email_link() function lacks capability and nonce checks, and the token is generated as md5(email . time()), allowing unauthenticated attackers to log in as a newly created customer or mark an account as verified.

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action. It relies only on published status and not on the post type's visibility, allowing unauthenticated users to disclose content of posts stored in non-public post types, such as captured contact-form submissions.

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute. Users with the Contributor role or above could inject JavaScript that runs in the browser of any user who views the page, including an administrator reviewing a pending submission.

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request. Unauthenticated attackers could inject arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier exposed in public page source. Users with the Author role or above could overwrite another user's form configuration and have that form's submissions delivered to an attacker-controlled address.

The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions. This allows unauthenticated users to add or delete reservation types in the plugin's configuration.

The Court Reservation WordPress plugin before 1.12.4 does not perform authorization or nonce verification on one of its challenge-management actions. This allows unauthenticated users to delete arbitrary tournament-ladder challenge records along with the linked court-booking event.

The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state. This allows unauthenticated users to make the site send templated verification-code emails to arbitrary recipients.

The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before outputting it in its cart slide-out. This allows unauthenticated users to store a Cross-Site Scripting payload that executes in another user's session, including a logged-in administrator.

The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL query. This allows authenticated attackers with editor-level access to perform blind SQL injection attacks.

The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files. This allows unauthenticated users to upload arbitrary files, including PHP files that lead to remote code execution on servers that execute PHP from the uploads directory.

The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation. This allows unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid, regardless of its payment method.

The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning its confirmation link. This allows unauthenticated users to obtain any paid order's key and, for recent guest orders, view the customer's personal details.

The UniPAY Payment Gateway For WooCommerce plugin (versions before 2.4) does not properly verify the authenticity of payment notifications, as their signature is checked against a merchant secret that is empty by default. This allows unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid.

Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (google-adk) versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application when both applications share a FileArtifactService root directory and use the same user_id (and session_id for session-scoped artifacts).

Insufficiently Protected Credentials in the tunnel gateway and provisioning interfaces in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows unauthenticated remote attackers to escalate privileges via authentication abuse to access access keys, secret keys, and deployment secrets.

Improper Control of Generation of Code in the Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection.

In the Linux kernel, a vulnerability was resolved in the wifi: p54 driver where the firmware parser accesses component ID and version records without validating their lengths. A malformed record can cause the parser to read past the record. The fix validates record lengths and rejects descriptor values that underflow the RX offset or produce an empty RX range.

The Rank Math SEO plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input in the updateMeta REST API endpoint. An authenticated attacker with Contributor-level access or higher can inject a PHP object, and the presence of a POP chain allows remote code execution by writing a webshell to the uploads directory.

A vulnerability was determined in a2ui up to 0.10.6 affecting the formatString function in expression_parser.ts of the Parser component. The manipulation causes resource consumption and can be initiated remotely. The exploit has been publicly disclosed and a patch is available as 1f71d1aac1b145ef57c7526f9e0cff316f5934e2.