CVE Vulnerability Catalog

The TranslatePress plugin up to version 3.3.6 contains a stored XSS vulnerability. An attacker can save a malicious script that executes on every page visit.

The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, disabling WordPress core's REST nonce protection for every route. This allows an attacker to perform a cross-site request forgery attack that creates a new administrator account using a logged-in administrator's session.

LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. Attackers with role.edit can rename their role to Superadmin or grant user.login_as permissions to take over accounts and reach core upgrade and module installation functions for code execution.

W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .php files executed by the web server, use encoded ../ sequences to write outside the media directory, and delete arbitrary files via DELETE /api/v0/media/[*:path].

Authorization bypass through user-controlled key vulnerability in Ultimate Member up to version 2.13.1. Allows privilege escalation.

Reflected XSS vulnerability in Unlimited Elements For Elementor up to version 2.0.20. Improper input neutralization during web page generation.

Improper validation of specified quantity in input in Kirki up to version 6.3.1. Allows accessing functionality not properly constrained by ACLs.

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface. Remote attackers can send SOAP requests to /jaxrpc/* with an unverified session identifier and a chosen class name, crashing the server, probing the classpath, or potentially reaching code execution.

In Bouncy Castle for Java before 1.86, a vulnerability allows truncated OpenPGP encrypted messages to be accepted without error. On the SEIPD version 1 path, no integrity check is performed at all, and on the AEAD path (SEIPD v2 and v5), the trailing authentication tag is skipped, silently dropping packets after the literal. The issue also affects LTS before 2.73.13 and FIPS (BC-FJA) before specified versions, but only on the AEAD route.

In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate accepted public keys built on a foreign ECC curve that merely shares BLS12-381's field characteristic. This allowed aggregate signatures to verify with a phantom signer, even without a signature for that key and message pair.

In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list failed to verify that the removed leaf actually belonged to the joiner. This missing check allowed any party holding the group's public GroupInfo to send a commit with a Remove proposal naming any member, causing that member to be evicted and their slot in the ratchet tree to be taken over. The fix requires the removed leaf's credential to match the joiner's own new leaf credential on both the sending and receiving side.

In Bouncy Castle for Java before 1.86, both copies of PKIXCertPathReviewer (org.bouncycastle.pkix.jcajce and the legacy org.bouncycastle.x509) failed to apply X.509 name constraints to the end-entity certificate. The checkNameConstraints method walked the path with a loop bound excluding index zero (the target certificate), so the permitted and excluded subtree checks of RFC 5280 sec. 6.1.3 (b) and (c) never ran against the leaf's subject DN or subjectAltName. As a result, a chain whose leaf violated a NameConstraints extension imposed by its issuing CA was reported as valid (isValidCertPath() returned true with an empty error list), while CertPathValidator rejected the identical chain.

In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted messages where digestAlgorithm and authAttrs disagreed about whether authenticated attributes were present. The parser chose based on digestAlgorithm alone, so it could verify the content MAC and then return attributes via getAuthAttrs() as though they had been authenticated, even though the MAC never covered them. This also affects LTS before 2.73.13 and FIPS releases (BC-FJA) before the corresponding bcpkix-fips and bcutil-fips versions.

In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding (cross-certification) signature when that binding omitted a Key Flags subpacket. isSigningKey() inherited SIGN_DATA from the primary key via getKeyFlags() and getApplyingSubpacket(), while verifyEmbeddedPrimaryKeyBinding() read only the binding signature's own hashed subpackets and treated the subkey as non-signing, so the same subkey was both signing-capable and exempt from cross-certification.

In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted third-party certifications or trust delegations from any component key of the issuing certificate, without requiring the component to have certification authority. An attacker could use a restricted subkey (e.g., signing-only or encryption-only) to issue a valid identity certification or trust delegation, which was then attributed to the primary key.

In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV released the caller's key, IV and additional authenticated data arrays with JNI's ReleaseByteArrayElements in mode 0, which commits the native copy back into the Java array. When an application passed the same Java array as both input and destination (e.g., encrypting in place over KeyParameter.getKey()), the later mode-0 release wrote the unchanged key bytes over the ciphertext, exposing the raw AES key. The fix releases read-only input arrays with JNI_ABORT, preventing the copy-back.

The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation is possible via guest checkout because the malicious payload is embedded in a multipart Content-Disposition field name starting with 'wpcpo-'.

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping and lack of preparation on the SQL query. This allows unauthenticated attackers to append additional SQL queries to existing ones, potentially extracting sensitive information from the database. This is a second-order SQL injection: an attacker submits a crafted referrer URL to the wmcTrack endpoint, which persists the raw value, and the injection triggers when an administrator views the Traffic Sources dashboard.