CVE Vulnerability Catalog

The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities. This allows users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them.

The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its settings update action, verifying only a nonce. This allows an authenticated low-privileged user granted access to the sync feature to overwrite the plugin's settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.

The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours. This allows users with contributor-level access and above to modify, reconfigure and publish tours created by other users.

The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours. This allows users with contributor-level access and above to read and modify tours created by other users.

The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard. This allows users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.

The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes. This allows users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site.

The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to. This allows users with a custom fundraising role to edit, publish and read pages owned by other users, including administrators.

The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute. This allows users with a custom form-editing role to inject arbitrary web scripts that execute in the browser of any visitor or administrator who opens the affected donation form.

The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk. This allows users with a high-privilege custom role to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and overwrite the plugin's stored configuration.

The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route. This allows unauthenticated visitors to view the content and settings of unpublished (draft, pending, private and scheduled) donation forms that WordPress core otherwise keeps non-public.

The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state. This allows unauthenticated attackers to forge a payment completion notification and create a completed order without paying.

The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary.

A flaw was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09 in the function SmsCodeServiceImpl.validateSmsCode0 of /service/sms/SmsCodeServiceImpl.java, related to SMS code verification. The manipulation causes improper restriction of excessive authentication attempts. The attack may be initiated remotely, though its complexity is rather high and exploitability is regarded as difficult; the exploit has been published.

A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. An unknown function in AuthController.java handling SMS code verification improperly processes the mobile/code arguments, resulting in improper authentication. The attack can be launched remotely and the exploit is publicly available.

A security vulnerability was detected in onyx-dot-app Onyx up to version 5.0.0. It affects an unknown function in web/src/app/craft/components/output-panel/PreviewTab.tsx and leads to cross-site scripting (XSS). The attack can be initiated remotely, and the exploit has been publicly disclosed.

A security flaw was discovered in Zylon PrivateGPT versions 1.0.0 and 1.0.1. The vulnerability affects the load_file_from_uri function in private_gpt/server/ingest/uri_loader.py (URI Artifact Loader component) and involves manipulation of the Value argument, resulting in server-side request forgery. The attack can be initiated remotely, and a public exploit is available.

A SQL injection vulnerability was found in the Restaurant_IMS project (mansi-k repository) in the mysqli_connect function of the lsmodal.php file. Manipulation of the login_id/epsw arguments allows injection of malicious SQL code. The vulnerability can be exploited remotely, and the project does not provide version details due to its rolling release model.

A SQL injection vulnerability was found in pig-mesh pig up to version 4.1.0, affecting the orderItem.getColumn function in SqlFilterArgumentResolver.java. Manipulating the ascs/descs arguments allows SQL injection, and the attack can be launched remotely. The exploit has been published and may be used.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vulnerability information is available.

A vulnerability was detected in Unitree Robotics Unitree Go2 up to versions 1.1.13/1.1.14.1/1.1.15.1. The WebSocketClient.connect function in websocket.py of the chat_go component performs improper certificate validation, enabling a remote attack of high complexity. The vendor confirmed the issue (CWE-295).