CVE Vulnerability Catalog

The Arraytics Booktics plugin in versions up to 1.0.31 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. The issue affects all versions from the start through 1.0.31.

The Meow Gallery plugin for WordPress is vulnerable to stored cross-site scripting via Attachment Alt Text (aria-label attribute) in all versions up to and including 5.5.1 due to insufficient input sanitization and output escaping. An authenticated attacker with author-level access or above can inject arbitrary scripts that execute when a user accesses an injected page.

Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.

The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 5.5.4 because it does not properly verify that a user is authorized to perform an action. An authenticated attacker with author-level access or above can enumerate and read metadata of all private and draft posts, including post ID, title, date, author, and status.

Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator downloads the file and clicks Preview Media, content-sniffed HTML from /direct/view renders same-origin, stealing localStorage JWTs for full GraphQL and REST access.

changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter slugs and integer news IDs against preview endpoints to read draft posts, unsent newsletters and declined news items.

Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation view. Attackers can send an email with HTML and script in the From display name that executes when the recipient opens the folder, enabling mailbox content theft or redirection.

The CP Multi View Events Calendar plugin for WordPress is vulnerable to stored cross-site scripting via the 'Subject' parameter in all versions up to and including 1.4.43 due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or above can inject arbitrary scripts that execute when a user accesses an injected page.

The GeoDirectory plugin for WordPress (versions up to and including 2.8.199) is vulnerable to Stored Cross-Site Scripting via the listing description (post_content). Insufficient input sanitization on save combined with the AyeCode UI library, which inserts the data-bs-content value as HTML into a popover, allows authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts.

In FreeRTOS-Kernel before V11.3.3, on MPU-enabled ports with queue sets enabled, missing queue-set type validation in the queue-set selection system call allows a local unprivileged task to write actor-controlled data beyond a pointer-sized object on the privileged kernel stack, affecting privileged memory across the MPU isolation boundary.

The GeoDirectory plugin for WordPress (all versions up to and including 2.8.198) is vulnerable to arbitrary shortcode execution. The software allows users to execute an action that does not properly validate a value before running do_shortcode, enabling unauthenticated attackers to execute arbitrary shortcodes.

The Like Button Rating ♥ LikeBtn plugin for WordPress (all versions up to and including 2.6.64) is vulnerable to Stored Cross-Site Scripting via the 'HTTP_CLIENT_IP (Client-IP header)' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user visits the injected page. Exploitation requires the administrator to have disabled the default 'Be GDPR compliant' option and an additional administrator action.

The Themify Builder plugin for WordPress (versions up to and including 7.8.4) is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font (tb_cf) posts. Insufficient input sanitization and output escaping on the variations post meta allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute on the Custom Fonts admin listing.

The Majestic Support plugin for WordPress (all versions up to and including 1.2.2) is vulnerable to generic SQL Injection via the 'columns (array keys)' parameter due to insufficient escaping on user-supplied input and lack of sufficient preparation on the existing SQL query. This allows authenticated attackers with subscriber-level access and above to append additional SQL queries to extract sensitive information from the database.

The FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.55.7212) is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_video][]' parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute when a user visits the injected page. This requires an administrator to have enabled the 'Allow visitors to upload videos to their profile' setting.

The FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.55.7212) is vulnerable to Stored Cross-Site Scripting via the 'comment (shortcode attribute 'align')' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user visits the injected page. This requires the plugin's 'Parse Vimeo and YouTube links' setting to be enabled.

The FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.55.7212) is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user visits the injected page. This requires the 'Parse Vimeo and YouTube links' option to be enabled and a site administrator to approve the comment containing the malicious shortcode.

The OpenStation plugin for WordPress (all versions up to and including 1.1.16) is vulnerable to authorization bypass due to improper verification of user authorization. This allows authenticated attackers with subscriber-level access and above to modify arbitrary other users' placement rows and read serialized metadata. Exploitation requires at least one orphaned placement to exist and the attacker to self-enable OpenStation.

The JS Help Desk plugin for WordPress (versions up to and including 5.0.1) is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function. An authenticated attacker with administrator-level access can delete arbitrary files on the server, potentially leading to remote code execution if a critical file such as wp-config.php is deleted. Exploitation requires a two-step sequence: saving a traversal-crafted value in the support_custom_img configuration field, then triggering deletion by uploading a new support custom image.

The Redux Framework plugin for WordPress (versions up to and including 4.5.15) is vulnerable to stored cross-site scripting via the multi_media field. The field's renderer prints the stored value into an href attribute, a hidden input value, and an HTML element without escaping, and user_meta_save() checks permissions against a user ID from the request body, allowing a Subscriber to write a field declared for manage_options. An authenticated attacker with Subscriber-level access can inject arbitrary scripts into their own profile that execute when an administrator views that profile.