CVE Vulnerability Catalog

The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed. This allows a site administrator who is not a Super Admin to create or overwrite network-wide options.

The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages. This could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability. On WordPress Multisite this could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup. This could allow users with the author role and above to inject iframe and form elements into published pages.

The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allows unauthenticated users to achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator.

The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API. This allows unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.

The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public. This allows unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.

The Otter Blocks WordPress plugin before version 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet. This allows users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post.

The development web server (ADK Web) in Google Agent Development Kit (ADK) for Java lacks WebSocket origin validation and uses a permissive cross-domain policy. This allows a remote attacker to control a locally running agent and read its data via a malicious web page visited by a developer while the server is running. The issue is fixed in version 1.13.0.

Part-DB prior to version 2.13.3 builds the absolute URL of the password-reset link it emails from the client-supplied HTTP Host header without trusted-host validation. An unauthenticated attacker can submit a forgot-password request for a known account with a spoofed Host header, causing Part-DB to email a reset link with an attacker-controlled hostname but the genuine reset token. When the victim or an automated mail scanner opens the link, the token is disclosed to the attacker, who can replay it to take over the account, including the seeded admin account.

Part-DB prior to version 2.13.2 contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with import permission can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the part is later exported as an XLSX spreadsheet, Part-DB writes the value using setCellValue() without neutralizing formula characters, so the exported file may contain an executable formula that could be evaluated by another user's spreadsheet software.

Part-DB prior to version 2.13.2 allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encoded file data. The application enforces the size limit for normal browser-based uploads, but the API base64 upload path does not apply the same validation. As a result, an authenticated user with API access and permission to create attachments can upload files larger than the configured maximum, potentially exhausting disk space and causing a denial of service.

Part-DB prior to version 2.13.2 allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment downloads are enabled, Part-DB downloads the remote file and streams it directly to disk without enforcing the MAX_ATTACHMENT_FILE_SIZE limit. As a result, an authenticated user who can create or edit attachments can cause Part-DB to store files larger than the configured maximum, potentially exhausting disk space and causing a denial of service.

Part-DB prior to version 2.12.3 sanitizes SVG files based solely on the user-controlled filename extension rather than the actual file content type. An authenticated attacker can upload a malicious SVG with a JavaScript payload using a non-SVG extension (e.g., .jpg), bypassing sanitization entirely. When any user views the attachment inline, the browser receives Content-Type: image/svg+xml and executes the embedded script in the Part-DB origin.

Lookyloo prior to version 1.39.4 allows an unauthenticated user to trigger the “report a capture” email on demand (which is expected). The /json/<uuid>/report API endpoint (CaptureReport) incorrectly passes the email and comment parameters, overwriting as_admin. When True, as_admin triggers a search query on a MISP instance (if configured) and adds a list of matching URLs to the email sent to the analyst (not the submitter, so there is no risk of information leakage). This could potentially cause a DoS on the MISP instance.

The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 1.4.7 via the 'f' parameter. This allows unauthenticated attackers to read arbitrary files on the server, which may contain sensitive information. Exploitation requires a valid purchase_id token, obtainable by any user through a single low-cost purchase or a shared download link.

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to and including 6.89.1 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires open user registration, and script execution is triggered when an Administrator runs the plugin's user-spam scan and views the Non-checkable users or Spam users tab.

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, for example to delete accounts from the BMC's Redfish service.

OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident}, i.e., not using the specific maintenance endpoint.

In Part-DB before version 2.12.2, BOM validation messages are rendered using Twig's |raw filter and include translated placeholders populated with user-controlled Part names. A user who can edit a Part name can store HTML markup that is rendered in another user's BOM validation result page, resulting in cross-user stored HTML injection.