CVE Vulnerability Catalog

The Majestic Support plugin by Ahmad Majestic, versions up to 1.2.1, contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The Royal Elementor Addons WordPress plugin (through version 1.7.1068) contains an unsafe reflection vulnerability that uses externally-controlled input to select classes or code. This can lead to code injection.

The WordPress Sunshine Photo Cart plugin (through version 3.7.5) contains a Missing Authorization vulnerability caused by incorrectly configured access control security levels. This allows exploitation of the flawed authorization settings.

The WP Mailster plugin contains a Stored Cross-Site Scripting vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 1.9.1.0.

The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit. A deeply nested JSON document of about 20 KB causes a raw java.lang.StackOverflowError instead of a JSONException, failing the parsing thread.

The SureDash plugin by Brainstorm Force is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.12.2.

The SureDash plugin by Brainstorm Force, versions up to 1.12.2, contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this vulnerability by submitting a crafted request that conceals prohibited values from inspection, resulting in a bypass of configured security rules.

A flaw was found in mod_qos where improper boundary checking when inspecting HTTP response bodies causes the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this by triggering specially crafted server responses, crashing an Apache worker process and causing a Denial of Service (DoS).

A flaw was found in mod_qos that allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails to verify array boundaries when recording client IP addresses, leading to heap memory corruption and a crash of the web server process.

A flaw was found in mod_qos that allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during processing of percent-encoded input, the module reads past allocated memory boundaries, which can crash an Apache worker process.

The WordPress plugin Elementor Addon Elements up to version 1.14.4 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious input can be stored and executed in a user's browser.

Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor (powerpack-lite-for-elementor) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PowerPack Addons for Elementor from n/a through 3.1.0.

The WordPress Metform plugin (through version 4.3.2) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This allows exploitation of the flawed authorization settings.

The Xpro Elementor Addons plugin (versions up to and including 1.7.10) is vulnerable to Cross-Site Request Forgery (CSRF). The flaw allows an attacker to force an authenticated user to perform unintended actions.

The eRoom plugin by DigitalME, versions up to 1.7.1, contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The H5P plugin up to version 1.17.9 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. User input is not properly sanitized before being stored.

Missing Authorization vulnerability in WP Chill Strong Testimonials through 3.3.14 allows Exploiting Incorrectly Configured Access Control Security Levels. The flaw enables unauthorized access to functionality or data governed by access control.

The Falcon – WordPress Optimizations & Tweaks plugin by eLightUp, versions up to 2.12.0, contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The MarketKing plugin for WooCommerce contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects MarketKing versions up to and including 2.1.72.