CVE Vulnerability Catalog

An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination.

An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication.

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `title` attribute of the `bt_bb_service` shortcode in all versions up to, and including, 5.7.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Bold Page Builder plugin for WordPress up to version 5.7.2 is vulnerable to Stored Cross-Site Scripting via the 'background_image' parameter of the bt_bb_section shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an injected page.

The Bold Page Builder plugin for WordPress up to version 5.7.2 is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of the bt_bb_image shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an injected page.

The Bold Page Builder plugin for WordPress up to version 5.7.2 is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the bt_bb_icon shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an injected page.

The Bold Page Builder plugin for WordPress up to version 5.7.2 is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the bt_bb_css_image_grid shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an injected page.

The WP Directory Kit plugin for WordPress up to version 1.5.4 is vulnerable to generic SQL Injection via the 'data_fields_list' parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with custom-level access or higher to append additional SQL queries, potentially extracting sensitive information from the database.

The Smart Slider 3 plugin for WordPress up to version 3.5.1.38 is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an injected page.

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress up to version 3.1.1 is vulnerable to Stored Cross-Site Scripting via the Data Table 'display_options' setting. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an injected page.

The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing unauthenticated attackers to bypass its internal-address filter and make the server send requests to internal services.

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course.

The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content.

The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipment status and prematurely mark the order completed.

The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and above to store arbitrary web scripts unfiltered under a privileged user's account, executing in the context of anyone who later views that content.

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on a multisite network, files belonging to a different site they have no access to.

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered. This allows PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present.

The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators.

The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers. This allows users with a subscriber-level account to render admin-only plugin pages and disclose the plugin's stored settings.

The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview. This allows users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens the affected content in the editor.