CVE Vulnerability Catalog

Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/pricing-tiers' that allow the injection and persistence of malicious JavaScript code through parameters such as 'code', 'name', and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access.

Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/payment-methods' that allow the injection and persistence of malicious JavaScript code through parameters such as 'code', 'name', and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access.

A flaw in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak occurs because the system does not inspect composite roles when checking whether a delegated administrator may assign a specific role. An administrator with limited rights can assign a role that secretly includes full administrative control.

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to and including 3.1.6. The raw $_POST['data'] array is copied into $custom_fields before validate() and sanitize() run, leaving it unsanitized when persisted.

The User Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Avatar Field in all versions up to and including 4.0.2 due to insufficient input sanitization and output escaping. It is exploitable via a nonce-free GET request to /wp-admin/profile.php without requiring a profile-form submission.

The WPForms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page_title' POST parameter and {page_title} Smart Tag in all versions up to and including 2.0.2 due to insufficient input sanitization and output escaping. It is only exploitable on forms whose confirmation message places the {page_title} Smart Tag inside an HTML attribute context.

The SSL Zen plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 4.7.42 via the 'file_name' parameter. This allows reading the contents of arbitrary files on the server.

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' and 'host' parameters in versions up to and including 4.7.42. The getMessages() function decodes base64 input and echoes raw HTML without escaping.

The WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shapes_values parameter in all versions up to and including 4.9.8 due to insufficient input sanitization and output escaping. The fc-call-nonce is exposed to all frontend visitors, and the secondary _wpnonce check can be bypassed by omitting the parameter.

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 1.4.0.5 via the 'page_url' parameter. It is only reachable when the dom_get_type setting is configured to 'wp_remote_post'.

Keycloak's mTLS holder-of-key binding ensures a token can only be used by the client that requested it by binding it to their certificate. The new Standard Token Exchange V2 feature does not check for this certificate, allowing an attacker with stolen client credentials to obtain a standard, unrestricted token.

The GeoDirectory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_hours' parameter in all versions up to and including 2.8.183 due to insufficient input sanitization and output escaping. The AJAX save handler validates only post authorship and a nonce with no additional capability check.

The Better Messages plugin for WordPress (versions up to and including 3.0.4) is vulnerable to Stored DOM-Based Cross-Site Scripting via User Display Name. Due to insufficient input sanitization and output escaping, an authenticated attacker with subscriber-level access can store a malicious script that executes whenever a user accesses the injected page.

The Better Messages plugin for WordPress (versions up to and including 3.0.4) is vulnerable to generic SQL Injection via the 'group_id' Message Meta Parameter. Due to insufficient escaping of user-supplied input, an authenticated attacker with subscriber-level access can append additional SQL queries to existing ones, enabling extraction of sensitive information from the database.

The GeoDirectory plugin for WordPress (versions up to and including 2.8.181) is vulnerable to Stored Cross-Site Scripting via a Text-type Custom Field (e.g., 'phone'). Due to insufficient input sanitization and output escaping, an authenticated attacker with subscriber-level access can inject malicious scripts that execute whenever a user accesses the injected page.

A vulnerability in the Ash library allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Arguments declared with public?: false should only be set by trusted server-side code, but the lack of a public? check on these paths enables modification from user input.

The Blog2Social plugin for WordPress (versions up to and including 9.1.0) is vulnerable to authorization bypass. Due to improper verification of user authorization, an authenticated attacker with contributor-level access can view, modify, or delete other users' Blog2Social records, including disclosing network authentication IDs and scheduled post content.

The Bookly plugin for WordPress (versions up to and including 28.2) is vulnerable to Authorization Bypass via PHP Type Juggling. Due to the use of a loose inequality operator in the verification function and lack of CSRF and authentication protection in the AJAX controller, an unauthenticated attacker can bypass phone/email ownership verification and overwrite any Bookly customer's data.

The Gutenverse plugin for WordPress (versions up to and including 4.0.8) is vulnerable to Stored Cross-Site Scripting via the Post Comment Block 'suffixMain' Attribute. Due to insufficient input sanitization and output escaping, an authenticated attacker with contributor-level access can inject malicious scripts that execute whenever a user accesses the injected page.

The JetFormBuilder plugin for WordPress (versions up to and including 3.6.5.3) is vulnerable to Reflected Cross-Site Scripting via the 'jfb_xss' URL Query Variable Parameter. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject malicious scripts that execute if they can trick a user into clicking a link.