CVE Vulnerability Catalog

The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded visitor's IP address, user agent and referer.

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter (also function, plugin, post_type, post_status, ids, loggedout, and POST post_title) in all versions up to and including 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

A flaw was found in spice-server where the GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback. An authenticated malicious SPICE client during VM live migration can trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.

Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.

Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause browse, restore, history, and delete operations to resolve to a path outside the repository, via a percent-encoded traversal sequence (%2e%2e) in the request path. The issue arises because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user must already have permissions on it.

The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by tricking the user into opening a crafted URL and clicking the Reset button or submitting an empty search.

The GeoDirectory plugin for WordPress (versions up to and including 2.8.191) is vulnerable to Stored Cross-Site Scripting via the 'post_content' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or above can inject arbitrary scripts into pages that execute when a user visits the injected page. This requires the attacker to own a published listing, but edits to an already-published listing bypass re-moderation and remain live immediately.

The Events Made Easy plugin for WordPress (versions up to and including 3.2.22) is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. This vulnerability is only exploitable when both the guest event submission feature (eme_fs[guest_submit]) and forced location creation (eme_fs[force_location_creation]) are explicitly enabled by a site administrator, as both settings default to off.

NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes. The NordVPN user-mode application allows a low-privileged attacker to act as a trusted process and connect to the named pipe "\\.\pipe\nord-security\v1\NordVpnService\Server". The attacker can then invoke the "ISettingsGrpc.StopService" and "ISettingsGrpc.ChangeServiceStartType" methods with an arbitrary service name, leading to denial of service of critical system services. Services protected by Windows (PPL processes, Windows Tamper Protection), such as Windows Defender, cannot be stopped or reconfigured. This issue was fixed in version 8.12.

The Tutor LMS plugin for WordPress (versions up to and including 4.1.0) is vulnerable to Stored Cross-Site Scripting via the display_name parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or above can inject arbitrary scripts into pages that execute when a user visits the injected page. Exploitation requires that a Legal Consent record exists for the attacker's user account, causing the View Logs button to appear in the wp-admin/users.php Consent Logs column.

The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This allows unauthenticated attackers or authenticated attackers holding any POS role to append additional SQL queries to extract sensitive information from the database.

Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows exploitation of non-production interfaces. This issue affects Costifier through 2026-10-16. The vendor was contacted early about this disclosure but did not respond in any way.

Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows exploitation of trusted identifiers. This issue affects Costifier through 2026-10-16. The vendor was contacted early about this disclosure but did not respond in any way.

IKAS Technology Inc. Ikas E-Commerce Infrastructure contains an observable response discrepancy vulnerability that allows account footprinting. This issue affects Ikas E-Commerce Infrastructure through 2026-07-13.

An SQL injection vulnerability has been discovered in TSG Profleet. An attacker could retrieve, create, update and delete data from the database by sending a GET request using the 'Identificación' parameter of the '/cgi-bin/index.php' endpoint.

The DoubleScale | All-in-One CRM plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store_upload function. This is due to a fail-open extension allow-list in extension_is_allowed() that returns true when wp_check_filetype() yields an empty type for unrecognized extensions such as .php, combined with magic-byte-only MIME detection and no capability check beyond is_user_logged_in().

The SureCart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dir' shortcode attribute in all versions up to and including 1.34.2 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or higher can inject arbitrary scripts into pages that execute whenever a user visits the injected page.

The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to and including 4.17.5. The get_user_profile_structure() function assembles the front-end profile buffer, including raw comment excerpts, and passes the entire buffer to do_shortcode() after only a narrow neutralization pass, allowing an authenticated attacker with Subscriber-level access or higher to inject arbitrary shortcodes with attacker-chosen attributes via a comment.