CVE Vulnerability Catalog

The fanx_fingerprint function in ssl/sslxprint.c of ssldump miscalculates the heap buffer size, resulting in a 3-byte heap-based buffer overflow on every invocation with valid inputs. An attacker can supply a crafted pcap file containing a TLS X.509 certificate to trigger the overflow when ssldump is run with FAN/1 fingerprinting enabled.

The SiteOrigin CSS plugin for WordPress (versions up to and including 1.6.7) is vulnerable to stored DOM-based Cross-Site Scripting via the 'href' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The Quick PayPal Payments: Payment Button & Form plugin for WordPress in versions up to and including 6.0.4 is vulnerable to Stored Cross-Site Scripting via the 'form' parameter. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The NotificationX plugin for WordPress (versions up to and including 3.3.3) is vulnerable to stored Cross-Site Scripting via the 'name' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The User Profile Builder plugin for WordPress (versions up to and including 4.0.3) is vulnerable to privilege escalation via the 'role' parameter handled by the wppb_add_meta_to_user_on_activation() function. An unauthenticated attacker can gain a fully activated WordPress administrator account by submitting role=administrator through the public registration form and clicking the confirmation activation link.

The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress in versions up to and including 3.6.1 is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter. Authenticated attackers with vendor-level access and above can append additional SQL queries into existing queries to extract sensitive information from the database.

The Salon Booking System plugin for WordPress (versions up to and including 10.31.9) is vulnerable to stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The SiteOrigin CSS plugin for WordPress (versions up to and including 1.6.7) is vulnerable to stored DOM-based Cross-Site Scripting via the 'url (comment_author_url)' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress in versions up to and including 4.0.3 is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Search Regex plugin for WordPress version 3.5 is vulnerable to PHP Object Injection via deserialization of untrusted input in the replace_all function. An authenticated attacker with subscriber-level access or higher can inject a PHP Object, and the presence of a POP chain allows code execution.

The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress in versions up to and including 4.11.1 is vulnerable to arbitrary shortcode execution. Authenticated attackers with subscriber-level access and above can save a shortcode payload to their Biographical Info field, which then executes on any unauthenticated front-end request that resolves that author's description.

The Simply Schedule Appointments plugin for WordPress (versions up to and including 1.6.12.35) is vulnerable to stored Cross-Site Scripting via the 'status' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The Ultra Addons for Contact Form 7 plugin for WordPress (versions up to and including 3.5.54) is vulnerable to stored Cross-Site Scripting via File Upload due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The 10Web Booster plugin for WordPress (versions up to and including 2.34.5) is vulnerable to limited file write via path traversal. An unauthenticated attacker can create arbitrary directories outside the cache root and write cached pages into them, leading to cache poisoning and arbitrary directory creation.

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments, allowing unauthenticated attackers to upload files that may be executable, making remote code execution possible.

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to and including 3.0.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute when a user visits an injected page. The wp_kses_post filter does not strip the payload because angle-bracket characters are not required, letting the unescaped attribute value survive storage and fire as a live event handler in the unauthenticated (guest) rendering branch.

The User Profile Builder plugin for WordPress (versions up to and including 4.0.3) is vulnerable to Stored Cross-Site Scripting via the First Name field due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. This vulnerability is only exploitable when the Email Confirmation feature is enabled in Profile Builder.

The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-axis column value parameter in all versions up to and including 3.0.6 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts that execute when a user visits an injected page. It requires an administrator to have published a chart whose SQL query returns a column controllable by a lower-privileged user, such as wp_users.display_name, which a Subscriber can populate with a payload via the standard WordPress profile page.

The Broken Link Checker plugin for WordPress in versions up to and including 2.4.14.1 is vulnerable to arbitrary shortcode execution because it does not properly validate a value before running do_shortcode. Unauthenticated attackers can execute arbitrary shortcodes if a submitted comment containing the payload in an href or src attribute is approved through the normal comment moderation workflow; once approved, the shortcode executes automatically via WP-Cron.

The Nexter Extension plugin for WordPress (versions up to and including 4.7.11) is vulnerable to privilege escalation. The /?reset-view handler in role_switcher_to_view_admin_as() performs no nonce or capability check, and the profile_update cleanup hook does not fire during bulk role changes via wp-admin/users.php?action=promote, leaving a stale 'administrator' value in user meta.