CVE Vulnerability Catalog

Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the replacePeerFiles permission is never enforced, allowing an authenticated low-privilege author with replaceFiles permission to overwrite peer asset files.

Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method checks permissions only against the user's own provisional draft, then deletes the canonical element without re-checking, allowing an authenticated user without deleteEntriesForSite permission to hard-delete entries.

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments(). Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites.

Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files.

Unauthenticated Cross-Site Request Forgery (CSRF) in Mang Board WP versions up to 2.3.8.

Unauthenticated CSRF vulnerability in Simply Schedule Appointments versions up to 1.6.12.23. An attacker can exploit this to perform unauthorized actions in the context of a logged-in administrator.

Unauthenticated CSRF vulnerability in Activity Log versions up to 2.13.1. The vulnerability allows an attacker to perform unauthorized operations on behalf of an administrator.

Unauthenticated XSS vulnerability in Estatik versions up to 4.3.4. An attacker can inject a malicious script that executes in the victim's browser.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore WooCommerce Product Attachment woo-product-attachment allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Attachment: from n/a through 2.3.4.

Unauthenticated PHP object injection in Ninja Forms - Layout & Styles versions up to 3.0.31. An attacker can inject malicious PHP objects, potentially leading to remote code execution.

Unauthenticated XSS vulnerability in TrustedSite versions up to 1.2.5. An attacker can inject a malicious script that executes in the victim's browser.

Unauthenticated XSS vulnerability in Interactive Geo Maps versions up to 1.6.30. An attacker can inject a malicious script that executes in the victim's browser.

Incorrect privilege assignment vulnerability in LiquidThemes Booking Hub allows privilege escalation. This issue affects versions from n/a through 1.3.1.

Unauthenticated XSS vulnerability in MP3 Audio Player for Music, Radio & Podcast by Sonaar versions up to 5.13.1. An attacker can inject a malicious script that executes in the victim's browser.

Unauthenticated XSS vulnerability in Upsell Order Bump Offer for WooCommerce versions up to 3.1.5. An attacker can inject a malicious script that executes in the victim's browser.

The WP User Frontend plugin in versions up to 4.3.10 contains a PHP Object Injection vulnerability exploitable by subscribers. An attacker with subscriber role can exploit this to perform unauthorized operations.

In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper in the connectivity service injects header values into a JSON template without proper escaping, allowing JSON structure break-out and injection of additional fields. An attacker controlling a header (e.g., MQTT 5 user property, AMQP 1.0 application property, or Kafka record header) can inject an inline _policy object, overriding the administrator-configured policyId.

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to, and uploads into, potentially resulting in remote code execution.

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories.

The Broken Link Checker plugin for WordPress up to version 2.4.13 is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to perform the plugin's standard dismiss-and-recheck workflow on a link submitted by the attacker via the WordPress comment author URL field, after which the attacker's HTTP server issues a redirect to a URL containing an HTML/JavaScript payload that is stored verbatim in the link log.