CVE Vulnerability Catalog

The NextGEN Gallery plugin for WordPress (up to and including 4.4.1) is vulnerable to Remote Code Execution via the render_image function. This is due to unrestricted mass assignment of caller-supplied meta_data keys onto the image model, missing realpath containment in path construction, and a bypassable signature check on the public image delivery route. An authenticated attacker with custom-level access and above can execute code on the server.

A flaw was found in json-glib where the JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.

The Debug Log Manager plugin for WordPress (up to and including 2.5.2) is vulnerable to Stored Cross-Site Scripting via the 'message (and pageUrl)' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that will execute when a user accesses an injected page. This requires debug logging enabled with JS error logging active and the attacker obtaining the publicly emitted dlmVars.jsErrorLogging nonce.

A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. decompress_xpi_thread() used libarchive with archive_read_support_format_all(), allowing a TAR file named *.xpi to be extracted; a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a warning dialog, when the user installs or opens the crafted .xpi.

A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In set_permission(), types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored, so control fell into an else-if branch that always set EPHY_PERMISSION_PERMIT for ACCESS_WEBCAM and ACCESS_MICROPHONE. A malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt.

The GeoDirectory plugin for WordPress (up to and including 2.8.197) is vulnerable to Stored Cross-Site Scripting via the 'post_images' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access and above can inject arbitrary web scripts into pages that will execute when an Administrator or Editor opens the pending listing's edit screen. The payload does not fire for the attacker directly but executes in the victim's browser, enabling privilege escalation.

The Germanized for WooCommerce plugin (up to and including 4.1.4) is vulnerable to Unauthorized Access of Private Data via Activation Token Reuse. The on_user_email_changed hook, responsible for rotating the activation token and recording a pending-email-change marker, is only registered inside the is_double_opt_in_login_enabled() branch when "Disable login for unactivated customers" is set to Yes, leaving the original ?activate= token valid and unbound to the email address when the setting is No. An authenticated attacker with subscriber-level access can change their account email to a victim's billing email and redeem the original activation token to reassign guest orders and expose the victim's billing data.

The WP Directory Kit plugin for WordPress (up to and including 1.6.0) is vulnerable to generic SQL Injection via the 'idfield' parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. An unauthenticated attacker can append additional SQL queries into already existing queries to extract sensitive information from the database.

The FlexStock plugin for WordPress (up to and including 3.17.2) is vulnerable to Stored Cross-Site Scripting via the 'products[].post_content' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access and above can inject arbitrary web scripts into pages that will execute when a user accesses an injected page. This is exploitable by any Subscriber-level user because the plugin's admin_enqueue_scripts callback exposes the REST bearer token in the Dashboard page source without a capability check, and the REST endpoint's permission_callback validates only that bearer token rather than performing a current_user_can() capability check.

The WooCommerce Extra Product Options Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '<fieldname>_start / <fieldname>_end' parameter in all versions up to and including 3.3.2 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into performing an action such as clicking a link. The vulnerability is only exploitable on product pages where a Date & Time Range Picker extra field is configured, though the required field name is visible in the product page source.

The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'querystring:<key>' URL parameter in all versions up to and including 3.15.5 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into performing an action such as clicking a link. The bypass is triggered when an attacker supplies a matching 'field:<key>' URL parameter that causes the server to fully resolve the {field:*} placeholder, forcing the client-side else-branch to abandon the server-sanitized value and reconstruct field content from the raw query string.

The WP Activity Log plugin for WordPress (versions up to and including 5.6.1) is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page.

The Smart Post plugin for WordPress (versions up to and including 4.0.9) is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page. Exploitation requires the victim page to contain an Author Filter block alongside a grid or live-filter block, and execution is triggered by a visitor clicking the attacker's author entry in the dropdown.

The SimpleForm plugin for WordPress (versions up to and including 3.10.2) is vulnerable to arbitrary file upload via the handle_upload function. Missing a server-side file key allowlist and pre-sanitization extension derivation allows a trailing-dot filename to bypass all extension and MIME validation, enabling unauthenticated attackers to upload executable files and achieve remote code execution. The only access control is a nonce printed into every public form's data-nonce attribute, trivially obtainable by any unauthenticated visitor.

A flaw was found in konflux-ci that allows privilege escalation when the user interface proxy automatically disables TLS certificate verification for connections to internal backend services in environments lacking a default service certificate authority. Because the proxy attaches a cluster-scoped authentication token with user impersonation rights to these requests, an adjacent network attacker capable of intercepting traffic can capture the credentials to gain full administrative control of the cluster.

A flaw was found in konflux-ci that allows an attacker with repository write access to achieve arbitrary code execution within the CI/CD workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest synchronization scripts to dynamically evaluate unvalidated script output. Successful exploitation allows compromise of CI/CD pipelines, theft of sensitive authentication tokens and deployment credentials, and unauthorized access to production systems.

A flaw was found in konflux-ci that allows an attacker with permission to trigger automated workflow runs to cause information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing injection of malicious filter commands. As a result, sensitive information such as API credentials, deployment keys, and internal notes may be exposed in workflow logs.

A flaw was found in konflux-ci where CI automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potentially allowing them to modify source code or release artifacts.

The FeedWordPress plugin for WordPress (versions up to and including 2026.0517) is vulnerable to Stored Cross-Site Scripting via syndicated RSS/Atom feed content. The SyndicatedPost::sanitize_content() function only strips the 'target' attribute, and SyndicatedPost::insert_post() deliberately removes WordPress's wp_filter_kses and wp_filter_post_kses filters before persisting imported feed items. This allows unauthenticated attackers who control an external feed that a site has already subscribed to to inject arbitrary web scripts into pages.

The All in One SEO plugin for WordPress in versions up to and including 5.0.3 is vulnerable to Sensitive Information Exposure via the 's' parameter. Unauthenticated attackers can extract arbitrary non-public post meta values, including sensitive custom fields such as API keys and internal notes, which are emitted verbatim into the HTML title element and JSON-LD SearchResultsPage schema.