CVE Vulnerability Catalog

Subscriber-level Cross Site Scripting (XSS) vulnerability in Accordion plugin versions up to and including 3.0.6.

Cross Site Scripting (XSS) vulnerability in FluentCommunity versions up to 2.7.5, exploitable by a user with Subscriber role.

Broken Access Control vulnerability in Internal Link Optimiser versions up to 5.2.7, exploitable without authentication.

Cross Site Scripting (XSS) vulnerability in AfterShip Tracking versions up to 1.18.1, exploitable by a user with Subscriber role.

Broken Access Control vulnerability in AI for SEO versions up to 2.4.2, exploitable without authentication.

Cross Site Scripting (XSS) vulnerability in Profile Extra Fields by BestWebSoft versions up to 1.3.4, exploitable by a user with Subscriber role.

Broken Access Control vulnerability in ReactPress versions up to 3.4.0, exploitable by a user with Subscriber role.

Broken Access Control vulnerability in WP Social Avatar versions up to 1.5, exploitable without authentication.

Sensitive Data Exposure vulnerability in Payment Forms for Paystack versions up to 4.0.5, exploitable by a user with Subscriber role.

Broken Access Control vulnerability in Secure Card Gateway for ePay Paycenter (Piraeus Bank) versions up to 1.0.32, exploitable without authentication.

Cross Site Scripting (XSS) vulnerability in AcyMailing SMTP Newsletter versions up to 10.11.1, exploitable by a user with Subscriber role.

Broken Access Control vulnerability in AcyMailing SMTP Newsletter up to version 10.11.1 allows a subscriber to gain unauthorized access to administrative functions.

Sensitive data exposure vulnerability in WP Event Solution up to version 4.1.18 allows unauthorized access to customer data.

Broken Access Control vulnerability in Service Finder Booking up to version 6.2 allows a subscriber to gain unauthorized access to administrative functions.

Unauthenticated Insecure Direct Object References (IDOR) vulnerability in Do Lasso up to version 358 allows an unauthenticated attacker to access objects without authorization.

Broken Access Control vulnerability in Tourfic up to version 2.23.1 allows a subscriber to gain unauthorized access to administrative functions.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Popup by Supsystic up to version 1.11.2 allows an unauthenticated attacker to inject malicious scripts.

HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions.

Stored Cross-site Scripting (XSS) vulnerability in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML() before interpolating it into the onclick attribute of the account deletion button, but the browser HTML-decodes attribute values before the JavaScript engine parses the handler, allowing an encoded single quote (') to break out of the string literal and inject arbitrary JavaScript that executes when the victim clicks the delete button for that account.

HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain conditions.