CVE Vulnerability Catalog

The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes the order even when the server-side gateway verification fails, allowing an unauthenticated attacker to mark arbitrary orders as paid without paying.

The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or origin check. Because these are pay-later methods, an attacker can mark their own unpaid order as settled and obtain fulfilment without paying.

The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkout without paying the merchant.

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables. In multi-team mode, a task or DAG from one team could resolve another team's Connection or Variable, obtaining its credentials in full.

The Joomla extension Cotton Cloud before version 2.0.3 has improper ACL implementation, allowing authenticated users to perform file operations (read, delete, overwrite, re-assign permissions) on files owned by other users.

Velociraptor fails to sanitize data when exporting to CSV, which can lead to formula execution by Microsoft Excel during import. Cells starting with certain characters are treated as formulas, allowing arbitrary code execution.

The hunt_delete() VQL function in Velociraptor allows deleting hunts. Velociraptor misapplied the permission check, requiring only COLLECT_CLIENT (usually assigned to the 'investigator' role) instead of the DELETE_RESULTS permission (usually only assigned to administrators).

A double-free flaw was found in 389-ds-base in the get_ldapmessage_controls_ext() function. An unauthenticated remote attacker can trigger it with a single BIND request carrying a critical Session Tracking control, leading to heap corruption and potential denial of service.

Velociraptor allows reading Stacked result sets from the GUI due to incorrect path validation against the prefix deny list. A user with read access to the root org can access result sets from child orgs.

The Joomla extension tabaoca.org - Cotton Cloud before 2.0.2 has improper ACL implementation, allowing unauthenticated users to perform file operations (read, delete, overwrite, re-assign permissions) on every file managed within the extension.

An authenticated attacker with low privileges can access an endpoint in the controller's web interface vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages, limiting impact to the notification functionality.

The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not verify that the requester owns the account being queried, allowing unauthenticated attackers to retrieve the order history and purchase totals of any customer whose email address they know or can enumerate.

The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation and to clear the plugin's activity records.

The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL or check the requester's capability or nonce before making a server-side HTTP request. This allows any authenticated user, such as a subscriber, to make the site issue arbitrary requests to internal hosts and services, including requests with attacker-chosen method, headers, and body.

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when processing a front-end upload. This allows any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the plugin's front-end user upload feature to be enabled, which is not the default.

The WPC Admin Columns WordPress plugin before 2.3.4 lacks authorization checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post, and term metadata, including data belonging to administrators.

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key. The route falls back to an authentication-only gate, allowing any authenticated user such as a subscriber to overwrite the stored key and disrupt geolocation-based consent banner targeting.

The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups.