CVE Vulnerability Catalog

The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access.

The PowerPress Podcasting plugin by Blubrry for WordPress before version 11.16.11 does not sanitize and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

The Brizy WordPress plugin before version 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box. Users with the Contributor role or above can inject arbitrary web scripts that execute in the session of a higher-privileged user who opens the post for review.

The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history.

The miniOrange 2FA WordPress plugin before version 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the site's metered OTP allowance, preventing legitimate users from receiving their second-factor codes.

The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen. This allows users with the Editor role (or Contributor/Author when enabled) to inject arbitrary JavaScript that executes in the session of any higher-privileged user who views that screen.

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.

SQL Injection vulnerability in the WordPress plugin 'Database for Contact Form 7, WPforms, Elementor forms' before version 1.5.5. A parameter is not properly sanitized and escaped before being used in a SQL statement, allowing SQL injection by users with a specific capability (default administrators, but can be delegated).

The Paid Membership Subscriptions WordPress plugin before version 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user. This allows any authenticated user with Subscriber-level access and above to take over another member's subscription and overwrite its plan, status and expiration.

The Quiz and Survey Master (QSM) WordPress plugin before version 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute. This allows users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.

The GDPR Framework By Data443 WordPress plugin before version 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests. This allows unauthenticated attackers to forge consent records for arbitrary email addresses and to flood the site's privacy-request queue with arbitrary entries.

The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account. This allows subscriber-level users to write administrator-controlled account-state and reputation fields on their own profile, including self-activating a pending or banned account and forging their forum reputation score.

The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints. This allows unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation does not cover (a blind Server-Side Request Forgery).

A vulnerability in DWSurvey up to 6.14.0 affects an unknown function in the file /api/dwsurvey/app/survey/up-survey-status.do of the Survey Status Handler component. This manipulation causes improper authorization. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A vulnerability was found in DWSurvey up to version 6.14.0 in the function DwDeisgnSurveyController.devSurvey in the file /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do. Manipulation leads to authorization bypass. The attack can be launched remotely, and the exploit has been made public.

A vulnerability has been found in kalcaddle kodbox 1.67 Build 02 in the file /user/sso/apiLogin of the SSO API Login component. Manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely, and the exploit has been publicly disclosed.

An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an attacker on the WLAN to bypass captive portal authentication.

A flaw has been found in kalcaddle kodbox 1.67 Build 02. The vulnerability affects unknown code in the file /index.php?plugin/msgWarning/action of the msgWarning Plugin component. Manipulation can lead to improper authorization, and the attack can be launched remotely. The exploit has been published and may be used.

A path traversal flaw in WildFly's domain mode implementation allows a remote attacker who has obtained the slave host controller secret or compromised a slave host controller to supply a crafted relative path containing directory traversal sequences, causing the Domain Controller to resolve and serve arbitrary files readable by the DC process. This leads to unauthorized disclosure of sensitive information.

A vulnerability in sar2html 4.0.0 affects an unknown part of the file sar2html.py in the Search component. Manipulating the Search argument results in SQL injection. The attack can be initiated remotely, and the exploit is now public.