CVE Vulnerability Catalog

The WP Photo Album Plus plugin up to version 9.2.03.001 is vulnerable to stored Cross-Site Scripting (XSS) due to a double-encoding flaw in the photo comment pipeline. An attacker can submit a double HTML-entity-encoded payload (e.g., <img src=... onload=...>) that passes filters and is stored, then executes in the victim's browser.

The Ultimate Addons for WPBakery Page Builder WordPress plugin before version 3.21.5 has a vulnerability in the shared link-rendering function Ultimate_VC_Addons::uavc_link_init(). The description does not provide further details.

The Paid Membership Subscriptions WordPress plugin before version 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions. Any authenticated user (Subscriber and above) can disclose the payment details of any member by enumerating the payment identifier.

The NewStatPress WordPress plugin before version 1.4.5 does not sanitize and escape data from unauthenticated visitor requests before storing and later outputting it in one of its widgets. This allows unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users viewing the affected widget.

The Events Made Easy WordPress plugin before version 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request. It relies only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to overwrite the personal data of any person record.

The Mailgun for WordPress plugin before version 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing lists. This allows unauthenticated attackers to enrol arbitrary email addresses into those lists using the owner's stored API credentials.

The Lightbox with PhotoSwipe WordPress plugin before version 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser. Users with author-level access and above (who lack the unfiltered_html capability) can store JavaScript that runs when a visitor or administrator opens the lightbox.

The Check & Log Email WordPress plugin before version 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.

The GiveWP WordPress plugin before version 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input. This allows unauthenticated users to complete donations through a payment gateway the administrator has disabled.

The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user.

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above (enrolled in any single course) to read every user's quiz attempts across the whole site, including personal data such as IP addresses, names, registration dates and quiz results.

In CodeIgniter before version 4.7.4, IncomingRequest::isSecure() trusts X-Forwarded-Proto and Front-End-Https headers, allowing an attacker to spoof them and cause the application to incorrectly treat an HTTP request as secure, potentially affecting HTTPS enforcement logic.

In Cloudreve before version 4.17.0, WOPI session validation uses only the session-id prefix of the access token and does not enforce the requested action, allowing a malicious viewer to forge the token suffix and invoke file write operations.

In Cloudreve before version 4.17.0, a single-file share event-stream subscription resolves the share root to the owner's parent folder and subscribes to it, allowing an authenticated share recipient to receive information about unshared sibling files and folders.

Cloudreve before version 4.17.0 has a vulnerability in thumbnail and avatar decoders that limit compressed file size but not decoded pixel dimensions. An authenticated user can submit a small PNG, JPEG, or GIF that triggers unbounded memory allocation and terminates the Cloudreve process due to an out-of-memory error.

Cloudreve before version 4.17.0 has a vulnerability in the GET /api/v4/user/search endpoint that calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser. This allows any logged-in user to enumerate email addresses and profile metadata for inactive or banned accounts.

Cloudreve before version 4.17.0 has a vulnerability in the WOPI PUT_RELATIVE handler that passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename. This allows slash and dot-dot segments to escape the source file directory and create or conditionally overwrite files elsewhere in the same owner account.

A stack-based buffer overflow vulnerability in the upload functionality could allow an authenticated attacker to achieve code execution.

In Google mcp-toolbox versions 0.3.0 through 1.4.0, an SSRF vulnerability exists in HTTP source and tool components due to missing restrictive CheckRedirect policy and target IP validation, allowing requests to be redirected to internal or arbitrary external endpoints.

The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 multicast messages. A specially crafted GOOSE frame containing an undersized timestamp field can trigger a heap out-of-bounds read during message processing, causing the process to crash and resulting in a denial-of-service condition.