CVE Vulnerability Catalog

The Chaty Pro plugin for WordPress is vulnerable to time-based blind SQL Injection. Authenticated attackers with subscriber-level access can inject arbitrary SQL commands.

The ShopLentor plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter. Authenticated attackers with admin access can inject SQL queries.

The ShopLentor plugin for WordPress up to version 3.4.5 is vulnerable to Insecure Direct Object Reference via the 'optionSection' parameter. Authenticated attackers with contributor-level access or higher can read arbitrary WordPress option rows, including internal plugin news feed data, WooCommerce block pattern transients, and third-party configuration records stored as arrays-of-arrays with 'title' keys.

The Advanced Form Integration plugin for WordPress up to version 2.6.0 fails to properly verify user authorization. Authenticated attackers with subscriber-level access or higher can overwrite stored MailUp OAuth tokens in the adfoin_mailup_keys option, hijacking form submission data to an attacker-controlled MailUp account or breaking the integration entirely.

The Cookie Banner plugin for WordPress up to version 4.3.7 is vulnerable to Cross-Site Request Forgery in the process_bulk_action function due to missing nonce validation. Unauthenticated attackers can permanently delete or forcibly resolve GDPR data request records stored in the wpl_data_req table by tricking a site administrator into clicking a link.

The Demi plugin for WordPress up to version 0.0.8 allows unauthenticated attackers to copy arbitrary files on the server via the handle_restore_step function. Lack of access controls on the wp-content/uploads/demi-backup-state/ directory exposes the restore key used to authenticate the unauthenticated AJAX handler. The attack requires a prior restore operation to have been initiated.

The FluentCart WordPress plugin before version 1.4.0 does not verify that a subscription belongs to the requesting customer in several payment-method endpoints. This allows any authenticated customer to act on another customer's subscription (changing payment method, cancelling, or re-binding it) when they know the target subscription identifier.

The PDFDraft plugin for WordPress up to version 1.1.0 lacks capability checks in the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route. Unauthenticated attackers can download stored template PDFs, which may contain customer PII, invoices, orders, and certificate data, by using known or guessable design slugs.

The nice-select2 library before version 2.4.1 is vulnerable to Cross-site Scripting (XSS) via the <select> element. An attacker can supply a malicious payload that is rendered directly into the DOM without proper sanitization, causing arbitrary script execution in a victim's browser when they view or interact with the affected page.

Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner – AcyChecker versions up to 1.8.1.

Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) versions up to 1.3.0.

In Milk admin version 0.9.8 and earlier, a cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request.

IDOR vulnerability in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/delete/{id}`. An authenticated user can delete notifications of any other user without ownership verification, as the controller does not check `user_id` or `company_id`. Notification IDs are sequential, allowing iteration and systematic deletion.

React Router versions 6.0.0 through 7.17.0 are vulnerable to Open Redirect through use of backslashes in <Link> and useNavigate. This issue has been fixed in version 7.18.0.

React Router versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0 are vulnerable to XSS in applications that allow open redirects. An attacker could craft a malicious link that redirects users to an unexpected external site or exploits an XSS vector. This issue has been fixed in version 7.13.0.

React Router versions 7.11.0 through 7.17.0 are missing protocol validation in RSCErrorHandler, allowing redirects from untrusted sources. This only affects applications using unstable RSC APIs. Fixed in version 7.18.0.

React Router versions 6.4.0 through 7.17.0 allow unexpected constructor execution on the client if application code allows attacker-supplied input to overwrite certain aspects of SSR errors. This can trigger an outbound network request. Only affects Framework Mode and Data Mode applications performing manual SSR/hydration. Fixed in version 7.18.0.

An issue in the redirect parameter in Milk admin version 0.9.8 and earlier allows remote attackers to redirect users to arbitrary external URLs via a crafted request.

Pivotick contains an XSS vulnerability in the sidebar property-list component. Link-like property values (url, uri, href, link, website, homepage) were rendered as hyperlinks without URL scheme validation. An attacker can supply a malicious value using the javascript: scheme, including whitespace or control characters. Clicking the link can execute JavaScript in the application context. The vulnerability was fixed by normalizing values and blocking unsafe schemes.

The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to disclose kernel memory.