CVE Vulnerability Catalog

The SureDash – Community, Courses & Member Dashboard plugin for WordPress up to version 1.10.0 is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page.

The Rich Showcase for Google Reviews plugin for WordPress up to version 6.9.9 is vulnerable to Stored XSS via the 'pagination' shortcode attribute. Authenticated attackers with contributor-level access can inject arbitrary scripts that execute when a page is visited.

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected XSS via the 'category_id' parameter in all versions up to 1.8.13. An attacker can inject arbitrary scripts that execute when a victim clicks a link, but only in browsers supporting access keys.

In affected versions of Octopus Deploy, insufficient checks on project trigger actions allow an unauthorized user to trigger a deployment.

In Red Hat Quay, the Slack and generic webhook notification handlers do not validate URLs against SSRF. A repository administrator can force the Quay worker to send POST requests to internal network addresses or cloud endpoints.

The Open User Map – Interactive Leaflet Maps plugin for WordPress up to version 1.4.45 is vulnerable to Stored XSS via shortcode attributes. Authenticated attackers with contributor-level access can inject scripts that execute even when a post is pending review.

The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress up to version 2.3.0 is vulnerable to Stored Cross-Site Scripting via the 'redirect-to' Shortcode Attribute due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts, but the XSS payload is in a hidden attribute, so it only fires in specific browsers when specific access keys are used, making exploitation unlikely.

The Visualizer – Tables & Charts Manager plugin for WordPress is vulnerable to Stored XSS via the 'backend-title' parameter due to insufficient input sanitization and output escaping. Attackers with contributor-level access can inject arbitrary scripts.

The Brands for WooCommerce plugin for WordPress is vulnerable to Stored XSS via the 'width' Shortcode Attribute due to insufficient input sanitization. Attackers with contributor-level access can inject arbitrary scripts.

The WP Hotel Booking plugin for WordPress is vulnerable to Stored XSS via the 'widget_search' Shortcode Attribute due to insufficient input sanitization. Attackers with contributor-level access can inject arbitrary scripts, but exploitation requires browsers supporting access keys.

The Cozy Blocks plugin for WordPress up to version 2.2.11 is vulnerable to Stored XSS via the 'icon.view' block attribute. Authenticated attackers with contributor-level access can inject arbitrary scripts that execute when a user accesses the page.

The Cozy Blocks plugin for WordPress up to version 2.2.11 is vulnerable to Stored XSS via the 'cozyCustomFont' block attribute. Authenticated attackers with contributor-level access can inject arbitrary scripts that execute when a user accesses the page.

The Payment Plugins for Stripe WooCommerce plugin for WordPress up to version 4.0.7 fails to properly verify user authorization. An unauthenticated attacker can mark arbitrary pending WooCommerce orders as paid by forging a charge.pending event with attacker-controlled data, triggering payment_complete() and order fulfillment. The vulnerability is exploitable only when the webhook_secret_test or webhook_secret_live field is left blank (default).

The ProfileGrid WordPress plugin before version 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to soft-delete, tamper with the metadata of, and mark as read other users' private message threads.

The ProfileGrid WordPress plugin before version 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment.

OpenStack Zaqar through version 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known.

In OpenStack Ironic Python Agent through version 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.

The Firelight Lightbox plugin for WordPress up to version 2.3.20 is vulnerable to Stored DOM Cross-Site Scripting. The href attribute in PDF links is insufficiently sanitized, allowing authenticated attackers with contributor-level access or higher to inject scripts.

The Nexter Blocks plugin for WordPress up to version 5.0.0 has a directory traversal vulnerability via the 'plus_name' parameter. Authenticated attackers with subscriber-level access or higher can delete arbitrary JS/CSS files on the server.

The Post Grid Gutenberg Blocks – PostX plugin for WordPress up to version 5.0.32 is vulnerable to stored XSS via the 'searchnoresult' block attribute. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary scripts that execute when an editor or administrator previews the page.