CVE Vulnerability Catalog

The Featured Image Generator plugin up to version 1.3.4 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. This could enable unauthorized actions in the admin panel.

The AI Content Writing Assistant (All in One) plugin up to version 1.1.7 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. This could enable unauthorized actions in the admin panel.

The History Timeline plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions from n/a through 1.0.6.

The Post Video Players plugin up to version 1.163 contains an exposure of sensitive system information to an unauthorized control sphere vulnerability. It allows retrieving embedded sensitive data.

The WordPress plugin Trash Duplicate and 301 Redirect (trash-duplicate-and-301-redirect) up to version 1.9.1 has a Missing Authorization vulnerability. It allows exploiting incorrectly configured access control security levels.

The AI Copilot plugin up to version 1.5.2 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. An attacker can perform operations without proper permissions.

The Sticky Notes for WP Dashboard plugin up to version 1.2.4 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. This could enable unauthorized operations on the admin dashboard.

An HTML Injection vulnerability in TrueConf server 5.5.2.10813 in the conference description field allows an attacker to inject arbitrary HTML in the Create/Edit conference functionality. The payload will be triggered when the victim opens the Conference Info page ([conference url]/info).

A vulnerability was determined in aizuda snail-job up to 1.7.0 on macOS. Affected by this vulnerability is the function FurySerializer.deserialize of the component API. This manipulation of the argument argsStr causes deserialization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

The ShopMagic plugin for WooCommerce contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 4.7.2.

DOM-Based XSS vulnerability in Essential Addons for Elementor (WordPress plugin) allows an attacker to manipulate the DOM in the victim's browser. Affects versions up to and including 6.5.3.

A missing authorization vulnerability in the Demo Importer Plus plugin (versions up to and including 2.0.8) allows exploitation of incorrectly configured access control security levels. An unauthorized user can perform actions requiring permissions.

Stored XSS vulnerability in Auto Listings (WordPress plugin) allows an attacker to permanently inject malicious script that executes on every page view. Affects versions up to and including 2.7.1.

A DOM-Based Cross-site Scripting vulnerability in the Combo Offers WooCommerce plugin (versions up to and including 4.2) arises from improper neutralization of input during web page generation. An attacker can inject a malicious script that executes in the user's browser.

DOM-Based XSS vulnerability in Blog Filter (WordPress plugin) allows an attacker to manipulate the DOM in the victim's browser. Affects versions up to and including 1.7.3.

The FiveStar plugin (fivestar) contains an authorization bypass through user-controlled key vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 1.7.

The Arcane plugin for WordPress contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 3.6.6.

The Backpack Traveler theme by Mikado-Themes contains an authorization bypass vulnerability through a user-controlled key. This allows exploiting incorrectly configured access control security levels and affects versions up to and including 2.10.3.

The Struktur plugin (struktur) contains an authorization bypass through user-controlled key vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 2.5.1.

A missing authorization vulnerability in the BoldGrid weForms plugin (versions up to and including 1.6.25) allows exploitation of incorrectly configured access control security levels. An unauthorized user can perform actions they should not have permission to do.