CVE Vulnerability Catalog

The Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin (cf7-salesforce) in versions up to and including 1.4.6 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This may lead to unauthorized access to functions or data.

CSRF vulnerability in the GiveWP WordPress plugin allows an attacker to perform unauthorized requests on behalf of a logged-in user. Affects versions up to and including 4.13.1.

The Trinity Audio plugin for WordPress (versions up to and including 5.23.3) contains a Missing Authorization vulnerability caused by incorrectly configured access control security levels. This allows unauthorized users to perform operations that should be protected.

CSRF vulnerability in the Simple Link Directory WordPress plugin allows an attacker to perform unauthorized requests on behalf of a logged-in administrator. Affects versions up to and including 8.8.3.

xmlseclibs version 3.1.3 contains an authentication bypass vulnerability caused by a flaw in the libxml2 canonicalization process during document transformation. When libxml2 canonicalization is invoked on invalid XML input, it may return an empty string instead of a canonicalized node, and xmlseclibs computes the DigestValue over this empty string, treating it as a successful canonicalization.

The Aisle theme (versions up to 2.9) has a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. An unauthorized user may perform actions reserved for higher privileges.

The GiveWP plugin by StellarWP is vulnerable to Code Injection in versions up to and including 4.13.1. The issue involves improper control of code generation, allowing code injection.

The Powerlift theme by Mikado-Themes is vulnerable to Missing Authorization in versions below 3.2.1. The issue allows exploiting incorrectly configured access control security levels.

Cross-Site Request Forgery (CSRF) vulnerability in Salon booking system. Allows an attacker to perform unauthorized actions on behalf of an authenticated user.

The Webba Booking plugin (webba-booking-lite) in versions up to and including 6.2.1 contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Webba Booking from n/a through <= 6.2.1.

Cross-Site Request Forgery (CSRF) vulnerability in Chartify chart builder. Allows an attacker to perform unauthorized actions on behalf of an authenticated user.

The Thank You Page Customizer for WooCommerce plugin (versions up to and including 1.1.8) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This enables unauthorized users to perform protected operations.

The Lobo plugin from VanKarWai is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 2.8.6.

The Tablesome plugin up to version 1.1.34 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The Elastic Email Sender plugin from Elastic Email is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.2.20.

Clone for Windows by ELECOM CO.,LTD. registers a Windows service with an unquoted file path. A user with write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.

The My Tickets plugin for WordPress (versions up to and including 2.1.0) contains a Missing Authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.

CSRF vulnerability in the Simple Folio WordPress plugin allows an attacker to perform unauthorized requests on behalf of a logged-in user. Affects versions up to and including 1.1.0.

The Happy Addons for Elementor plugin (versions up to and including 3.20.3) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This may allow unauthorized access to functions or data.

The Betheme theme by muffingroup (up to version 28.2) has a DOM-Based XSS vulnerability due to improper input neutralization during page generation. An attacker can inject malicious script that executes in the victim's browser.