CVE Vulnerability Catalog

The Bookly plugin for WordPress (versions up to and including 28.2) is vulnerable to Authorization Bypass via PHP Type Juggling. Due to the use of a loose inequality operator in the verification function and lack of CSRF and authentication protection in the AJAX controller, an unauthenticated attacker can bypass phone/email ownership verification and overwrite any Bookly customer's data.

The Gutenverse plugin for WordPress (versions up to and including 4.0.8) is vulnerable to Stored Cross-Site Scripting via the Post Comment Block 'suffixMain' Attribute. Due to insufficient input sanitization and output escaping, an authenticated attacker with contributor-level access can inject malicious scripts that execute whenever a user accesses the injected page.

The JetFormBuilder plugin for WordPress (versions up to and including 3.6.5.3) is vulnerable to Reflected Cross-Site Scripting via the 'jfb_xss' URL Query Variable Parameter. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject malicious scripts that execute if they can trick a user into clicking a link.

The Customer Reviews for WooCommerce plugin for WordPress (up to and including 5.120.0) is vulnerable to authorization bypass due to improper verification of user permissions. This allows unauthenticated attackers to permanently delete arbitrary attachments from the Media Library (including administrator-owned product images, logos, and documents) by injecting their IDs into a review that is later trashed and purged. Exploitation requires a public review-form link (a 13-hex formId) that exposes the nonce needed to reach the handler without any WordPress account or session.

The Fancy Product Designer plugin for WordPress (versions up to and including 6.5.2) is vulnerable to Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta. The fpd_save_order AJAX action is registered for unauthenticated users without nonce or capability checks, and the strip_tags() sanitization is bypassed using JSON unicode escape sequences that json_decode() converts back to angle brackets when the order is rendered in the admin view.

The Fancy Product Designer plugin for WordPress (versions up to and including 6.5.2) is vulnerable to Stored Cross-Site Scripting via the 'output_format' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. This requires the Pro Export/Genius feature to be enabled, as the vulnerable fpd_pr_export AJAX action is only registered when that feature is active.

The AMP for WP – Accelerated Mobile Pages plugin for WordPress (versions up to and including 1.1.16) is vulnerable to Stored Cross-Site Scripting via Comment Content through Regex Transformation due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. The crafted payload uses only WordPress-permitted comment tags and attributes (an anchor with href and title), and the AMP sanitizer pipeline omits javascript: protocol blocking, so neither the comment save filter nor the AMP output stage removes the malicious URI introduced by the transformation.

The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected. This allows unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn from the response whether an internal service answered.

The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk. This allows users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including outside the site's document root.

The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pages. This leads to Reflected Cross-Site Scripting (XSS) which could be used against any visitor, including logged-in administrators.

The Tohoku Electric Power smartphone application "Yorisou e Net" uses a hard-coded cryptographic key. This may allow an attacker to retrieve the hard-coded cryptographic key from the affected product.

The Elementor Website Builder plugin is vulnerable to Cross-Site Request Forgery (CSRF). This issue affects versions from n/a through 4.3.1.

The OpenStation plugin for WordPress (versions up to and including 1.1.7) is vulnerable to authorization bypass. Due to improper verification of user authorization, an authenticated attacker with custom-level access can read the title, status, date, permalink, and a 300-character content excerpt of any private, draft, pending, or future post, as well as the content and AI-moderation verdicts of unapproved and spam comments.

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress (up to and including 4.8.6) is vulnerable to privilege escalation due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v1/signup/<op>` and the absence of a key allowlist in the `finish_registration_logic` function. The attacker-controlled `wawp_custom_fields` parameter is copied directly into `update_user_meta()`, allowing sensitive meta keys such as `wp_capabilities` and `wp_user_level` to be set. This enables unauthenticated attackers to register an account with the administrator role and gain full administrative access. When OTP verification is enabled, the OTP session token is returned in plaintext in the HTTP response, and the `handle_magic_link_request()` handler marks it as verified on any unauthenticated GET request containing it without checking the OTP code, making the OTP step trivially bypassable.

A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. The vulnerability affects the CmsContentAdminController function in SysUserAdminController.java within the exportExcel/exportData component. Manipulation of the userId/deptId arguments causes authorization bypass, and the attack can be initiated remotely. The exploit has been made publicly available and could be used for attacks.

phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php. This flaw allows access to functionality that should be restricted to authorized users.

A vulnerability in django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit. This allows bypassing login attempt throttling mechanisms.

In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeover. This flaw enables an attacker to gain control of another user's account.

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.

ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive over SMTP from arbitrary senders. This may allow processing of malicious SVG files.