CVE Vulnerability Catalog

The CorvusPay WooCommerce Payment Gateway plugin for WordPress up to version 2.7.4 is vulnerable to stored cross-site scripting via the 'approval_code' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses the affected page. The unauthenticated REST endpoint POST /wp-json/corvuspay/success/ has permission_callback set to __return_true, and signature validation only logs the result without stopping execution, allowing an attacker to store a malicious approval_code unchallenged.

The WP CTA – Sticky CTA Builder plugin for WordPress up to version 2.2.2 is vulnerable to time-based blind SQL Injection via the 'fildname' parameter in the ajaxCheck() method. Due to missing authorization and the endpoint being accessible to unauthenticated users, attackers can inject arbitrary SQL queries and extract sensitive data, including administrator password hashes.

The Essential Addons for Elementor plugin for WordPress is vulnerable to administrator account takeover via email header injection. This affects all versions up to and including 6.6.10 due to insufficient server-side validation of a Login/Register widget setting used to construct outgoing email headers. An authenticated attacker with Contributor-level access or higher can inject a Bcc header to receive a copy of the administrator's password reset link and achieve full account takeover.

The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 0.3.5 via the 'code-engine' shortcode. This is due to the plugin not restricting access to the code injecting functionality, allowing authenticated attackers with Contributor-level access and above to execute code on the server.

The SureCart plugin for WordPress up to version 4.2.3 is vulnerable to privilege escalation via account takeover. This is due to insufficient validation of user identity before updating details like email during customer profile synchronization from webhook events. Unauthenticated attackers can change linked user email addresses, including administrators if their account is linked to a SureCart customer record, and then reset the password to gain access if the customer ID is known.

The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 Form Field in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping.

The Planyo Online Reservation System plugin for WordPress up to version 3.0 is vulnerable to Server-Side Request Forgery (SSRF) leading to Local File Inclusion (LFI). The ulap.php file acts as an AJAX proxy accessible without authentication, and the send_http_post() function fails to validate the URL scheme, allowing an attacker to use file:// URLs to read arbitrary local files on the server.

The Swiss Toolkit For WP plugin for WordPress up to version 1.4.6 contains an arbitrary file upload vulnerability. The `upload_extension_files()` function improperly validates file types by using `strpos()` to search for an extension string in the filename instead of verifying the actual file extension.

The Booking Package plugin for WordPress up to version 1.7.20 is vulnerable to generic SQL injection via the 'email' form parameter (form<N>). Insufficient escaping and lack of query preparation allow unauthenticated attackers to append additional SQL queries, potentially extracting sensitive database information.

The Simple JWT Login plugin for WordPress up to version 3.6.6 contains an authentication bypass and privilege escalation vulnerability. An authenticated attacker with subscriber-level access can inject an administrator's email into the `payload` parameter, resulting in a JWT with admin identity and gaining a fully authenticated admin session.

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 1.6.1 via the get_type_template function. This allows authenticated attackers with contributor-level access or higher to include and execute arbitrary .php files on the server.

The WP Ultimate CSV Importer plugin for WordPress up to version 8.0.1 is vulnerable to Remote Code Execution via the 'MappedFields' parameter. Missing capability checks on AJAX handlers and exposure of the plugin nonce to any authenticated user allow a Subscriber to install the Import WooCommerce add-on, persist attacker-controlled PHP expressions in MappedFields, and trigger eval() in ImportHelpers::get_meta_values().

The Motors – Car Dealership & Classified Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content and User Biographical Info in all versions up to, and including, 1.4.112 due to insufficient input sanitization and output escaping.

The WP Grid Builder plugin for WordPress up to version 2.3.3 contains a privilege escalation vulnerability. Missing authorization and meta key validation in the `/wp-json/wpgb/v2/metadata` REST endpoint allow authenticated users with Subscriber-level access or higher to escalate their privileges to Administrator by updating their own `wp_capabilities` user meta with a crafted nested array payload.

Spinnaker prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 contains a vulnerability in Kustomize bake operations that allows unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes.

Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend.

The charging station backend lacked throttling on repeated authentication attempts, allowing an attacker to perform a denial-of-service attack.

A vulnerability in Phalcon before version 5.15.0 causes the default MVC router to use a compiled PCRE pattern with a nested quantifier, allowing an attacker to trigger catastrophic backtracking via a crafted request URI containing repeated slashes and newline characters. This leads to CPU exhaustion or route-matching failure.

A vulnerability in Tilt from version 0.24.0 to 0.37.3 allows an attacker to access the HUD view stream via WebSocket despite CSRF protection. The CSRF token is served by an unauthenticated endpoint, and the server accepts connections without an Origin header, enabling theft of session data, Tiltfile contents, and resource statuses.

Tilt HUD server mounts unauthorized pprof handlers under /debug, allowing an unauthenticated attacker to read process memory (including session and API tokens) and degrade performance. The vulnerability affects versions 0.19.5 through 0.37.3.