CVE Vulnerability Catalog

The WP Recipe Maker plugin for WordPress (versions up to and including 10.8.1) is vulnerable to arbitrary shortcode execution. The sanitize_metadata() function recursively calls do_shortcode() on recipe metadata fields, including reviewBody populated from comment content, without sanitizing shortcode tokens before execution. Unauthenticated attackers can execute arbitrary registered shortcodes on every recipe page render, disclosing data in JSON-LD metadata.

The Better Messages plugin for WordPress (versions up to and including 2.15.33) is vulnerable to Information Exposure by Spoofing. The is_ai_bot_user() function identifies privileged internal AI bot accounts by checking for the 'ai-chat-bot-' prefix against a guest record's stored IP address, which is populated verbatim from the client-controlled X-Real-IP request header. This allows unauthenticated attackers to register a guest identity treated as an internal AI bot, bypassing role allowlists and join filters to join administrator-restricted chat rooms, post messages, and read other users' private message history.

The Tutor LMS plugin for WordPress (versions up to and including 4.0.8) is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can trick a user into clicking a link.

The Tutor LMS plugin for WordPress (versions up to and including 4.0.8) is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. This allows authenticated attackers with subscriber-level access and above to permanently delete arbitrary WordPress posts — including pages, courses, quizzes, and WooCommerce products — via wp_delete_post( $id, true ). The exploit chain requires triggering the profile-photo upload flow, creating a Tutor topic reparented to that attachment, then invoking the lesson deletion handler against any target post ID.

The WP Photo Album Plus plugin for WordPress (all versions) is vulnerable to remote code execution via the wppa_image_magick function. Insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command executed via exec(), with only escapeshellcmd() applied to the whole command. An authenticated attacker with subscriber-level access can execute code on the server.

The Gravity Forms plugin for WordPress (versions up to and including 3.1.0.4) is vulnerable to arbitrary file upload via the upload_file function. A mismatch between validation and persistence pipelines allows hidden file upload fields to bypass extension validation. Unauthenticated attackers can upload executable files, enabling remote code execution.

The Divi Essential plugin for WordPress (versions up to and including 5.8.1) is vulnerable to sensitive information exposure via the dnxte_get_database_tables and dnxte_get_database_data AJAX actions. The handlers only conditionally verify a nonce (the check runs solely when the 'nonce' POST parameter is present and can be trivially bypassed by omitting it) and never call current_user_can() or enforce a capability. This allows authenticated attackers with Subscriber-level access and above to enumerate every table in the WordPress database and read up to a caller-controlled number of rows from any table — including wp_users (usernames, emails, hashed passwords), wp_usermeta (session tokens, secret keys), and wp_options (privileged settings, API keys, credentials stored by other plugins).

The SEO Booster plugin for WordPress (versions up to and including 7.4.7) is vulnerable to Missing Authorization due to a missing capability check on the handle_oauth_callback() function hooked to admin_init, which processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role. This allows authenticated attackers with Subscriber-level access and above to overwrite the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options and delete the seobooster_needs_reauth flag by visiting a crafted /wp-admin/ URL, disrupting the Google Search Console integration and injecting attacker-chosen data into site options.

The Asset CleanUp: Page Speed Booster plugin for WordPress (versions up to and including 1.4.0.5) is vulnerable to stored cross-site scripting via comment content due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary scripts that execute when a user visits the injected page. This is only exploitable when combine_loaded_css is enabled.

The WP2Social Auto Publish plugin for WordPress (versions up to and including 2.4.12) is vulnerable to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

The WPComplete plugin for WordPress (versions up to and including 2.9.9.0) is vulnerable to Stored Cross-Site Scripting via the 'empty' Shortcode Attribute due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. This requires the premium version of the software. Please note this only affects the pro version.

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with full system access.

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens, enabling operating system command execution.

SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of restricted documents via template injection.

The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable storage access, can copy the SQLite database and media files directly without entering the vault passcode.

A buffer overflow vulnerability was identified in the Totolink A3002MU (version Hh-B20211125.1046) within the formWlEncrypt function of the /boafrm/formWlEncrypt file. Manipulation of the submit-url argument allows remote exploitation. The exploit is publicly available and may be used.

A buffer overflow vulnerability was determined in the Totolink A3002MU (version Hh-B20211125.1046) within the formWlAc function of the /boafrm/formWlAc file. Manipulation of the submit-url argument can lead to a buffer overflow. The attack may be performed remotely, and the exploit has been publicly disclosed.

A flaw was found in the OpenShift console allowing unauthenticated access to the /api/devfile/ and /api/devfile/samples/ endpoints. A remote attacker can send crafted devfile payloads, leading to Server-Side Request Forgery (SSRF) and, by sending repeated large requests without a specified content length, to unbounded memory growth and Denial of Service (DoS).

In Vinyl Cache before 9.0.2, a workspace buffer overflow vulnerability exists in the .upper() and .lower() string methods of VCL. It can be used as a remote denial of service vector causing the child process to segfault or assert and restart.

A buffer overflow vulnerability was found in the Totolink A3002MU (version Hh-B20211125.1046) within the formSchedule function of the /boafrm/formSchedule file. Manipulation of the webpage argument results in a buffer overflow. The attack is possible remotely, and the exploit has been made public.