CVE Vulnerability Catalog

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster's ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.

The MIPL Grouped Checkout Fields for WooCommerce plugin for WordPress (versions up to and including 1.2.1) is vulnerable to arbitrary file uploads due to missing file type validation in the `mipl_wc_upload_file` function. This allows unauthenticated attackers to upload arbitrary files to the server, potentially enabling remote code execution.

In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.

PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.

PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.

PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.

PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.

The WP-Members Membership Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions up to, and including, 3.5.6 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into clicking a link. Exploitation requires the victim to first visit the attacker-crafted URL and then click the Terms of Service link on the registration page.

The Simple Ajax Chat plugin for WordPress (versions up to and including <= 20260811) is vulnerable to Stored Cross-Site Scripting via chat messages due to insufficient input sanitization and output escaping. The nonce protecting chat message submission is publicly visible on the chat page, allowing unauthenticated attackers to persistently inject malicious scripts.

The Vigilant – 100% Free Security Suite plugin for WordPress (versions up to and including 2.10.2) is vulnerable to Stored Cross-Site Scripting via the User-Agent header due to insufficient input sanitization and output escaping. The malicious payload is delivered passively by any unauthenticated visitor who triggers a failed login attempt with a crafted User-Agent header.

The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `supertitle` and `subtitle` attributes of the `bold_timeline_item` shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes.

The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query Parameter Name in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping.

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data[name]' Parameter in all versions up to, and including, 2.0.16 due to insufficient input sanitization and output escaping. The show_preview AJAX action is registered for unauthenticated users and is gated only by a nonce, which an unauthenticated attacker can retrieve by loading any publicly accessible page that emits it.

The UsersWP plugin for WordPress (versions up to and including 1.2.70) is vulnerable to Arbitrary File Deletion via the upload_file_remove() AJAX handler. An authenticated attacker with Subscriber-level access or above can delete arbitrary files on the server, including wp-config.

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'post_types', and 'orderby' request parameters. This is due to insufficient input sanitization and output escaping in the relevanssi_debug_array() function in lib/debug.php, which dumps user-supplied query variables through print_r() inside a <pre> block without HTML escaping.

The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.5.9 due to insufficient input sanitization and output escaping. WordPress's server-side HTML encoding of the 's' search parameter in the <title> element is bypassed because the browser DOM API decodes HTML entities when jQuery's .text() method reads document.title.

The WP Photo Album Plus plugin for WordPress (versions up to and including 9.2.08.003) is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter due to insufficient input sanitization and output escaping. The nonce failure path for the getshortcodedrenderedfenodelay action serves as the log-write trigger, making the exploit fully reachable by unauthenticated callers.

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. This is due to insufficient input sanitization and output escaping in the wp_load_js() function, which reads filter values from the URL path via the url_request extension's parse_url_query() and embeds them into an inline JavaScript string using json_encode() without escaping single quotes.

The Unlimited Elements For Elementor plugin for WordPress (versions up to and including 2.0.16) is vulnerable to SQL Injection via the 'addontype' parameter due to insufficient escaping and lack of preparation in the getWhereString() function. An unauthenticated attacker can append additional SQL queries to extract sensitive information from the database.

The Sticky Chat Widget plugin for WordPress (versions up to and including 1.4.2) is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX action. An unauthenticated attacker can append additional SQL queries to extract sensitive information from the database.