CVE Vulnerability Catalog

The YITH WooCommerce Waitlist Premium plugin for WordPress up to version 3.35.0 is vulnerable to Privilege Escalation. The add_user_in_waiting_list() function lacks capability checks and nonce verification, and uses parse_str() and extract() to import attacker-controlled variables, allowing authenticated attackers with Subscriber-level access to create an administrator account and assign the administrator role.

ESET AV Remover (standalone) contains an Improper Privilege Management vulnerability that allows Privilege Escalation via specially crafted RPC.

A vulnerability in SUSE neuvector manager before version 5.4.5 involves insertion of sensitive information into log files. This could expose confidential data in the manager container's logs.

A vulnerability in Dell SCG 5.0 (Appliance and Application) before specific versions involves improper neutralization of special elements in an SQL command (SQL Injection). A low-privileged attacker with remote access could exploit this, leading to script injection.

A vulnerability in Dell SCG 5.0 (Appliance and Application) before specific versions involves insertion of sensitive information into log files. A low-privileged attacker with local access could exploit this, leading to information exposure.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could exploit this, leading to denial of service.

A vulnerability in Dell SCG 5.0 (Appliance and Application) before specific versions involves improper neutralization of special elements in an LDAP query (LDAP Injection). An unauthenticated attacker with remote access could exploit this, leading to script injection.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Validation of Certificate with Host Mismatch vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access.

The PublishPress Capabilities plugin for WordPress up to version 2.50.0 is vulnerable to Privilege Escalation. The addPluginCapabilities() function automatically grants the Editor role all manage_capabilities_* capabilities, allowing attackers with Editor-level access to manage roles and plugin settings, but not full administrator access.

The WPMR Google Feed Manager for WooCommerce plugin for WordPress (up to and including version 2.23.7) is vulnerable to time-based SQL Injection via the 'feed' parameter due to insufficient escaping and lack of query preparation. Authenticated attackers with administrator-level access can append additional SQL queries to extract sensitive information from the database.

A flaw in the key provider component of the keycloak-services library (core engine for Red Hat Build of Keycloak) arises from an incomplete fix for path probing. A realm administrator can still submit arbitrary filesystem paths as keystore parameters, allowing determination of file existence and readability on the server, potentially exposing sensitive system information.

The myCred plugin for WordPress (up to and including version 3.2.4) is vulnerable to Stored Cross-Site Scripting via the 'wrapper' shortcode attribute due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page.

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-82223 Reason: This candidate is a reservation duplicate of CVE-2026-82223. Notes: All CVE users should reference CVE-2026-82223 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files.

The Contact Form 7 Captcha WordPress plugin before version 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

The WP Express Checkout WordPress plugin before version 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.

The Hustle WordPress plugin before version 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.

The CleanTalk WordPress plugin before version 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page.

The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.1.5. Authenticated attackers with subscriber-level access can install and activate an arbitrary attacker-hosted plugin, resulting in remote code execution on the server. The required nonce is emitted inline on all admin pages accessible to subscribers when WooCommerce is inactive, meaning any subscriber-level user can harvest it and trigger the exploit without any additional privileges.

A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.