CVE Vulnerability Catalog

The Hummingbird plugin for WordPress (versions up to and including 3.21.0) is vulnerable to Remote Code Execution via the log_msg() function in class-page-cache.php. The protective '<?php die(); ?>' header is omitted due to a class_exists() namespace bug, and cookie names with the wphb_cache_ prefix are written to the log file without sanitization, allowing an unauthenticated attacker to write and execute arbitrary PHP.

The iubenda | All-in-one Compliance plugin for WordPress up to version 3.13.4 is vulnerable to Stored Cross-Site Scripting via Comment Content due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The exploit works by embedding KSES-allowed markup such as abbr title attributes and HTML comments so that the global strtr() substitution mutates an inert tag into an executable element like an img onerror handler.

The iubenda | All-in-one Compliance plugin for WordPress up to version 3.13.4 is vulnerable to Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite, but only when the 'Secondary' parser engine is active (parser_engine=default). Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. This vulnerability does not exist under the default 'new' DOM-based parser engine.

The Social Chat – Click To Chat App Button plugin for WordPress up to version 8.6.2 is vulnerable to Stored Cross-Site Scripting via the 'consent_message' JSON attribute in the .qlwapp data-box. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or above to inject arbitrary web scripts that execute when a user accesses the page. The exploit requires no user interaction beyond page load, as setting auto_open and consent_enabled to 'yes' causes the consent box and embedded script to execute immediately.

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0. This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress up to version 7.3.3 is vulnerable to Stored Cross-Site Scripting via event attribute values. This is due to insufficient input sanitization when storing attribute values (using only wp_unslash() without sanitization) and lack of output escaping when rendering the '#_ATT{key}' placeholder. Authenticated attackers with Author-level access or above, or unauthenticated attackers when anonymous event submissions are enabled, can inject arbitrary web scripts that execute when any user views the affected event page.

In libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service.

In libxml2 before 2.15.4, an inconsistency in xmlIO between xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, due to a missing integer overflow check before invoking the write callback. This has security implications for many uses of that length value within a callback.

In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart due to length saturation in xmlXPtrEval for xpointer expressions.

In libxml2 before 2.15.4, xmlregexp in xmlRegNewParserCtxt has a NULL pointer dereference after a strdup failure, i.e., it does not calculate a string length after NULL checking.

In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow leading to a heap-based buffer overflow.

In libxml2 before version 2.15.4, there is an out-of-bounds read vulnerability in the xmlFAParsePosCharGroup function, related to the NXT macro in xmlregexp.

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the 'Upload from URL' media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to internal services.

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.

YesWiki prior to version 4.6.6 contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization.

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_tags() only. Because strip_tags() does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such as onmouseover, and execute arbitrary JavaScript in the victim's browser. This issue is reachable without authentication.

YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML or JavaScript to a valid archived revision timestamp, still load that archived revision, and execute arbitrary JavaScript in the victim's browser. The vulnerable form is only rendered when the victim can both read and edit the target page.

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders.