CVE Vulnerability Catalog

The Jotform – AI Chatbot plugin versions up to 3.8.2 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability.

The Pubjet | پاب‌جت plugin versions up to 5.4.8 allow a subscriber to change settings they should not have access to.

The Wordable plugin versions up to 8.2.10 have a Broken Access Control vulnerability that allows a subscriber to access functions they should not have permissions for.

The WPSection plugin versions up to 1.5.1 have a Broken Access Control vulnerability that allows a subscriber to access functions they should not have permissions for.

The Everest Backup plugin versions up to 2.3.13 contain an unauthenticated Remote Code Execution (RCE) vulnerability.

The Additional Order Filters for WooCommerce plugin versions up to 1.24 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability.

The WP File Download plugin versions up to 6.3.6 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability.

Builderius.io Builderius versions from 1.4 through 1.4-beta contain a Server-Side Request Forgery (SSRF) vulnerability.

The Forminator plugin by WPMU DEV versions up to 1.57.3 have an incorrect privilege assignment vulnerability that allows privilege escalation.

The Martfury - WooCommerce Marketplace WordPress theme contains a Reflected XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 3.3.9.

Reflected XSS vulnerability in the ThemeStek Extras for LabtechCO Theme extension. Improper neutralization of input during web page generation allows reflected XSS. Affects versions up to 8.4.

Deserialization of untrusted data vulnerability in the Super Video Player plugin. Allows an attacker to perform object injection. Affects versions up to 1.8.13.

Missing authorization vulnerability in the Bayarcash WooCommerce plugin. Allows exploiting incorrectly configured access control security levels. Affects versions up to 4.4.2.

Incorrect privilege assignment vulnerability in WooCommerce. Allows privilege escalation. Affects versions from 9.8.0 through 11.1.2.

Code injection vulnerability in the Thank You Page Customizer for WooCommerce plugin. Allows code injection. Affects versions up to 1.2.3.

Cross-site request forgery vulnerability in OpenRefine up to version 3.10.1 in the get-rows command. Allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.

Incorrect authorization vulnerability in SkillHub before version 0.2.22 in AccountMergeService and AccountMergeController. Allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode. When no webhook_secret is configured, remote attackers can send unauthenticated updates to port 8080 and spoof an allowed or admin user_id to run privileged commands like /shell on the host.

AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-Id or user_id headers to act as any user.

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as the Spotweb PHP process.