CVE Vulnerability Catalog

WPAdverts by Greg Winiarski through version 2.3.4 contains a Reflected XSS vulnerability (improper input neutralization during web page generation). An attacker can exploit reflected XSS to execute malicious scripts in the victim's browser.

WPAdverts by Greg Winiarski through version 2.3.4 contains a Stored XSS vulnerability (improper input neutralization during web page generation). An attacker can store a malicious script that executes in the browser of every user visiting the infected page.

Tainacan through version 1.3.0 contains a deserialization of untrusted data vulnerability that allows Object Injection. An attacker can exploit this to execute malicious code or manipulate application objects.

FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a privileged user downloads multiple recordings as a ZIP.

Slider by 10Web through version 1.2.62 contains a deserialization of untrusted data vulnerability that allows Object Injection. An attacker can exploit this to execute malicious code or manipulate application objects.

Forminator by WPMU DEV through version 1.57.3 contains a Stored XSS vulnerability (improper input neutralization during web page generation). An attacker can store a malicious script that executes in the browser of every user visiting the infected page.

ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The av_extend call with an underflowing value leads to allocation of 2^32 slots, causing memory exhaustion.

ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The av_extend call with an underflowing value leads to allocation of 2^32 slots, causing memory exhaustion.

Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (datasketches-cpp). var_opt_union::deserialize() read the 32-byte preamble after checking only 8 bytes were available, so a truncated serialized union could cause a read of up to 24 bytes past the end of the input. This can cause a crash (denial of service) and could expose adjacent memory contents. Affects versions from 2.0.0-incubating before 5.3.0.

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. The vulnerability is due to the endpoint's permission callback returning true unconditionally combined with insufficient validation of the input, allowing unauthenticated attackers to read arbitrary files on the server.

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name>' parameter in all versions up to and including 1.7.31 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page, but this requires specific administrator configuration.

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter in all versions up to and including 44.1 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject scripts that execute when an administrator visits the WPO365 wizard page, with the payload stored in the wpo365_errors transient for up to three days.

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling plugin for WordPress is vulnerable to generic SQL Injection via the 'booking[service_id]' parameter in all versions up to and including 5.7.2 due to insufficient escaping and lack of query preparation. Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database.

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to and including 9.3.03.002 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject scripts that execute when a user accesses an injected page, using a bypass that converts HTML entities back to live tags.

The Zeinet plugin by Bracketweb is vulnerable to Reflected XSS in versions up to and including 1.0.0 due to improper neutralization of input during web page generation.

The Motors plugin by StylemixThemes is vulnerable to Missing Authorization in versions up to and including 1.4.108, allowing exploitation of incorrectly configured access control security levels.

The Grocery Shopping Store plugin by Omegathemes is vulnerable to Authentication Bypass Using an Alternate Path or Channel in versions up to and including 1.3.3, allowing password recovery exploitation.

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler. The vulnerability is due to authorizing access based on a non-secret email address instead of the WooCommerce order_key.

The YITH WooCommerce Affiliates plugin for WordPress is vulnerable to deserialization of untrusted data, allowing object injection. This affects all versions up to and including 3.31.0.

The WPO365 | LOGIN plugin for WordPress is vulnerable to authentication bypass via OIDC nonce replay in all versions up to and including 44.1. This occurs when the use_id_token_parser_v2 option is enabled.