CVE Vulnerability Catalog

Reflected Cross-Site Scripting (XSS) vulnerability in the JetEngine plugin by Crocoblock. Improper neutralization of input during web page generation allows reflection of a malicious script in the server response.

The WpEvently plugin in versions 5.5.0 and earlier has a Broken Access Control vulnerability for contributors. Contributor-level users can gain unauthorized access to administrative functions.

Vulnerability allowing remote code execution (RCE) by a user with the author role in the Rank Math SEO plugin in versions up to and including 1.0.276.

wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer instead of the TLS sequence number carried in the additional authenticated data. Because the record layer leaves the explicit-nonce field for the cipher to populate, the value read is constant across records, so every AES-CCM record within a connection is encrypted under an identical key and nonce pair. Reusing a CCM key and nonce weakens confidentiality (identical keystream across records, so a known record recovers the others) and integrity (authentication tag forgery). Only wolfEngine is affected; wolfProvider is not. AES-GCM under wolfEngine is tracked separately. AES-CCM cipher suites are not enabled by default and must be explicitly selected, which limits exposure. TLS 1.3 and non-TLS use of the cipher are not affected.

The WP Job Portal plugin in versions 2.5.9 and earlier has an Insecure Direct Object References (IDOR) vulnerability for subscribers. Subscriber-level users can access objects (e.g., data) without authorization.

Unauthenticated Denial of Service (DoS) attack in the Smush Image Compression and Optimization plugin in versions up to and including 4.2.0.

The ACF Extended plugin in versions 0.9.2.6 and earlier has a Broken Access Control vulnerability for contributors. Contributor-level users can gain unauthorized access to administrative functions.

In wolfEngine before version 1.4.1, the 8-byte explicit AES-GCM nonce is generated once when the TLS write key is set and never incremented per record. As a result, every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream and leaks the GHASH authentication key, enabling authentication tag forgery.

In wolfProvider before version 1.2.2, the 8-byte explicit AES-GCM nonce is generated once when the TLS write key is set and never incremented per record. As a result, every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream and leaks the GHASH authentication key, enabling authentication tag forgery.

Uncontrolled recursion in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 to exhaust a BEAM node's memory. The issue stems from misclassification of a list as a charlist, leading to recursive exception raising and stack growth until memory exhaustion.

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The plugin accepts review submissions from unauthenticated users through the 'cr_local_forms_submit' AJAX action without sanitizing HTML content before storing it, and later renders this stored content on product pages without proper escaping.

Ceviz Informatics Inc. Web Design has a Reflected XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions through 25082026.

The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocket_beacon AJAX endpoint. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The E-Commerce Platform of Dayneks Software Industry and Trade Inc. has a Reflected XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions through 28082026. The vendor was contacted but did not respond.

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 3.4.4. The load_previous_field_value() method accepts arbitrary URL values from $_POST data for upload fields without domain restriction, which are then passed to wp_remote_head(). This allows unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs.

CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size. An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands to a significantly larger byte sequence. Because the entire decompressed output is materialized in memory before being written to a temporary file, a sufficiently large payload may exhaust process or host memory and consume substantial disk space, resulting in denial of service.

In CodeChecker through 6.28.2, there is a flaw in ldlogger-tool-gcc.c:129 where the safe_strcpy() helper (which is strncpy()) writes 4096 bytes into a buffer of 4094 bytes, causing a 2-byte stack overflow on every invocation, independent of the input path's length. The fix for CVE-2025-40843 replaced unchecked strcpy() with a bounded safe_strcpy(), but the size passed was incorrect.

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter.