CVE Vulnerability Catalog

The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 8.1.7. The check_mimetype function lacks proper file type validation, allowing authenticated attackers with subscriber-level access or above to upload files that may be executable, leading to remote code execution. This requires exploiting a race condition.

The FooSales plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to and including 1.43.0. The plugin does not properly validate a user's identity before updating their details, allowing authenticated attackers with Cashier-level access or above to change arbitrary users' email addresses, including administrators, and then reset passwords and gain access.

The Easy Digital Downloads plugin for WordPress up to version 3.6.9 is vulnerable to Stored Cross-Site Scripting (XSS) via PayPal IPN parameters. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

The GeoDirectory plugin for WordPress up to version 2.8.187 is vulnerable to Local File Inclusion (LFI) via the 'design_type' parameter. Unauthenticated attackers can include and execute arbitrary .php files on the server, potentially leading to access control bypass, sensitive data disclosure, or code execution.

The LatePoint plugin for WordPress up to version 5.7.3 is vulnerable to privilege escalation. The lack of an allowlist for setting names/values and missing role validation for the 'default_wp_role_for_customer' setting allows authenticated attackers with 'settings__edit' capability (e.g., agents) to overwrite the default WordPress role to 'administrator', causing new customer accounts to be created with full admin privileges.

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.

The Groundhogg plugin for WordPress up to version 4.9 is vulnerable to privilege escalation. Missing ownership and capability checks in the 'process_edit()' function allow authenticated users with 'edit_contacts' capability (e.g., sales reps) to reassign a contact to any WordPress account, including an administrator, and then use the auto-login URL to authenticate as that administrator.

The LifterLMS plugin for WordPress up to version 10.2.1 is vulnerable to PHP Object Injection via deserialization of untrusted input. Authenticated attackers with 'edit_course' capability (e.g., instructors) can inject a PHP object, which may lead to file deletion, data theft, or code execution if a POP chain is present in another plugin or theme.

The rtMedia plugin for WordPress, BuddyPress and bbPress up to version 4.7.13 is vulnerable to limited file deletion due to insufficient file path validation in the process function. Unauthenticated attackers can delete arbitrary safe files on the server, using a public nonce emitted in frontend JavaScript on pages with rtMedia gallery or upload shortcode.

The Fastcache by Host.it plugin up to version 1.7.4 is vulnerable to Code Injection via the `fastcache_settings[cache_cookie_exclude][]` parameter. The setting is registered without a sanitize_callback, and the buildSiteHtaccessRules() function only applies trim() to cookie values before interpolating them into an Apache RewriteCond line, leaving embedded newlines intact. This allows authenticated administrators to inject arbitrary Apache directives into .htaccess, such as php_value auto_prepend_file, enabling execution of attacker-controlled PHP code on every request.

The Advanced Form Integration plugin up to version 2.9.0 is vulnerable to Authentication Bypass via Unverified Password Change. The adfoin_ultimatememberac_send_data function passes an attacker-controlled field key and value directly to UM()->user()->update_profile() in the 'account' context, which bypasses Ultimate Member's banned-key validation, without any identity verification, ownership check, capability check, or current-password reauthentication. This allows unauthenticated attackers to change the password of any WordPress user, including administrators, via a public Contact Form 7 form.

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped, allowing command injection.

Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that allows an authenticated attacker with access to debug logs to view LUKS passphrases or SMB Active Directory credentials.

Aegisub versions 3.2.0 through 3.4.2 automatically load Automation scripts referenced in ASS subtitle project metadata without asking whether the user trusts the scripts or their authors. Opening a crafted ASS file can execute arbitrary code with the privileges of the Aegisub process; in versions 3.4.0–3.4.2, inconsistent NUL handling also allows a crafted ASS/Lua polyglot to execute itself. The vulnerability is fixed in Aegisub 3.5.0.

Vikunja versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the user_tokens table in plaintext. An attacker with read access to the database can immediately use pending tokens to take over user accounts without knowing passwords. Version 2.4.0 fixes the issue.

Vikunja versions 1.0.0 through 2.3.0, when an administrator enables the per-provider emailfallback option on an OpenID Connect provider, links an SSO login to a pre-existing local account using only the email claim from the IdP, without checking email_verified or requiring the account password. An attacker with a token carrying a victim's email can log in as that victim without consent. Version 2.4.0 fixes the issue.

Vikunja version 2.3.0 allows a scoped API token limited to the oauth.authorize permission to call POST /api/v1/oauth/authorize, obtain an OAuth authorization code, and exchange it for a normal bearer JWT and refresh token. The resulting credentials are not restricted by the original token's permissions, granting access to routes outside its declared scope. Version 2.4.0 fixes the vulnerability.

Tina (headless CMS) versions prior to 0.2.1 assign a rich-text node.url value directly to an anchor href without validating the URL scheme in the tina-markdown element. A content author can store a link using a script-capable scheme, and a visitor clicking the rendered link executes attacker-controlled script in the site's origin. The issue is fixed in version 0.2.1.

Tina (headless CMS) versions prior to 3.0.0 — @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD and interpolates the raw value into the API URL and JavaScript string literals in generated code. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The issue is fixed in version 3.0.0.

Jexactyl versions prior to 4.0.5 — the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when payment_status is paid but does not compare amount_total or currency with the referenced order and configured billing currency. An authenticated client can complete a lower-value or mismatched-currency payment and cause the order to be processed. The issue is fixed in version 4.0.5.