CVE Vulnerability Catalog

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to and including 1.12.0 due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or higher can inject arbitrary scripts that execute when a user hovers over a comment's like counter, as the tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion WebSocket events and returning thread API responses. An authenticated channel member can obtain server-side webhook URLs and authentication context from interactive-message posts via the post_deleted WebSocket event or the threads REST API.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries. An attacker with access to server logs can obtain valid session tokens or OAuth access tokens and impersonate authenticated users.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switch endpoint. An attacker with a valid OAuth bearer token for a target user can permanently take over that user's SSO-backed account by setting an attacker-controlled password and detaching the account from its identity provider.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administrator-initiated imports. An authenticated attacker with team admin privileges can force-add existing Mattermost users to their team and forge posts attributed to those users' identities.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user's permissions before other validations, allowing non-content reviewers to infer a post's flagged status via direct API call.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results. An authenticated user without permission to list private teams can disclose the ID, name, and display name of private teams via a modified team search request.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team and guest invitation tokens. An authenticated attacker can join a team or gain unauthorized access to private channels via a forwarded or leaked invitation link.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, and 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches. A remote attacker can cause memory exhaustion on the server via a crafted oversized image response.

The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or above can inject arbitrary web scripts into pages that execute whenever a user accesses the injected page.

The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased_plan' parameter in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or above can inject arbitrary web scripts into pages that execute whenever a user accesses the injected page.

The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge payment-confirmation notifications and record arbitrary donations as completed, with attacker-chosen amounts, donor names and messages.

The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks on installs where the payment key has not been configured.

The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions.

The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed content.

Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, and 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties and to bound the quadratic multibyte-keyword matching performed for each post. An authenticated user can degrade post-processing latency and consume excessive CPU on behalf of other members of any shared channel by storing an oversized notify_props.mention_keys list on their own profile.

The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. An authenticated attacker with Contributor-level access or above can publish, unpublish, or bulk-delete any wpmb_map post, including maps owned by administrators.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints. An authenticated user can learn the channel ID of a private channel another user is actively viewing via the status endpoints without being a member of that channel.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed. A System Console administrator can disclose the plaintext bind password to an attacker-controlled server via the Test Connection / diagnostics feature.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection. An authenticated user with permission to manage outgoing OAuth connections can obtain the secret by pointing the token URL at an attacker-controlled endpoint and triggering validation.