CVE Vulnerability Catalog

Allocation of resources without limits or throttling and initialization of a resource with an insecure default vulnerability exists in Apache Thrift Python bindings. This issue affects Apache Thrift versions before 0.25.0.

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the 'Remove query strings from static resources' option is enabled in W3 Total Cache.

HAVELSAN Inc. Sef - AI Chatbot Platform before 2.1 has an SQL injection vulnerability due to improper neutralization of special elements in SQL commands. The product is no longer supported.

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. An LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers. This issue affects versions from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9.

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in an LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced to avoid a server DoS. This issue affects versions from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9.

Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects versions from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9.

Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflows the stack in the server's decoder. This issue affects versions from 1.2.0 before 1.2.9.

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer (or a MITM) can send a small BER-encoded response causing a large memory allocation before any data is received, leading to OutOfMemoryError and denial of service. This issue affects versions from 1.2.0 before 1.2.9.

HAVELSAN Inc. Sef - AI Chatbot Platform before 2.1 has an improper certificate validation vulnerability allowing Adversary in the Middle (AiTM) attacks. The product is no longer supported.

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to and including 5.122.0 due to insufficient input sanitization and output escaping. This requires the image attachment feature to be enabled, allowing unauthenticated attackers to submit a review with a malicious author name and upload an image via a public endpoint.

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to and including 4.28.3 due to insufficient input sanitization and output escaping. This is only exploitable when the administrator has configured a non-empty value for the "Allowable tags in excerpts" setting.

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to and including 3.6.5.4 due to insufficient input sanitization and output escaping. The attack is possible via the unauthenticated wp_ajax_nopriv_jet_form_builder_submit endpoint.

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Type in all versions up to and including 2.13.0 due to insufficient input sanitization and output escaping. This is only exploitable when an integrating plugin or theme registers a file_list field on a publicly accessible front-end form or user meta box.

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to and including 2.4.2 due to insufficient input sanitization and output escaping. This is exploitable on any board configured with the default write_level=0 and editor_type=N settings.

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to and including 3.22.0 due to insufficient input sanitization and output escaping. This mXSS-style transform bypasses WordPress comment kses sanitization because the payload is stored using only kses-allowed tags and attributes; the malicious event handlers and style fragments become active only when the plugin's output-buffer callback rewrites the rendered HTML at request time.

The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_id' parameter in all versions up to and including 5.1.7 due to insufficient input sanitization and output escaping. The CSRF gate protecting form submission is bypassable by any unauthenticated visitor who first loads the public form page to obtain a valid double-submit cookie.

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'np1' Custom Field Parameter in all versions up to and including 9.4.0 due to insufficient input sanitization and output escaping. The subscription endpoint requires no nonce, no capability check, and no CAPTCHA, and the payload can be smuggled past email-address validation by embedding the {profile_1} placeholder in the local part of the submitted address.

The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to and including 3.6.0 due to insufficient input sanitization and output escaping. Comment moderation delays but does not prevent exploitation — once an administrator approves the visually innocuous comment, the stored payload executes in the browser of every subsequent visitor to the affected post.

The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has enabled the 'Link Encoding: Base64' option in the plugin settings.

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator accesses the feed builder preview page. This attack requires only a Facebook account to post a comment on the connected Facebook Page, with no WordPress credentials needed; additionally, the use of v-show rather than v-if means injected HTML — including onerror handlers — is evaluated in the DOM even when the comment section is not visually displayed. When combined with the lack of URL validation in the cff_install_addon AJAX handler (admin/addon-functions.php), an injected script running in an administrator's session can trigger arbitrary plugin installation from an attacker-controlled URL, which may result in server-side code execution.