CVE Vulnerability Catalog

Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FluentBoards: from n/a through 2.1.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS. This issue affects Prime Slider – Addons For Elementor: from n/a through 4.7.1.

Missing Authorization vulnerability in TMS Amelia ameliabooking allows exploiting incorrectly configured access control security levels. This issue affects Amelia from n/a through 2.4.10.

A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete. Manipulation of the argument teamId causes improper privilege management. The attack can be initiated remotely and the exploit has been publicly disclosed.

The WordPress plugin WP User Manager (up to version 2.9.24) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This may permit unauthorized access to user management functions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureForms allows Stored XSS. This issue affects SureForms from n/a through 2.12.7.

Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce allows exploiting incorrectly configured access control security levels. This issue affects Pay for Payment for WooCommerce from n/a through 3.0.1.

Missing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments allows exploiting incorrectly configured access control security levels. This issue affects Quick Paypal Payments from n/a through 6.0.3.

The Premium Addons for Elementor plugin up to version 4.11.110 contains a stored XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject malicious scripts that will execute in other users' browsers.

The Active Products Tables for WooCommerce plugin up to version 2.1.3 has a vulnerability of inserting sensitive information into sent data, allowing retrieval of embedded sensitive data. An attacker can exploit this to extract confidential information from the system.

The PowerPack Addons for Elementor plugin up to version 3.1.0 contains a stored XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject malicious scripts that will execute in other users' browsers.

The Books Gallery plugin up to version 4.8.4 contains a stored XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject malicious scripts that will execute in other users' browsers.

The FOX (woocommerce-currency-switcher) plugin up to version 1.5.4 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can gain access to functions that should be protected.

The User Registration plugin up to version 5.2.8 has a missing authorization vulnerability, allowing retrieval of embedded sensitive data. An attacker can exploit this to extract confidential information from the system.

The User Registration plugin up to version 5.2.8 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can gain access to functions that should be protected.

The User Registration plugin up to version 5.2.8 contains a stored XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject malicious scripts that will execute in other users' browsers.

The User Registration plugin up to version 5.2.8 contains a Cross-Site Request Forgery (CSRF) vulnerability, allowing an attacker to force an authenticated user to perform unwanted actions. The attack can be carried out without the victim's knowledge.

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress up to version 2.8.18 contains a sensitive information exposure vulnerability via ai_wp_footer_hook. This allows authenticated attackers with subscriber-level access and above to extract data such as the server's internal IP address, PHP configuration, WordPress and theme versions, hardening constants, the plugin's full block matrix, and all post meta values including underscore-prefixed protected keys such as API tokens and private integration state written by other plugins.

HCL Connections is vulnerable to a cross-site scripting (XSS) attack that allows an attacker to execute arbitrary script code in the browser of an unsuspecting user. This may lead to stealing cookie-based authentication credentials and compromising user accounts.

The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'counterid' parameter in all versions up to and including 3.0. This allows authenticated attackers with editor-level access or above to append additional SQL queries to existing ones.