CVE Vulnerability Catalog

The Flexible Subscriptions plugin for WordPress up to version 1.8.4 contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects the flexible-subscriptions function.

The JetElements For Elementor plugin for WordPress up to version 2.9.2.3 contains a stored XSS vulnerability in the jet-elements function. The vulnerability is due to improper neutralization of input during web page generation.

Stored XSS vulnerability in the JetMenu plugin by Crocoblock. Improper input neutralization during web page generation allows persistent injection of malicious script.

Stored XSS vulnerability in the Ad Inserter plugin by Igor Funa. Improper input neutralization during page generation allows persistent script injection.

Missing authorization in the Products Restricted Users for WooCommerce plugin by Codection. Incorrectly configured access control security levels can be exploited by unauthorized users.

Missing authorization in the WP User Manager plugin. Incorrectly configured access control security levels can be exploited by unauthorized users.

Vulnerability involving insertion of sensitive information into sent data in the Booster Elite for WooCommerce plugin. Allows retrieval of embedded sensitive data.

SQL injection vulnerability in SEMCMS (up to 5.0) in SEMCMS_Banner.php. Manipulation of input can lead to SQL injection, remotely exploitable.

SQL injection vulnerability in SEMCMS (up to 5.0) in SEMCMS_Download.php. Manipulation of input leads to SQL injection, remotely exploitable.

Improper authorization vulnerability in SEMCMS (up to 5.0) in /admin/SEMCMS_User.php?Class=Deleted&CF=user. Manipulation leads to improper authorization, remotely exploitable.

Information disclosure vulnerability in WMCMS 4.446.1257 in /index.php. Manipulation of the path/file argument leads to information disclosure, remotely exploitable.

Information disclosure vulnerability in tsi-coop tsi-dpdp-cms versions 0.5.0/0.5.1/0.5.2 in the JSON Schema Validation component. Manipulation of the _func argument leads to information disclosure, remotely exploitable.

The Event post plugin (up to version 6.1.1) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions they are not permitted to.

The VideoWhisper Site Manager for ChatGPT, Claude, Codex plugin (up to version 1.2.10) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may gain access to functions or data they should not be permitted to.

The Paid Videochat Turnkey Site plugin (up to version 7.5.12) contains an Improper Validation of Specified Quantity in Input vulnerability that allows input data manipulation. An attacker may supply invalid quantity values, potentially leading to unexpected application behavior.

The Event post plugin (up to version 6.1.1) contains an Authorization Bypass Through User-Controlled Key vulnerability that allows bypassing authorization by manipulating a user-controlled key. An attacker may gain access to resources or perform actions they are not authorized to.

The Flexible Quantity – Measurement Price Calculator for WooCommerce plugin (up to version 2.3.22) contains an Improper Validation of Specified Quantity in Input vulnerability that allows input data manipulation. An attacker may supply invalid quantity values, potentially leading to incorrect price or product quantity calculations.

The TMDS plugin (up to version 1.0.15) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions they are not permitted to.

OTRS does not sufficiently neutralize user-controlled values that are later included in CSV exports. An attacker can inject values beginning with spreadsheet formula characters (=, +, -, @), which when the CSV file is opened in spreadsheet software may be interpreted as formulas and perform unintended actions. This affects versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.7.X, and OTRS Community Edition 6.x and earlier.

OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends (e.g., database and LDAP) are configured, the uniqueness check for customer user email addresses is performed only within the selected backend, allowing an authenticated user with permission to create or modify customer users to create a customer user whose email address is already assigned to a customer user in another backend. This can result in customer-related information or email communication being associated with or exposed to the wrong customer user. This affects versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.7.X, and OTRS Community Edition 6.x and earlier.