CVE Vulnerability Catalog

The AI Translation for Polylang plugin up to version 1.6.2 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Attackers can gain unauthorized access to translation functions.

The Super Payments WordPress plugin before version 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key is empty by default. This allows unauthenticated attackers to forge a valid signature and mark arbitrary WooCommerce orders as paid without payment.

Apache CXF's OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets without validating that the final decoded URI belongs to the RP's origin. Both directly encoded and double-encoded external URLs can trigger the issue.

The Ultimate Member plugin for WordPress in versions up to and including 2.13.1 contains an Incorrect Privilege Assignment vulnerability that allows Privilege Escalation. The issue affects all versions from n/a through 2.13.1.

The ProfilePress (wp-user-avatar) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 4.17.3.

The ProfilePress (wp-user-avatar) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 4.17.3.

The ThemeGrill User Registration (user-registration) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 5.2.7.

The codemstory 워드프레스 결제 심플페이 (pgall-for-woocommerce) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 5.5.17.

The Magepeople inc. Deposits and Partial Payments for WooCommerce (advanced-partial-payment-or-deposit-for-woocommerce) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 4.0.1.

The Crocoblock JetReviews (jet-reviews) plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 3.1.2.

The Mamunur Rashid Classified Listing (classified-listing) plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 6.1.2.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Incorrect Authorization vulnerability. A high-privileged attacker with remote access could exploit it, leading to privilege escalation and unauthorized access.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain a Path Traversal vulnerability (improper limitation of a pathname to a restricted directory). A high-privileged attacker with local access could exploit it, leading to code execution and filesystem access.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low-privileged attacker with local access could exploit it, leading to information disclosure, protection mechanism bypass, and unauthorized access.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Server-side request forgery.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS. This issue affects JetBlocks For Elementor: from n/a through 1.5.2.1.

The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.

The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields of the page being viewed.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Not Failing Securely ('Failing Open') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.