CVE Vulnerability Catalog

In Bouncy Castle for Java before 1.86 (and LTS before 2.73.13), the legacy PBES1 and PKCS#12 PBE families used an unbounded iteration count from untrusted input, allowing a small input to dictate arbitrary work. The fix rejects negative or over-limit counts (default 10,000,000) via the org.bouncycastle.pbe.max_iteration_count property.

In Bouncy Castle for Java before 1.86, the opt-in key-size validation for CMS key-transport recipients (JceKeyTransRecipient.setKeySizeValidation(true)) never ran for messages using RFC 9709 (id-alg-cek-hkdf-sha256). A faulty comparison (byte array vs OID) caused the check to be skipped, accepting keys of mismatched size. This also affects BC-FJA before bcpkix-fips 2.0.13 and 2.1.13.

In Bouncy Castle for Java before 1.86, the HQC implementation leaked secret-derived data through two side channels: GF(2^8) arithmetic used lookup tables indexed by field elements, and the fixed-weight support sampler stopped scanning on collision and stored positions at a secret index. An attacker observing cache behavior or decapsulation timing can recover information about the HQC private key.

The Twenty20 Image Before-After plugin for WordPress in all versions up to and including 2.0.5 is vulnerable to Stored Cross-Site Scripting via the 'offset' shortcode attribute due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages.

In Linux Mint Xreader up to 4.6.5, the function setup_document_content_list/g_strdup_printf in backend/epub/epub-document.c (EPUB File Handler) is vulnerable to path traversal. The attack can be performed remotely and the exploit has been publicly disclosed. Upgrading to version 4.6.6 fixes the issue.

The Burst Statistics plugin for WordPress in all versions up to and including 3.7.1 is vulnerable to Improper Authentication leading to Account Persistence. The maybe_load_shared_dashboard() handler issues a genuine WordPress session cookie for the burst_statistics_viewer account to any visitor with a valid share token, and the plugin does not restrict the core password update endpoint or filter the edit_user capability, allowing an unauthenticated attacker to set an attacker-chosen password and permanently take over that account.

The WPFront Notification Bar plugin for WordPress in versions up to and including 3.5.1 is vulnerable to Reflected Cross-Site Scripting. The debug-log output path (write_debug_logs) reflects the raw value of $_SERVER['REQUEST_URI'] through vprintf() directly inside a <script> block emitted on wp_footer, without any sanitization or escaping.

The Photo Gallery by 10Web plugin for WordPress in versions up to and including 1.8.46 is vulnerable to Reflected Cross-Site Scripting via the 'thumb_url' parameter due to insufficient input sanitization and output escaping. The editimage_bwg AJAX action performs a capability check but no nonce verification, so the payload can be delivered via a crafted GET request without a CSRF token.

The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress in versions up to and including 3.5.3 is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes due to insufficient input sanitization and output escaping.

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress in versions up to and including 3.0.19 is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. An unauthenticated attacker can read, create, update, clone, and delete email notification flows, including overwriting default reservation confirmation, cancellation, and admin alert emails with attacker-controlled content.

The WPC Estimated Delivery Date for WooCommerce plugin for WordPress in versions up to and including 4.0.1 is vulnerable to Reflected Cross-Site Scripting via the 'rule_data' parameter due to insufficient input sanitization and output escaping.

The WP Ultimate Review plugin for WordPress in versions up to and including 2.4.3 is vulnerable to arbitrary shortcode execution due to improper validation of a value before running do_shortcode. The bypass relies on WordPress's strip_shortcodes() function unwrapping the [[tag]] double-bracket escape to a bare [tag] that survives wp_insert_post storage and fires when the publicly queryable xs_review post type is rendered through the_content.

The WPMobile.App – Android and iOS App Builder plugin for WordPress in versions up to and including 11.84 is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI (path segment after /android_json/search/)' parameter due to insufficient input sanitization and output escaping. Exploitation requires the app's content mode to be configured as 'webview' (i.e., the 'speed' option is not set to '1').

The WP Ultimate Review plugin for WordPress in versions up to and including 2.4.3 is vulnerable to arbitrary shortcode execution due to improper validation of a value before running do_shortcode. The nonce required to pass the only gate is emitted to unauthenticated visitors via the public review form, and submitted shortcode payloads are auto-published without admin approval by default.

The Wp Social Login and Register Social Counter plugin for WordPress in versions up to and including 3.2.1 is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute and Arbitrary User Meta Write due to insufficient input sanitization and output escaping. The attacker must chain two steps: invoking the nonce-only dismiss_ajax_call endpoint to set the xs_social_profile_image meta flag, then setting their display name to a script payload.

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page. This allows users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators.

The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read. This allows users granted the translator capability to retrieve the contents of files of certain types from anywhere on the server, including outside the web root.

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement. This allows users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce, or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data. This allows an unauthenticated attacker to modify or delete another customer's stored cart.

The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress in versions up to and including 1.10.41 is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. An authenticated attacker with subscriber-level access or higher can overwrite the post_content of any post or page with LLM-generated text, influencing SEO and consuming paid AltText.ai API credits.