CVE Vulnerability Catalog

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.

The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned listing-management role to inject arbitrary web scripts that execute when a listing is viewed by any visitor, including an administrator.

The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published.

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access (who do not hold unfiltered_html) to store a payload that executes when the page is rendered.

The Popup Maker WordPress plugin through version 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce. This allows authenticated users with minimal privileges such as Subscribers to overwrite a site-wide option (the linked service account and API configuration) that should only be modifiable by administrators.

The Avada theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to and including 7.16.1 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into clicking a link.

The Paytm Payment Gateway WordPress plugin before version 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation. This allows unauthenticated attackers to change the status of arbitrary orders, including marking unpaid orders as paid and reducing stock.

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to and including 3.1.15.1 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses an injected page. Exploitation requires an administrator to have enabled Autoptimize's 'Lazy-load images?' option, the w3-total-cache/w3-total-cache.php file to be present on disk with the plugin disabled, a class named Minify_HTML to be loaded into scope by another plugin, and the malicious comment to be approved by a moderator before the payload renders.

The Tabs Responsive WordPress plugin through version 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page.

Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications.

A security flaw has been discovered in calcom cal.diy up to 6.2.0. It affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Manipulation results in missing authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used. The pull request to fix this issue awaits acceptance.

A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown function of the file admin_reservefilter.php. Manipulation of the argument filter leads to SQL injection. The attack can be launched remotely. The exploit is publicly available and might be used.

A vulnerability was determined in itsourcecode Pet Shop Management System 1.0. The affected element is an unknown function of the file admin_reject_completed.php. Manipulation of the argument ID causes SQL injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

The Mooncake transfer engine through version 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single listener thread in writeFully(), breaking all subsequent handshakes, metadata fetches, notify and probe requests.

Office-PowerPoint-MCP-Server through version 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by supplying absolute paths or ../ sequences. Attackers can steer an AI agent via prompt injection to abuse save_presentation, open_presentation, or manage_image output_path to overwrite any server-writable file or load external files.

A Cross-Site Scripting (XSS) vulnerability in CAPEC-63 before version 3.0b63 is due to improper neutralization of input during web page generation (CWE-79). This allows an attacker to inject malicious scripts into pages that execute in the victim's browser.

An External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 before version 3.0b63 allows path traversal attacks. This allows an attacker to manipulate file paths to access files outside the intended directory.

An Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 before version 3.0b63 allows authentication abuse. This may allow an attacker to exploit default settings for unauthorized access.

An Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo before version 3.3b63 allows collecting data from common resource locations. An attacker can exploit this to access confidential data stored in the system.

infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py). Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations.