CVE Vulnerability Catalog

Pretix 2025 introduces a new API endpoint that returns check-in data for all events of an organizer instead of a specific event. This allows unauthorized users to access check-in information for other events.

CoolerControl/coolercontrold before version 4.0.0 has a CORS misconfiguration, allowing unauthenticated remote attackers to read data and send commands to the service via malicious websites.

In CoolerControl/coolercontrold before version 4.0.0, unauthenticated functionality allows unauthenticated attackers to view and modify potentially sensitive data via HTTP requests.

Incorrect privilege assignment in Dell PowerScale OneFS versions 9.5.0.0-9.10.1.6 and 9.11.0.0-9.13.0.1 allows a low-privileged local attacker to escalate privileges.

A vulnerability in Dell PowerScale OneFS causes error messages to contain sensitive information. Versions 9.5.0.0 through 9.10.1.6 and 9.11.0.0 through 9.13.0.0 are affected.

The Beaver Builder Page Builder plugin for WordPress up to version 2.10.1.1 has a stored XSS vulnerability via the 'settings[js]' parameter. Authenticated attackers with author-level access can inject arbitrary scripts that execute when a page is visited.

The User Registration & Membership plugin for WordPress is vulnerable to SQL Injection via the 'membership_ids[]' parameter in all versions up to and including 5.1.2. Insufficient escaping and preparation on the SQL query allows authenticated attackers (Subscriber-level and above) to append additional SQL queries.

The BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5 due to missing nonce validation on the woobe_delete_tax_term() function. This makes it possible for unauthenticated attackers to delete WooCommerce taxonomy terms (categories, tags, etc.) via a forged request granted they can trick a site administrator or shop manager into performing an action such as clicking on a link.

The BEAR – Bulk Editor and Products Manager Professional plugin for WordPress up to version 1.1.5 is vulnerable to CSRF due to missing nonce validation in the woobe_redraw_table_row() function, allowing unauthenticated attackers to trick admins into updating WooCommerce product data.

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wsm_showDayStatsGraph' shortcode in all versions up to and including 8.4 due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute whenever a user accesses an injected page.

The Robo Gallery plugin for WordPress up to version 5.1.3 is vulnerable to Stored Cross-Site Scripting via the 'Loading Label' setting. The plugin uses a `|***...***|` marker pattern to embed raw JavaScript code within JSON configuration objects. Authenticated attackers with Author-level access can inject arbitrary scripts that execute whenever a page with the gallery is viewed.

The pdfl.io plugin for WordPress up to version 1.0.5 is vulnerable to Stored XSS via the 'text' attribute of the 'pdflio' shortcode. Lack of output escaping allows attackers with contributor-level access to inject arbitrary scripts.

The PrivateContent Free plugin for WordPress, all versions up to and including 1.2.0, has a Stored XSS vulnerability via the 'align' shortcode attribute in the [pc-login-form] shortcode. The attribute is not properly sanitized or escaped, allowing authenticated attackers with Contributor-level access and above to inject arbitrary scripts.

The Flipmart plugin for WordPress (versions up to 2.8) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The AnyTrack Affiliate Link Manager plugin for WordPress up to version 1.5.5 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.

Missing authorization in the G5Plus April theme (g5plus-april) allows exploiting incorrectly configured access control security levels. The vulnerability affects versions up to 6.8 inclusive.

The Mailercloud WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.0.7.

The tagDiv Composer (td-composer) plugin for WordPress versions up to and including 5.4.3 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags, allowing code injection.

The RT-Theme 18 | Extensions plugin for WordPress up to version 2.5 inserts sensitive data into sent information. Attackers can retrieve embedded sensitive data.

CSRF vulnerability in RT-Theme 18 | Extensions (rt18-extensions) up to version 2.5 inclusive. Allows Cross-Site Request Forgery.