CVE Vulnerability Catalog

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users who can store a payload in user meta fields such as the biography, session_tokens (via a crafted User-Agent at login), or persisted_preferences (via the REST API), which are then promoted to the site-wide redux_demo option when a media URL repair is triggered on the demo panel.

The Ad Inserter plugin for WordPress up to version 2.8.18 is vulnerable to Reflected XSS via the 's' search parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks a crafted link. Exploitation requires an ad block with {title} or {short-title} placeholder enabled on search pages.

The Duplicate Post plugin for WordPress up to version 1.5.6 is vulnerable to Stored XSS via the 'noti_token' parameter. Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access or higher to inject arbitrary scripts that execute when a user accesses an injected page. This requires the site owner to enable User Level Permissions for the Subscriber role.

MISP contains a reflected XSS vulnerability in the analyst data notes panel. The seed path parameter supplied via URL is passed directly into inline JavaScript without sanitization. An attacker can trick an authenticated user into visiting a crafted URL, allowing arbitrary JavaScript execution in the victim's browser. Affects versions prior to the fix (commit 58925dbf0, post v2.5.48).

MISP contains a reflected XSS vulnerability in legacy taxonomy tag confirmation forms (add and disable tag). The forms echoed user-supplied tag names without escaping. An attacker can trick an administrator into visiting a crafted URL with a malicious tag, allowing arbitrary JavaScript execution in the admin's session. Affects versions <2.5.48.

The bbp style pack plugin for WordPress up to version 6.4.8 is vulnerable to Stored XSS via 'display_name' and 'bbp_reply_content' parameters. Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access or higher to inject arbitrary scripts that execute when a user accesses an injected page. Successful exploitation requires wrapping the reply in a <pre> block to prevent quote conversion.

The Calculated Fields Form plugin for WordPress up to version 5.5.1.3 is vulnerable to Reflected DOM-Based XSS via the 'x' parameter (attacker-chosen name matching the form's url.<name> predefined value). Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user clicks a crafted link. Exploitation requires a Text Area field with 'url.<name>' Predefined Value and predefinedClick disabled.

The Calculated Fields Form plugin for WordPress up to version 5.5.1.3 is vulnerable to Reflected DOM-Based XSS via the 'x' parameter (any URL parameter consumed by the form's calculated equation). Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user clicks a crafted link. Exploitation requires a public form with a Select2 dropdown populated via a calculated equation using GETURLPARAMETER() and setChoices().

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress up to version 3.0.1 is vulnerable to Reflected XSS via URL. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user accesses an injected page. Exploitation requires the victim to be on a mobile user-agent and click the WeChat share icon, but script execution is automatic once the dialog opens.

Multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, and Apeos C3567 1.1.3, have a path traversal vulnerability in the web management interface. The vulnerability is in the handling of externally supplied parameters. A specially crafted malicious request may trigger unintended processing.

The Ad Inserter plugin for WordPress up to version 2.8.18 is vulnerable to Reflected XSS via the Referer header. Insufficient input sanitization and output escaping on the '{search-query}' dynamic tag allow unauthenticated attackers to execute arbitrary JavaScript in the context of the site for any visitor, including a signed-in administrator. Exploitation requires an ad block with the '{search-query}' tag and automatic insertion enabled.

A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. An unknown function in backend/app/modules/ai/ai_client.py within the AI Provider Configuration Handler component allows exposure of data to the wrong session. The attack can be launched remotely and the exploit is publicly available.

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider. This allows unauthenticated attackers to mark arbitrary orders as paid without payment.

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request. This allows unauthenticated attackers to obtain the order key of an arbitrary order and view its contents.

The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization. This allows unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host.

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers. This allows any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync.

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 due to improper verification of user authorization. This allows authenticated attackers with subscriber-level access and above to delete arbitrary media library attachments, including administrator-owned files, when a Custom Fonts field is registered on the user profile page.

The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response served as HTML. This allows attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link.

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page. This could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's download dialogue, including administrators. Only sites running PHP below 8.1 are affected.

HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain.