CVE Vulnerability Catalog

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application.

GraphicsMagick up to 1.3.47 has an uncontrolled recursion vulnerability in the function ExtractPostscript in coders/wpg.c of the WPG File Handler component. The attack can be initiated remotely. The patch is named 627b5b1b2fc2.

The MPG plugin in versions up to and including 4.2.3 allows an unauthenticated user to access sensitive data. The lack of required authentication enables exposure of confidential information.

The Cool Formkit Lite plugin in versions up to and including 2.7.8 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This allows injection of a malicious script into the site.

The Razorpay Payment Links for WooCommerce plugin in versions up to and including 2.1.5 is vulnerable to Cross Site Request Forgery (CSRF) without requiring authentication. An unauthenticated attacker can force a victim to perform unwanted actions.

The King Addons for Elementor plugin in versions up to and including 51.1.86 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This enables injection of a malicious script into the site.

The YITH WooCommerce Tab Manager plugin in versions up to and including 2.15.0 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Author privileges. This allows injection of a malicious script into the site.

The OAuth Server plugin in versions up to and including 4.5.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This enables injection of a malicious script into the site.

The Strong Testimonials plugin (up to version 3.3.11) has a Stored XSS vulnerability due to improper input neutralization during web page generation. An attacker can inject malicious scripts that execute in other users' browsers.

The Events Calendar plugin in versions up to and including 6.17.5 contains a Broken Access Control vulnerability exploitable by a user with Contributor privileges. This allows bypassing access control mechanisms.

The Review Schema plugin in versions up to and including 3.1.0 contains an Insecure Direct Object References (IDOR) vulnerability accessible without authentication. An unauthenticated attacker can access objects they should not have access to.

The Polylang plugin in versions up to and including 3.8.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This enables injection of a malicious script into the site.

Cross Site Scripting (XSS) vulnerability in CMB2 versions up to 2.13.0, exploitable by a subscriber.

Broken Access Control vulnerability in Prevent files / folders access versions up to 2.6.7, exploitable by a subscriber.

Cross Site Scripting (XSS) vulnerability in Virtue/Ascend/Pinnacle Toolkit versions up to 4.9.12.1, exploitable by a contributor.

Cross Site Scripting (XSS) vulnerability in Visual Composer Website Builder versions up to 45.16.2, exploitable by a contributor.

Unauthenticated Sensitive Data Exposure vulnerability in Notivo versions up to 1.4.2.

Unauthenticated Bypass Vulnerability in Paid Member Subscriptions versions up to 3.0.9.

Unauthenticated Broken Access Control vulnerability in Blocksy Companion versions up to 2.1.55.

The ShortPixel Image Optimizer plugin through 6.5.5 contains a deserialization of untrusted data vulnerability allowing object injection. This may lead to unauthorized actions within the WordPress application context.