CVE Vulnerability Catalog

The Prime Slider plugin for Elementor up to version 4.1.10 contains a Stored XSS vulnerability via the 'follow_us_text' setting in the Mount widget. Insufficient input sanitization and output escaping allow attackers with author-level access or higher to inject arbitrary scripts.

The LearnPress – WordPress LMS Plugin is vulnerable to Stored Cross-Site Scripting via the 'skin' attribute of the learn_press_courses shortcode in all versions up to and including 4.3.3. Insufficient input sanitization and output escaping on the 'skin' attribute allows authenticated attackers (Contributor-level and above) to inject arbitrary web scripts.

Missing authorization in the MainWP Child Reports plugin for WordPress (up to version 2.2.6). Authenticated attackers with Subscriber access can obtain activity log entries (including action summaries, user info, IP addresses) via the Heartbeat API.

The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress up to version 3.3.13 lacks authorization in its webhook handler. Unauthenticated attackers can modify subscription settings, downgrading paid plans to Trial and changing store type and expiration dates.

The Investi plugin for WordPress up to version 1.0.26 has a stored XSS vulnerability via the 'maximum-num-years' attribute of the 'investi-announcements-accordion' shortcode. The attribute is not properly sanitized, allowing authenticated attackers with contributor-level access to inject arbitrary scripts.

The TableOn WordPress plugin up to version 1.0.4.4 contains a stored XSS vulnerability via shortcode attributes 'class', 'help_link', 'popup_title', and 'help_title'. These attributes are not properly sanitized or escaped before being inserted into HTML, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary scripts.

The Strong Testimonials plugin for WordPress versions up to 3.2.21 contains a stored cross-site scripting vulnerability via the testimonial_view shortcode due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.

The LightPress Lightbox plugin for WordPress up to version 2.3.4 contains a stored XSS vulnerability via the `group` attribute in the `[gallery]` shortcode. Lack of proper escaping allows authenticated attackers with Contributor-level access and above to inject arbitrary scripts that execute when a page is viewed.

The Blubrry PowerPress plugin for WordPress versions up to 11.15.15 contains a stored cross-site scripting vulnerability via the 'powerpress' and 'podcast' shortcodes due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.

The latest version of parisneo/lollms contains an insufficient session expiration vulnerability. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This is due to the absence of logic to reject requests after inactivity and the excessively long default session duration of 31 days. Attackers can maintain persistent access to a compromised account even after the victim resets their password.

In Go, context was not properly tracked across template branches for JS template literals, leading to incorrect escaping. Template actions within JS template literals also did not track brace depth, causing improper escaping. These issues could lead to XSS vulnerabilities.

The tar.Reader function in Go can allocate an unbounded amount of memory when reading a maliciously crafted archive containing a large number of sparse regions encoded in the 'old GNU sparse map' format.

On Linux, if the target of Root.Chmod is replaced with a symlink during the chmod operation, Chmod can operate on the symlink target even if it lies outside the root. The fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag. Root.Chmod checks its target before acting and returns an error if the target is a symlink outside the root, so impact is limited to cases where the target is replaced between check and operation.

The Elementor Website Builder plugin for WordPress up to version 3.35.5 contains a Stored XSS vulnerability via several widget parameters. Insufficient input sanitization and output escaping allow attackers with contributor-level access or higher to inject arbitrary scripts.

The Gravity Forms plugin for WordPress up to version 2.9.30 is vulnerable to Reflected XSS via the `form_ids` parameter in the `gform_get_config` AJAX action. This is due to the `GFCommon::send_json()` method outputting JSON data wrapped in HTML comments with a `Content-Type: text/html` header instead of `application/json`. The `wp_json_encode()` function does not HTML-encode angle brackets, allowing injected HTML/script tags. The `config_nonce` is publicly embedded on every page with a Gravity Forms form, making it identical for all unauthenticated visitors within a 12-hour nonce tick. This allows unauthenticated attackers to inject arbitrary web scripts if they can trick a user into clicking a link. The vulnerability does not work against authenticated users.

The Download Monitor plugin for WordPress up to version 5.1.10 is vulnerable to Cross-Site Request Forgery (CSRF) in the actions_handler() and bulk_actions_handler() functions. Missing nonce verification allows an unauthenticated attacker to delete, disable, or enable approved download paths via a forged request, provided they trick an administrator into clicking a link.

The Gravity Forms plugin for WordPress up to version 2.9.30 has a Stored XSS vulnerability in the Credit Card field's 'Card Type' sub-field. The get_value_entry_detail() method outputs the value without escaping, and get_value_save_entry() accepts unsanitized input. The Card Type field is not rendered on the frontend but the backend accepts it from POST requests. Unauthenticated attackers can inject arbitrary scripts that execute when an admin views the entry in the dashboard.

The Hustle plugin for WordPress up to version 7.8.10.2 has an unauthorized data modification vulnerability due to a missing capability check in the 'hustle_module_converted' AJAX action. Unauthenticated attackers can forge conversion events for any Hustle module, including draft modules.

The Score extension in MediaWiki (The Wikimedia Foundation) is vulnerable to Cross-Site Scripting (XSS) due to improper input neutralization. The issue has been fixed in the master branch and in versions 1.43, 1.44, and 1.45.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CampaignEvents Extension allows Cross-Site Scripting (XSS). This issue was remediated only on the `master` branch.