CVE Vulnerability Catalog

Stored XSS vulnerability in the WP Travel Engine plugin for WordPress (versions up to 6.7.5). Insufficient input sanitization and output escaping in the 'wte_trip_tax' shortcode allow authenticated attackers (contributor level and above) to inject malicious JavaScript.

The ElementsKit Elementor Addons and Templates plugin for WordPress up to 3.7.9 has a stored XSS vulnerability via the 'ekit_tab_title' parameter in the Simple Tab widget. Authentication at contributor level or above is required.

The Shortcodes Ultimate plugin for WordPress up to version 7.4.8 contains a Stored Cross-Site Scripting vulnerability via the su_carousel shortcode, due to insufficient input sanitization and output escaping in the 'su_slide_link' attachment meta field.

The Shortcodes Ultimate plugin for WordPress up to version 7.4.7 has a Stored XSS vulnerability in the 'src' attribute of the su_lightbox shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject scripts.

The Royal Addons for Elementor plugin for WordPress up to 1.7.1049 has a stored XSS vulnerability via the 'button_text' parameter. Authentication at contributor level or above is required.

Stored Cross-Site Scripting (XSS) vulnerability in WordPress Simple Shopping Cart plugin up to version 5.2.4. Through the 'wpsc_display_product' shortcode and user-supplied attributes, attackers with contributor-level access or higher can inject arbitrary scripts that execute when a page is visited.

The Ultimate Member plugin for WordPress up to version 2.11.1 is vulnerable to stored cross-site scripting (XSS) via the user description field due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary scripts that execute when a user visits an affected page. The vulnerability is exploitable only when "HTML support for user description" is enabled in Ultimate Member settings.

Stored Cross-Site Scripting (XSS) vulnerability in WordPress Xpro Addons plugin up to version 1.4.20. Through the 'onClick Event' setting in the Pricing Widget, attackers with contributor-level access or higher can inject arbitrary scripts that execute when a page is visited.

Stored XSS vulnerability in the Xpro Addons plugin for WordPress (versions up to 1.4.24). Insufficient input sanitization and output escaping in the Icon Box widget allow authenticated attackers (contributor level and above) to inject malicious JavaScript.

The Gutenverse plugin for WordPress up to version 3.4.6 contains a stored XSS vulnerability via the 'imageLoad' parameter. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts.

The Pie Register plugin for WordPress has a missing capability check in the pie_main() function, allowing unauthenticated attackers to change registration form status. Affects versions up to and including 3.8.4.8.

Vulnerability in Electron (versions before 38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8) on macOS. The app.moveToApplicationsFolder() function uses AppleScript that improperly handles certain characters in the path, potentially leading to arbitrary AppleScript execution when the user accepts the prompt.

In Electron prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, a service worker running in a session can spoof reply messages on the internal IPC channel used by webContents.executeJavaScript() and related methods, causing the main-process promise to resolve with attacker-controlled data.

In Electron prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, when an iframe requests fullscreen, pointerLock, keyboardLock, openExternal, or media permissions, the origin passed to session.setPermissionRequestHandler() was the top-level page's origin rather than the requesting iframe's origin. Apps that grant permissions based on the origin parameter may inadvertently grant permissions to embedded third-party content.

Electron before versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0 on macOS and Linux has an out-of-bounds heap read vulnerability when parsing a crafted second-instance message if the app calls app.requestSingleInstanceLock(). Leaked memory can be delivered to the app's second-instance event handler. This issue is limited to processes running as the same user as the Electron app. Windows is not affected.

In Electron prior to versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0, the nodeIntegrationInWorker setting was not correctly scoped. In certain process-sharing scenarios, workers spawned in frames with nodeIntegrationInWorker: false could still receive Node.js integration. Only apps that enable nodeIntegrationInWorker are affected.

Electron on Windows does not validate the protocol name in app.setAsDefaultProtocolClient() before writing to the registry. Apps passing untrusted input as the protocol name may allow an attacker to write to arbitrary registry subkeys, potentially hijacking existing protocol handlers.

Electron, a framework for building desktop applications, has a use-after-free vulnerability when apps allow downloads and programmatically destroy sessions. If a session is torn down while a native save-file dialog is open, dismissing the dialog dereferences freed memory, potentially leading to a crash or memory corruption. This affects versions prior to 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.

Electron, a framework for building desktop applications, has an HTTP response header injection vulnerability. Apps that register custom protocol handlers via protocol.handle() or modify response headers via webRequest.onHeadersReceived may be vulnerable if attacker-controlled input is reflected into a response header name or value. This affects versions prior to 38.8.6, 39.8.3, 40.8.3, and 41.0.3.

In the Nimiq Proof-of-Stake Rust implementation (core-rs-albatross), two consensus request handlers assume the history index is always available, causing a panic (unwrap) during node sync. A remote attacker can crash the node.