CVE Vulnerability Catalog

The WordPress plugin WP User Manager (up to version 2.9.24) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This may permit unauthorized access to user management functions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureForms allows Stored XSS. This issue affects SureForms from n/a through 2.12.7.

Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce allows exploiting incorrectly configured access control security levels. This issue affects Pay for Payment for WooCommerce from n/a through 3.0.1.

Missing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments allows exploiting incorrectly configured access control security levels. This issue affects Quick Paypal Payments from n/a through 6.0.3.

The Premium Addons for Elementor plugin up to version 4.11.110 contains a stored XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject malicious scripts that will execute in other users' browsers.

The Active Products Tables for WooCommerce plugin up to version 2.1.3 has a vulnerability of inserting sensitive information into sent data, allowing retrieval of embedded sensitive data. An attacker can exploit this to extract confidential information from the system.

The PowerPack Addons for Elementor plugin up to version 3.1.0 contains a stored XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject malicious scripts that will execute in other users' browsers.

The Books Gallery plugin up to version 4.8.4 contains a stored XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject malicious scripts that will execute in other users' browsers.

Blind SQL Injection vulnerability in WOLF bulk-editor plugin by PluginUs.Net. Improper neutralization of special elements in SQL command allows blind SQL injection.

The FOX (woocommerce-currency-switcher) plugin up to version 1.5.4 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can gain access to functions that should be protected.

The User Registration plugin up to version 5.2.8 has a missing authorization vulnerability, allowing retrieval of embedded sensitive data. An attacker can exploit this to extract confidential information from the system.

The User Registration plugin up to version 5.2.8 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can gain access to functions that should be protected.

The User Registration plugin up to version 5.2.8 contains a stored XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject malicious scripts that will execute in other users' browsers.

The User Registration plugin up to version 5.2.8 contains a Cross-Site Request Forgery (CSRF) vulnerability, allowing an attacker to force an authenticated user to perform unwanted actions. The attack can be carried out without the victim's knowledge.

An incorrect permission assignment for critical resource in AssetView, AssetView CLOUD, and AssetView Cloud +. A local authenticated attacker may gain SYSTEM privileges.

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress up to version 2.8.18 contains a sensitive information exposure vulnerability via ai_wp_footer_hook. This allows authenticated attackers with subscriber-level access and above to extract data such as the server's internal IP address, PHP configuration, WordPress and theme versions, hardening constants, the plugin's full block matrix, and all post meta values including underscore-prefixed protected keys such as API tokens and private integration state written by other plugins.

HCL Connections is vulnerable to a cross-site scripting (XSS) attack that allows an attacker to execute arbitrary script code in the browser of an unsuspecting user. This may lead to stealing cookie-based authentication credentials and compromising user accounts.

The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'counterid' parameter in all versions up to and including 3.0. This allows authenticated attackers with editor-level access or above to append additional SQL queries to existing ones.

Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService. This could allow an attacker to load an unauthorized driver.

The WPGraphQL plugin for WordPress has a missing authorization vulnerability that allows retrieving embedded sensitive data. This affects all versions from n/a through 2.23.1.