CVE Vulnerability Catalog

The Contact Form DB for Enfold plugin for WordPress in versions up to and including 2.0.2 is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. The payload is echoed unescaped in a title HTML attribute and in the table cell body in admin/ecf_index.php, and base64 encoding and serialization do not neutralize the malicious content.

The JTL-Connector for WooCommerce plugin for WordPress in versions up to and including 2.4.3 is vulnerable to time-based SQL Injection via the 'product.push' Identity Endpoint. Due to insufficient escaping of a user-supplied parameter and lack of sufficient preparation on the existing SQL query, an unauthenticated attacker can append additional SQL queries to existing ones to extract sensitive information from the database. The injection fires during identity linking before ProductController::push() executes, so exploitation succeeds even if downstream product handling would otherwise reject the request.

The Document Gallery plugin for WordPress in versions up to and including 5.1.1 is vulnerable to Stored Cross-Site Scripting via the 'dg_thumber_webhook' Action Request Body. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. Exploitation requires that logging be enabled in the plugin's Advanced settings, which is only the default state when WP_DEBUG is true; otherwise an administrator must manually enable it.

Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled. This can lead to memory corruption and potential code execution.

The NewStatPress plugin for WordPress in versions up to and including 1.4.5 is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. Exploitation requires that an administrator has placed the [NewStatPress type="Top Pages"] shortcode on a publicly viewable page, and that the attacker's crafted URL accumulates enough hits to appear in the top-N ranking.

Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The URL scheme filter (FURLRequestFilter) is empty by default, which permits all URL schemes. On Windows, this results in a call to ShellExecuteW() with the open verb, so a supplied file:/// URI causes the referenced file to be executed. Any Unreal Engine game that loads user-generated content containing Blueprints is vulnerable to command execution via a malicious local file or a remote file on a WebDAV share. This is an instance of CWE-1188 (Initialization of a Resource with an Insecure Default).

TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with crafted content to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.

TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into opening a crafted link to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.

The AnyComment plugin for WordPress in versions up to and including 0.3.6 is vulnerable to Stored Cross-Site Scripting via the 'email' parameter. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in AnyCommentSubscriptionsTable::column_default(), which returns the stored email verbatim into an HTML <td> when the subscription's user_ID does not resolve to an existing WP_User. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the AnyComment → Subscriptions admin page.

The Abandoned Cart Pro for WooCommerce plugin for WordPress in versions up to and including 10.8.0 is vulnerable to generic SQL Injection via the 'validate' parameter. Due to insufficient escaping of a user-supplied parameter and lack of sufficient preparation on the existing SQL query, an unauthenticated attacker can append additional SQL queries to existing ones to extract sensitive information from the database. AES-CTR is a malleable stream cipher, so an attacker who obtains one legitimate token by abandoning a cart with an email address they control can recover the keystream and forge a ciphertext carrying arbitrary SQL. The HMAC check added in 10.4.1 is enforced only when the wcap_nonce parameter is present, so omitting the parameter skips it entirely.

Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Virtual I/O Server. Affects versions from 01-00 before 01-23-/A for AIX and from 01-04 before 01-23-/A for Virtual I/O Server.

The Directorist plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 8.10.2.1. Authenticated attackers with subscriber-level access can delete arbitrary business directory listings, including those owned by other users.

The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to and including 5.9. Unauthenticated attackers can include arbitrary PHP files on the server, potentially leading to remote code execution.

The Membership & User Roles for WooCommerce plugin is vulnerable to privilege escalation in versions up to and including 20260828. Authenticated attackers with subscriber-level access can restore previously revoked administrator privileges.

The Bit integrations plugin for WordPress is vulnerable to privilege escalation via log re-execution in all versions up to and including 2.10.6. Unauthenticated attackers can overwrite the administrator's password and take over the administrator account.

The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.7.29. Unauthenticated attackers can retrieve personally identifiable information for every booked customer, including names, email addresses, phone numbers, and physical addresses.

A remote code execution vulnerability in ONLYOFFICE Document Server versions before 10.0.0 allows an authenticated attacker with a valid JWT to execute arbitrary operating system commands as the ds service account.

Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions.

Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication, allowing modification of device state or management settings.

The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges.