CVE Vulnerability Catalog

The Better Messages plugin for WordPress (versions up to and including 3.0.4) is vulnerable to Stored DOM-Based Cross-Site Scripting via User Display Name. Due to insufficient input sanitization and output escaping, an authenticated attacker with subscriber-level access can store a malicious script that executes whenever a user accesses the injected page.

The Better Messages plugin for WordPress (versions up to and including 3.0.4) is vulnerable to generic SQL Injection via the 'group_id' Message Meta Parameter. Due to insufficient escaping of user-supplied input, an authenticated attacker with subscriber-level access can append additional SQL queries to existing ones, enabling extraction of sensitive information from the database.

The GeoDirectory plugin for WordPress (versions up to and including 2.8.181) is vulnerable to Stored Cross-Site Scripting via a Text-type Custom Field (e.g., 'phone'). Due to insufficient input sanitization and output escaping, an authenticated attacker with subscriber-level access can inject malicious scripts that execute whenever a user accesses the injected page.

A vulnerability in the Ash library allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Arguments declared with public?: false should only be set by trusted server-side code, but the lack of a public? check on these paths enables modification from user input.

The Blog2Social plugin for WordPress (versions up to and including 9.1.0) is vulnerable to authorization bypass. Due to improper verification of user authorization, an authenticated attacker with contributor-level access can view, modify, or delete other users' Blog2Social records, including disclosing network authentication IDs and scheduled post content.

The Bookly plugin for WordPress (versions up to and including 28.2) is vulnerable to Authorization Bypass via PHP Type Juggling. Due to the use of a loose inequality operator in the verification function and lack of CSRF and authentication protection in the AJAX controller, an unauthenticated attacker can bypass phone/email ownership verification and overwrite any Bookly customer's data.

The Gutenverse plugin for WordPress (versions up to and including 4.0.8) is vulnerable to Stored Cross-Site Scripting via the Post Comment Block 'suffixMain' Attribute. Due to insufficient input sanitization and output escaping, an authenticated attacker with contributor-level access can inject malicious scripts that execute whenever a user accesses the injected page.

The JetFormBuilder plugin for WordPress (versions up to and including 3.6.5.3) is vulnerable to Reflected Cross-Site Scripting via the 'jfb_xss' URL Query Variable Parameter. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject malicious scripts that execute if they can trick a user into clicking a link.

The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected. This allows unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn from the response whether an internal service answered.

The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk. This allows users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including outside the site's document root.

The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pages. This leads to Reflected Cross-Site Scripting (XSS) which could be used against any visitor, including logged-in administrators.

The OpenStation plugin for WordPress (versions up to and including 1.1.7) is vulnerable to authorization bypass. Due to improper verification of user authorization, an authenticated attacker with custom-level access can read the title, status, date, permalink, and a 300-character content excerpt of any private, draft, pending, or future post, as well as the content and AI-moderation verdicts of unapproved and spam comments.

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.

IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WIN_CERTIFICATE data ("IRONMACE Co., Ltd." and "DigiCert Trusted Root G4") instead of parsing and validating the PKCS signature data. As a result, a local unprivileged attacker may bypass this via crafted certificate data and obtain access to privileged IOCTL functionality.

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a __proto__ property to modify the prototype of an object created during serialization in clonePlainJSObject. The malformed serialized object can then cause the React Native application to crash.

A cross-site scripting (XSS) vulnerability in ningzichun student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. The echo function in admin/fun/addLog.php does not neutralize the reason/detail arguments, allowing script injection. The attack can be initiated remotely and the exploit has been publicly disclosed.

A stored cross-site scripting (XSS) vulnerability in madpsy ka9q_ubersdr before 0.1.58 in the chat message rendering functionality. User-controlled URLs were insufficiently neutralized before being converted into HTML links, and quotation characters could break out of the href attribute and inject arbitrary HTML attributes. This allows arbitrary JavaScript execution in another user's browser without requiring a click.

A vulnerability in ningzichun student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf affects an unknown functionality of the file example_lite.sql. Manipulation can lead to the use of default credentials. The attack can be launched remotely and the exploit has been publicly disclosed.

A cross-site request forgery (CSRF) vulnerability in ningzichun student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf affects an unknown function. The attack can be initiated remotely and the exploit is now public.