CVE Vulnerability Catalog

The Video Gallery Block plugin for WordPress by bPlugins contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions through 1.6.0.

The Kali Forms plugin for WordPress contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions through 2.4.27.

The Kali Forms plugin for WordPress contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. The issue affects versions through 2.4.27.

The Simple Cloudflare Turnstile plugin for WordPress (up to version 1.44.0) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The JetEngine plugin by Crocoblock (up to version 3.9.0.1) contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The Cozy Blocks plugin by CozyThemes (up to version 2.2.27) has a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.

The WP Job Portal plugin by Ahmad (up to version 2.7.1) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The Ad Inserter plugin by Igor Funa (up to version 2.8.18) has a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.

The Product Feed Manager plugin by WPFunnels Team (up to version 7.14.1) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The Site Reviews plugin by Gemini Labs (up to version 8.3.5) has a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.

A stored cross-site scripting vulnerability in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.

A stored cross-site scripting vulnerability in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.

A server-side request forgery vulnerability in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information.

YMS-VPN8 and YMS-VPN8-CP by Yamaha register Windows services with unquoted file paths. A user with write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges.

The MW WP Form plugin for WordPress up to and including 5.1.7 is vulnerable to Sensitive Information Exposure via the 'post_id' parameter. Unauthenticated attackers can extract personally identifiable information from other users' form inquiry records, including names, email addresses and message bodies, by enumerating sequential post IDs.

A Cross-Site Request Forgery (CSRF) vulnerability in the SABBATIC application allows an attacker to trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint.

A Stored Cross-Site Scripting (XSS) vulnerability in the SABBATIC application allows an attacker to store JavaScript code that executes in the victim's browser when the page is viewed. The affected parameter is 'observaciones' in the /mis-gastos endpoint.

A Stored Cross-Site Scripting (XSS) vulnerability in the SABBATIC application allows an attacker to store JavaScript code that executes in the victim's browser when the page is viewed. The affected parameter is 'companyName' in the /empresa endpoint.

A Stored Cross-Site Scripting (XSS) vulnerability in the SABBATIC application allows an attacker to store JavaScript code that executes in the victim's browser when the page is viewed. The affected parameters are 'titulo_es' and 'add_etiquetas[]' in the /categorías endpoint.

A Stored Cross-Site Scripting (XSS) vulnerability in the SABBATIC application allows an attacker to store JavaScript code that executes in the victim's browser when the page is viewed. The affected parameter is 'nombre' in the /usuario endpoint.