CVE Vulnerability Catalog

In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) from version 2.5.0 to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when hovering over the data point.

In Progress® KendoReact (@progress/kendo-react-charts) from version 1.1.0 to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when hovering over the data point.

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. The vulnerability is due to the endpoint's permission callback returning true unconditionally combined with insufficient validation of the input, allowing unauthenticated attackers to read arbitrary files on the server.

The PeproDev Ultimate Profile Solutions plugin for WordPress up to version 8.2.36 is vulnerable to Stored Cross-Site Scripting (XSS) via the 'button' attribute of the 'logout-url' shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access to inject arbitrary web scripts that execute when a user accesses an injected page.

ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information.

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name>' parameter in all versions up to and including 1.7.31 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page, but this requires specific administrator configuration.

The Listdom plugin for WordPress up to version 6.1.2 is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSD_Menus_IX_CSV::import function. Authenticated attackers with administrator-level access can delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

The Retainful plugin (Email Marketing for WordPress and WooCommerce) is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to and including 1.0.10 due to insufficient input sanitization and output escaping.

The Avada theme for WordPress and WooCommerce is vulnerable to Stored Cross-Site Scripting via user profile 'Author Page' social link contact-method fields (author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, author_email) in versions up to and including 7.16.1. These fields are emitted in an anchor href without rejecting dangerous URL schemes such as javascript:.

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter in all versions up to and including 44.1 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject scripts that execute when an administrator visits the WPO365 wizard page, with the payload stored in the wpo365_errors transient for up to three days.

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling plugin for WordPress is vulnerable to generic SQL Injection via the 'booking[service_id]' parameter in all versions up to and including 5.7.2 due to insufficient escaping and lack of query preparation. Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database.

The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via the 'display_name' Profile Field (Second-Order) in all versions up to and including 1.5.9 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query.

The Motors – Car Dealership & Classified Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up to, and including, 1.4.124 due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts that execute when a user accesses an injected page; the nonce required by the stm_ajax_add_a_car AJAX handler is emitted in wp_footer on every page, making it accessible to any authenticated user.

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to and including 9.3.03.002 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject scripts that execute when a user accesses an injected page, using a bypass that converts HTML entities back to live tags.

The Zeinet plugin by Bracketweb is vulnerable to Reflected XSS in versions up to and including 1.0.0 due to improper neutralization of input during web page generation.

The Motors plugin by StylemixThemes is vulnerable to Missing Authorization in versions up to and including 1.4.108, allowing exploitation of incorrectly configured access control security levels.

The Grocery Shopping Store plugin by Omegathemes is vulnerable to Authentication Bypass Using an Alternate Path or Channel in versions up to and including 1.3.3, allowing password recovery exploitation.

Deserialization of Untrusted Data vulnerability in the Balance theme by Axiomthemes allows Object Injection. This issue affects Balance from n/a through 1.12.0.

Deserialization of Untrusted Data vulnerability in the Camelia theme by ThemeREX Group allows Object Injection. This issue affects Camelia from n/a through 1.2.15.

Deserialization of Untrusted Data vulnerability in the Convex theme by ThemeREX Group allows Object Injection. This issue affects Convex from n/a through 1.16.0.