CVE Vulnerability Catalog

Cross Site Request Forgery (CSRF) vulnerability in PublishPress Series plugin up to version 3.1.3. CSRF attacks can be performed without authentication, allowing forced actions on behalf of a logged-in admin.

Unauthenticated Broken Access Control vulnerability in Booking Calendar plugin up to version 11.7. Unauthenticated users can access booking and management functions that should be restricted.

Broken Access Control vulnerability in Simple Membership plugin up to version 4.8.2, allowing Contributor accounts to access admin functions. This enables privilege escalation.

Insecure Direct Object References (IDOR) vulnerability in Cooked plugin up to version 1.16.0, affecting Contributor accounts. It allows unauthorized access to objects (e.g., posts, recipes), potentially exposing data.

In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which reduces the attack window and significantly increases its complexity.

Unauthenticated Broken Access Control vulnerability in Easy Invoice plugin up to version 2.3.8. Unauthenticated users can access invoice and management functions that should be protected.

Cross Site Scripting (XSS) vulnerability in PublishPress Series plugin up to version 3.1.3, affecting Contributor accounts. It allows injection of malicious JavaScript into publication content, which executes in other users' browsers.

The Unlimited Elements For Elementor plugin in versions up to and including 2.0.19 contains a Server Side Request Forgery (SSRF) vulnerability. A user with Contributor privileges can force the server to make requests to arbitrary resources.

The JetElements For Elementor plugin in versions up to and including 2.9.2.1 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.

The PropertyHive plugin in versions up to and including 2.2.6 contains a Cross Site Scripting (XSS) vulnerability. A user with Contributor privileges can inject malicious script code.

The JetSearch plugin in versions up to and including 3.6.3 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.

The JetBlocks For Elementor plugin in versions up to and including 1.5.2 contains a Cross Site Scripting (XSS) vulnerability. A user with Contributor privileges can inject malicious script code.

The King Addons for Elementor plugin in versions up to and including 51.1.81 contains an Insecure Direct Object References (IDOR) vulnerability. An unauthenticated attacker can access objects they should not have access to.

The Element Pack Elementor Addons plugin in versions up to and including 8.8.3 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.

The JetTabs plugin in versions up to and including 2.3.3.1 contains a Cross Site Scripting (XSS) vulnerability. A user with Contributor privileges can inject malicious script code.

The JetBlog plugin in versions up to and including 2.4.10 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.

In the MISP sachertortephp library, the Xml::build() static method contains a logic error in the condition controlling network-based XML fetching. Due to operator precedence, the HTTPS branch is executed even when the readFile option is set to false, allowing an attacker to force outbound HTTPS requests to arbitrary URLs (SSRF).

admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort.

admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor never re-validates the user's locked status and session expiry resets on each request.

A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocation by ID without evaluating the caller's view_job_invocations permission filter against the record. An authenticated user whose job invocation visibility is restricted by a permission filter can enumerate job invocation IDs and read the live output, rendered script, and input values for other users' job invocations within their own organizations.