CVE Vulnerability Catalog

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the "Lazy Load Images" feature with "Process background images" to be enabled, and the malicious comment to be approved by a moderator before execution is triggered.

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is deliverable via unauthenticated comment submission and executes exclusively for non-logged-in visitors; if comment moderation is enabled, an approving moderator must first publish the comment before the script reaches other users.

The RegistrationMagic WordPress plugin before version 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity. This allows unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new account even when user registration is disabled.

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary 'reserve' key/value pairs as order metadata during a public checkout, then invoke the callback with an attacker-chosen 'option' parameter to select and unserialize that metadata without any provider signature, source-address, transaction-identity or ownership check. A POP chain is present in the TCPDF library bundled with the plugin itself, so no additional plugin or theme is required. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, including wp-config.php, which can lead to remote code execution when an attacker re-runs the WordPress installer against a database they control. Successful exploitation is contingent on an admin printing an invoice to trigger file deletion.

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before version 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering. This allows unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets stored in metadata by the plugin.

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Ninja Forms File Uploads add-on to be active, as the attack routes the unwhitelisted child entry through the File Uploads handler to write an attacker-supplied HTML file containing arbitrary JavaScript into any web-server-writable directory, including the site root, where it is served from the site's own origin.

The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives save-time sanitization because wp_kses_post allows the required HTML tags and attributes, and the client-side tooltip script re-parses the browser-decoded aria-label value as innerHTML while only stripping script elements, leaving onerror and other event-handler attributes fully intact and executable.

The QuickCal plugin for WordPress up to version 1.0.20 is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The nonce guarding the unauthenticated booked_add_appt AJAX action is publicly embedded on any page rendering the booking calendar shortcode, making it trivially obtainable.

PCRE2 before 10.48 has an out-of-bounds write vulnerability in pcre2_dfa_match due to reuse of a cached workspace block without a size check during recursive DFA matching. This requires an attacker-controlled regular expression or a recursive pattern with a small heap limit.

The iubenda | All-in-one Compliance plugin for WordPress up to version 3.13.4 is vulnerable to Stored Cross-Site Scripting via Comment Content due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The exploit works by embedding KSES-allowed markup such as abbr title attributes and HTML comments so that the global strtr() substitution mutates an inert tag into an executable element like an img onerror handler.

The iubenda | All-in-one Compliance plugin for WordPress up to version 3.13.4 is vulnerable to Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite, but only when the 'Secondary' parser engine is active (parser_engine=default). Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. This vulnerability does not exist under the default 'new' DOM-based parser engine.

In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.

YesWiki prior to version 4.6.6 contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization.

YesWiki from version 4.2.0 to before 4.6.6 has a SQL injection vulnerability in ApiController::deletePage(), where a page tag retrieved from the database is interpolated into a DELETE query without escaping. A low-privilege authenticated user can create a page with a tag that is a SQL fragment and execute arbitrary SQL in the wiki database.

YesWiki prior to version 4.6.6 has an unauthenticated SQL injection vulnerability in public Bazar entry-listing APIs, in numeric query filters. The filter value is escaped but inserted into SQL without quotes or numeric validation, allowing an attacker to inject boolean expressions and infer database contents.

YesWiki from version 4.6.2 to before 4.6.6 has a vulnerability in the POST /api/forms/{formId}/actor/inbox route, which is publicly exposed. HttpSignatureService::verifySignature() parses the HTTP Signature header and immediately makes a server-side HTTP GET to that URL, before any cryptographic verification. An unauthenticated attacker can make the server issue requests to internal services, including cloud metadata.

YesWiki from version 4.6.2 to before 4.6.6 has a vulnerability in HttpSignatureService::verifySignature(), which checks the result of openssl_verify() with a loose boolean negation. Since PHP treats -1 as truthy, the condition !(-1) is false, causing the error to be skipped and processing to continue even when signature verification failed.

YesWiki prior to version 4.6.6 contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic template feature that can be escalated to Remote Code Execution (RCE). An authenticated administrator can place arbitrary Twig expressions into the Semantic template field, which are executed server-side when public semantic endpoints are requested.

ntop nDPI before version 6.0 has a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger it with crafted network packets containing TLS SNI, HTTP headers, or DNS names, causing heap corruption.