CVE Vulnerability Catalog

Unauthenticated CSRF vulnerability in Activity Log versions up to 2.13.1. The vulnerability allows an attacker to perform unauthorized operations on behalf of an administrator.

Unauthenticated XSS vulnerability in Estatik versions up to 4.3.4. An attacker can inject a malicious script that executes in the victim's browser.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore WooCommerce Product Attachment woo-product-attachment allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Attachment: from n/a through 2.3.4.

Unauthenticated PHP object injection in Ninja Forms - Layout & Styles versions up to 3.0.31. An attacker can inject malicious PHP objects, potentially leading to remote code execution.

Unauthenticated XSS vulnerability in TrustedSite versions up to 1.2.5. An attacker can inject a malicious script that executes in the victim's browser.

Unauthenticated XSS vulnerability in Interactive Geo Maps versions up to 1.6.30. An attacker can inject a malicious script that executes in the victim's browser.

Incorrect privilege assignment vulnerability in LiquidThemes Booking Hub allows privilege escalation. This issue affects versions from n/a through 1.3.1.

Unauthenticated XSS vulnerability in MP3 Audio Player for Music, Radio & Podcast by Sonaar versions up to 5.13.1. An attacker can inject a malicious script that executes in the victim's browser.

Unauthenticated XSS vulnerability in Upsell Order Bump Offer for WooCommerce versions up to 3.1.5. An attacker can inject a malicious script that executes in the victim's browser.

The WP User Frontend plugin in versions up to 4.3.10 contains a PHP Object Injection vulnerability exploitable by subscribers. An attacker with subscriber role can exploit this to perform unauthorized operations.

In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper in the connectivity service injects header values into a JSON template without proper escaping, allowing JSON structure break-out and injection of additional fields. An attacker controlling a header (e.g., MQTT 5 user property, AMQP 1.0 application property, or Kafka record header) can inject an inline _policy object, overriding the administrator-configured policyId.

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to, and uploads into, potentially resulting in remote code execution.

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories.

The Broken Link Checker plugin for WordPress up to version 2.4.13 is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to perform the plugin's standard dismiss-and-recheck workflow on a link submitted by the attacker via the WordPress comment author URL field, after which the attacker's HTTP server issues a redirect to a URL containing an HTML/JavaScript payload that is stored verbatim in the link log.

Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability.

The Marcus Login With Ajax plugin up to version 4.5.1 contains a Reflected Cross-Site Scripting vulnerability due to improper neutralization of input during web page generation.

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts.

The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators.

The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent decoding step, leading to Stored XSS which will execute in the context of a logged in administrator.

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete. This allows unauthenticated visitors to register an account with elevated capabilities and then escalate it to administrator.