CVE Vulnerability Catalog

The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'no_results_message' node_preview Parameter in all versions up to and including 2.11.0.1 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into clicking a link.

The Search Atlas SEO WordPress plugin before version 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers. This allows any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account credentials.

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 6.3.8 via the 'remoteurl' parameter. This allows authenticated attackers with subscriber-level access and above to read the contents of arbitrary files on the server, which can contain sensitive information. An authenticated attacker first poisons the _wpfd_file_metadata['file'] post-meta value via the unprotected file.save handler, after which the streaming endpoint, hooked on init with no authentication requirement, resolves and streams the traversed file path to any caller, including unauthenticated visitors.

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (Custom HTML block inner HTML)' parameter in all versions up to and including 2.4.30 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page. A Contributor-level attacker can insert a crafted .df-element div with data-df-lightbox='thumb' via a Custom HTML block, whose inner HTML is passed as the title argument to parseThumbs() at render time, enabling both innerHTML injection into a span element and attribute breakout via an onerror handler on a constructed img element.

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (class attribute of .dvcss element)' parameter in all versions up to and including 2.4.30 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page. The payload is embedded as a Base64-encoded JSON object in a CSS class name on a Custom HTML block; the frontend parseCSSElements() function decodes it client-side with atob() and JSON.parse() and renders the logo property as raw HTML, meaning no server-side or client-side sanitization intercepts the malicious script before DOM insertion.

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 7.1.15 on Multisite installations. This is due to the `tml_ms_signup_handler()` function's `gimmeanotherblog` branch failing to enforce the network's `active_signup` registration policy, checking only `is_user_logged_in()` while sibling branches such as `validate-blog-signup` apply the full policy gate. This allows authenticated attackers with Subscriber-level access and above to directly POST `stage=gimmeanotherblog` to Theme My Login's signup route, bypassing the configured registration policy entirely — even when it is set to `none` or `user` — which causes `wpmu_create_blog()` to execute with the attacker's user ID, after which WordPress core assigns the Administrator role on the newly created subsite. The privilege gain is scoped to the newly created subsite only; the attacker's account retains Subscriber-level access on the main site and does not obtain Super Admin or network-level capabilities.

The Social Chat – Click To Chat App Button plugin for WordPress up to version 8.6.2 is vulnerable to Stored Cross-Site Scripting via the 'consent_message' JSON attribute in the .qlwapp data-box. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or above to inject arbitrary web scripts that execute when a user accesses the page. The exploit requires no user interaction beyond page load, as setting auto_open and consent_enabled to 'yes' causes the consent box and embedded script to execute immediately.

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress up to version 7.3.3 is vulnerable to Stored Cross-Site Scripting via event attribute values. This is due to insufficient input sanitization when storing attribute values (using only wp_unslash() without sanitization) and lack of output escaping when rendering the '#_ATT{key}' placeholder. Authenticated attackers with Author-level access or above, or unauthenticated attackers when anonymous event submissions are enabled, can inject arbitrary web scripts that execute when any user views the affected event page.

In libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service.

In libxml2 before 2.15.4, an inconsistency in xmlIO between xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, due to a missing integer overflow check before invoking the write callback. This has security implications for many uses of that length value within a callback.

In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart due to length saturation in xmlXPtrEval for xpointer expressions.

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow leading to a heap-based buffer overflow.

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the 'Upload from URL' media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to internal services.

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_tags() only. Because strip_tags() does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such as onmouseover, and execute arbitrary JavaScript in the victim's browser. This issue is reachable without authentication.

YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML or JavaScript to a valid archived revision timestamp, still load that archived revision, and execute arbitrary JavaScript in the victim's browser. The vulnerable form is only rendered when the victim can both read and edit the target page.

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders.

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action (actions/recentchanges.php) accepts a period argument from two disjoint parameter spaces. A whitelist validates only the URL form against ['day','week','month']. The action-argument form takes the else branch with no validation, and the value flows into PageManager::getRecentlyChanged(), where it is interpolated into a WHERE time >= '...' ORDER BY time DESC clause without escaping or parameterization. UNION-based injection succeeds, the leaked rows render into the response page, so any visitor of the trigger page sees the exfiltrated data. The vulnerability provides arbitrary read of the YesWiki database to anyone who can save the trigger page.

PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_file() and param_set_backup_file() functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any PX4 shell to trigger the crash.

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.