CVE Vulnerability Catalog

Subscriber sensitive data exposure vulnerability in SureFeedback Client Site versions up to 1.2.12. A user with subscriber role can access data they should not have permission to.

Unauthenticated XSS vulnerability in WP w3all phpBB versions up to 3.0.6. An attacker can inject malicious script that executes in the victim's browser.

Unauthenticated XSS vulnerability in CozyStay versions up to 1.10.0. An attacker can inject malicious script that executes in the victim's browser.

Subscriber SQL Injection vulnerability in Like Button Rating versions up to 2.6.61. A user with subscriber role can inject malicious SQL queries.

Unauthenticated XSS vulnerability in Music Player for WooCommerce versions up to 1.8.9. An attacker can inject malicious script that executes in the victim's browser.

Unauthenticated XSS vulnerability in CP Media Player versions up to 1.3.0. An attacker can inject malicious script that executes in the victim's browser.

Editor PHP Object Injection vulnerability in Fluent Boards Pro versions up to 2.0.11. A user with editor role can inject malicious PHP objects, potentially leading to remote code execution.

Editor Privilege Escalation vulnerability in FluentCRM Pro versions up to 3.1.12. A user with editor role can escalate their privileges to administrator level.

Unauthenticated XSS vulnerability in Realtyna Organic IDX plugin versions up to 5.4.1. An attacker can inject malicious script that executes in the victim's browser.

The Booking and Rental Manager plugin for WordPress versions up to 2.7.5 contains a PHP Object Injection vulnerability exploitable by users with the Contributor role.

Apache APISIX versions 2.11.0 through 3.17.0 are vulnerable to LDAP Injection. A caller with valid credentials for one LDAP entry can authenticate as a different consumer, bypassing the plugin's configured scope.

Apache APISIX version 3.17.0 is vulnerable to inefficient algorithmic complexity in graphql-limit-count routes. A single small request can pin a gateway worker at 100% CPU for an extended period.

Apache APISIX versions 2.12.0 through 3.17.0 are vulnerable to HTTP Request/Response Smuggling. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes.

The ACPT (Pro) - Custom Post Types Plugin for WordPress versions up to 2.0.63 contains a SQL Injection vulnerability exploitable by users with the Subscriber role.

The Kadence Shop Kit plugin for WordPress versions up to 3.0.6 contains a SQL Injection vulnerability exploitable by users with the Subscriber role.

The Mobile App for WooCommerce plugin for WordPress versions up to 0.4.62 contains an unauthenticated Broken Access Control vulnerability.

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin.

The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO offer feature is enabled.

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code execution.

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it. Users with a role as low as subscriber can read arbitrary files on the server, including its configuration file and authentication secrets.