CVE Vulnerability Catalog

LearnPress plugin in versions up to and including 4.4.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.

picu plugin in versions up to and including 3.10.1 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker.

GiveWP plugin in versions up to and including 4.17.0 contains a Privilege Escalation vulnerability exploitable by an unauthenticated attacker.

The Motors plugin by StylemixThemes in versions up to and including 1.4.124 contains an Insertion of Sensitive Information Into Sent Data vulnerability that allows retrieval of embedded sensitive data.

picu plugin in versions up to and including 3.10.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.

Charitable plugin in versions up to and including 1.8.12.3 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.

PowerPress Podcasting plugin in versions up to and including 11.17.9 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker.

Groundhogg plugin in versions up to and including 4.8.3 contains a Sensitive Data Exposure vulnerability exploitable by an unauthenticated attacker.

Payflex Payment Gateway plugin in versions up to and including 2.7.1 contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.

WPO365 plugin in versions up to and including 44.1 contains a Broken Access Control vulnerability exploitable by a subscriber-level attacker.

Xserver Migrator plugin in versions up to and including 1.6.6 contains a Sensitive Data Exposure vulnerability exploitable by an unauthenticated attacker.

The Advanced Google reCAPTCHA plugin version 5.40 and earlier contains a vulnerability of unauthenticated broken authentication. This means an attacker can bypass the login process without providing valid credentials.

The vulnerability in the Schmooze app is due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this by decompiling the distributed application package and extracting the embedded credentials and keys.

A vulnerability was found in SourceCodester Simple Student Information System 1.0 in the file searchquery.php. Manipulation leads to SQL injection. The attack can be initiated remotely.

In the OIDC implementation of Keycloak, specifically in the Device Authorization Grant flow, the minimum authentication level required by a client configuration is not checked. This allows an attacker who has stolen a user's password to bypass mandatory multi-factor authentication and gain unauthorized access to the Keycloak Admin REST API.

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where that secret has been left at its default empty value.

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored site data that referenced the old file path.

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being taken.

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order.