CVE Vulnerability Catalog

Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register versions up to 7.8.1.

Unauthenticated Broken Authentication in SupportCandy versions up to 3.5.1.

SQL Injection vulnerability in License Manager for WooCommerce versions up to 3.0.18. An attacker can inject malicious SQL code through the customer field.

Unauthenticated Cross Site Scripting (XSS) vulnerability in WP Multilang versions up to 2.4.31. An attacker can inject a malicious script that executes in the victim's browser.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Autopay versions up to 5.0.0. An attacker can inject a malicious script that executes in the victim's browser.

The WPDM – Premium Packages plugin (W3 Eden) is vulnerable to DOM-Based Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects WPDM – Premium Packages from n/a through 7.0.5.

Unauthenticated Arbitrary File Download vulnerability in Extra Product Options & Add-Ons for WooCommerce versions before 7.6. An attacker can download arbitrary files from the server.

In n8n, an open source workflow automation platform, prior to versions 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node after restart and executes arbitrary code on the server.

In Hoppscotch, an open source API development ecosystem, prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read private request history, session data, request contents, authorization headers, environment values, and settings and to modify or delete the victim's private history entries.

A Cross-site Scripting (DOM-Based XSS) vulnerability in the WordPress plugin EasyTest – Simplify A/B Testing stems from improper input neutralization during web page generation. Affects versions up to and including 1.0.1.

In the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes, a user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-admin privileges on the managed cluster, leading to arbitrary code execution and privilege escalation.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Templately versions up to 3.7.1. An attacker can inject a malicious script that executes in the victim's browser.

The Slider by 10Web plugin (versions up to 1.2.63) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick a logged-in user into performing unwanted actions within the application, such as changing slider settings.

Unauthenticated XSS vulnerability in Fluent Forms Pro Add On Pack versions prior to 6.2.12. An attacker can inject malicious scripts that execute in the victim's browser.

Unauthenticated XSS vulnerability in Kirki versions up to 6.2.3. An attacker can inject malicious scripts that execute in the victim's browser.

Unauthenticated SQL Injection vulnerability in Depicter Slider versions up to 4.8.0. An attacker can inject malicious SQL queries into the database.

The Ultimate Dashboard Pro plugin for WordPress (versions up to 3.11.2) contains a DOM-Based XSS (Cross-site Scripting) vulnerability. This means that an attacker can inject a malicious script into the page, which will execute in the user's browser, potentially leading to data theft or session hijacking.

PHP Object Injection vulnerability in OptionTree versions up to 2.7.3, requiring editor privileges. An attacker can inject serialized PHP objects, potentially leading to arbitrary code execution.

Denial of service vulnerability in Expat through 2.8.3. The storeAtts() function in xmlparse.c has quadratic complexity, causing excessive CPU consumption when processing an XML document with many attributes with non-normalized values.

Use-after-free vulnerability in Valkey prior to versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1. The RESTORE command accepts a malformed RDB stream that assigns one NACK to multiple consumers, potentially allowing remote code execution.