CVE Vulnerability Catalog

The Pods WordPress plugin before 3.3.9.1 incorrectly compares a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the default on installations whose first Pods version predates 3.1.

mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root.

The LcpDecodeConfig() function did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit this to crash ppp(8) or potentially execute arbitrary code as root.

The mp_Enddisc() function used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp(8) or potentially execute arbitrary code as root.

The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. The handler checked whether a page size had already been configured without holding the rangelock. Two concurrent callers could both observe an unconfigured object and set conflicting page sizes, leaving the object in an inconsistent state. An unprivileged local user can exploit this race to escalate privileges.

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An unprivileged local user can exploit this race condition to escalate privileges.

The WP Fastest Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. This requires the Polylang or Polylang Pro plugin to be active and the Combine JS option enabled.

The BlogVault Backup & Staging, MalCare WordPress Security, and WP Remote WordPress plugins (all before version 6.65) do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote management service, and generate that secret with a weak pseudo-random number generator, allowing attackers to recover it and gain administrative access to the site.

The Royal Addons for Elementor WordPress plugin before version 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

The Forminator Forms WordPress plugin before version 1.57.1 does not verify that site registration is enabled on the network before creating a site signup. This allows unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it.

The Tutor LMS WordPress plugin before version 4.0.6 does not validate values used to build a database query and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and read question and answer content from courses that are not publicly available. The injected text reaches the query as grammar rather than as data, and on the database engines tested it does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed course content rather than the database at large.

The Booking Package WordPress plugin before version 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price.

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before version 3.7.1 does not include an authorization check on a REST route that returns stored account data. This allows unauthenticated visitors to retrieve the connected service's API secret and account details, which can then be used to disconnect the plugin's integration.

Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service interfaces and software update mechanisms.

The WPCafe WordPress plugin before version 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly available nonce, allowing unauthenticated users to submit reservations with an arbitrary approval status and bypass the administrator moderation workflow.

The Booking for Appointments and Events Calendar WordPress plugin before version 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.

The Booking for Appointments and Events Calendar WordPress plugin before version 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated. This allows any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.

The Royal Addons for Elementor WordPress plugin before version 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy. This allows unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies.

The Royal Addons for Elementor WordPress plugin before version 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID. This allows unauthenticated users to modify that metadata on any post, including private and draft posts.

The Eventin WordPress plugin before version 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces. This allows unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of password-protected ones.