CVE Vulnerability Catalog

Stored XSS vulnerability in Image Photo Gallery Final Tiles Grid plugin up to version 3.6.13. Allows injection of a persistent script that can execute in the user's browser.

The Groundhogg plugin for WordPress (versions up to 4.8.3) contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands.

The PowerPress Podcasting plugin for WordPress (versions up to 11.17.9) contains a Cross-Site Request Forgery (CSRF) vulnerability that may allow unauthorized actions on behalf of a logged-in user.

Stored XSS vulnerability in GiveWP plugin up to version 4.17.0. Allows injection of a persistent script that can execute in the administrator's browser.

Exposure of sensitive system information vulnerability in Memberful - Membership Plugin up to version 1.81.2. Allows retrieval of embedded sensitive data.

Stored XSS vulnerability in B Blocks plugin up to version 2.1.8. Allows injection of a persistent script that can execute in the administrator's browser.

The Name Directory WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.34.2.

The Name Directory WordPress plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 1.34.2.

The Sirv plugin for WordPress (versions up to 8.2.5) contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands.

The PowerPress Podcasting WordPress plugin contains a missing authorization vulnerability that allows retrieving embedded sensitive data. The issue affects versions up to and including 11.17.9.

The WP VR WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 9.1.3.

Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 Search as the ticket's owner.

Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory.

P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P4 Search and the connected P4 Server.

Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 Search service account.

The Taxi Booking Manager for WooCommerce WordPress plugin contains an improper validation of specified quantity in input vulnerability, allowing input data manipulation. The issue affects versions up to and including 2.1.1.

The Video Conferencing with Zoom WordPress plugin contains an insertion of sensitive information into sent data vulnerability, allowing retrieval of embedded sensitive data. The issue affects versions up to and including 4.6.10.

The Premium Addons for Elementor WordPress plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 4.11.109.

The JS Help Desk WordPress plugin contains an authorization bypass through user-controlled key vulnerability, allowing exploiting incorrectly configured access control security levels. The issue affects versions up to and including 4.0.0.

The JS Help Desk plugin (js-support-ticket) up to version 4.0.0 has an authorization bypass vulnerability through a user-controlled key. An attacker can exploit incorrectly configured access control security levels.