CVE Vulnerability Catalog

The Cost Calculator Builder plugin up to version 4.0.17 contains a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data.

A SQL injection vulnerability was found in Discuz! X5.0 (versions 20260801, 20260820, 20260910) in the modmedalsubmit function in mod.php. Manipulation of the argument delete results in SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability has been found in Weaviate Verba up to 2.1.3 in the get_environment function of goldenverba/components/util.py, part of the generate_stream Endpoint component. The manipulation leads to information disclosure. The attack can be performed remotely and the exploit has been publicly disclosed.

The WP Statistics plugin up to version 14.16.14 contains a reflected XSS vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows in the StaticFileRouter::route function of lib/src/StaticFileRouter.cc, part of the Static File Router component. The manipulation leads to path traversal. The attack can be performed remotely and the exploit has been publicly disclosed.

A security flaw has been discovered in topoteretes cognee up to 1.5.4 in the get_user_id_by_email function of cognee/modules/users/authentication/get_api_auth_backend.py, part of the JWT Signing Key Handler component. Manipulation of the FASTAPI_USERS_JWT_SECRET argument results in hard-coded credentials. The attack can be launched remotely.

A vulnerability was found in Laradock up to 20.4 in an unknown function of workspace/Dockerfile, part of the Build Process component. The manipulation results in download of code without integrity check. The attack can be launched remotely but is highly complex and difficult to exploit. The exploit has been made public.

The Unlimited Elements For Elementor plugin up to version 2.0.20 contains a blind SQL injection vulnerability. An attacker can exploit this flaw to manipulate database queries without knowing the database structure.

The Gutenberg Blocks by Kadence Blocks plugin up to version 3.7.11.1 contains a stored XSS vulnerability. An attacker can save a malicious script that executes on every page visit.

The Unlimited Elements For Elementor plugin up to version 2.0.20 contains a reflected XSS vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

The TranslatePress plugin up to version 3.3.6 contains a stored XSS vulnerability. An attacker can save a malicious script that executes on every page visit.

The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations. The rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private files directly.

The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, disabling WordPress core's REST nonce protection for every route. This allows an attacker to perform a cross-site request forgery attack that creates a new administrator account using a logged-in administrator's session.

The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values. This allows authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end. This allows users granted access to the announcement management page (Contributor and above) to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the announcement.

A code injection vulnerability was found in InternLM MindSearch 0.1.0 in the ExecutionAction.run function in mindsearch/agent/graph.py. The attack can be launched remotely, and exploit details have been publicly disclosed.

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page. This allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout. This allows unauthenticated attackers to modify the shipping information stored on arbitrary orders.