CVE Vulnerability Catalog

In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted third-party certifications or trust delegations from any component key of the issuing certificate, without requiring the component to have certification authority. An attacker could use a restricted subkey (e.g., signing-only or encryption-only) to issue a valid identity certification or trust delegation, which was then attributed to the primary key.

In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_key. LeafNode.verify() checked a leaf's signature against the signature_key carried in the leaf itself, while the credential's X.509 certificate chain was stored but never parsed or validated, so the end-entity certificate's public key was never required to match signature_key as RFC 9420 sec. 5.3 requires. An attacker could present another party's certificate as its credential while signing the leaf, and the enclosing KeyPackage, with an unrelated key, and be accepted under that other party's identity through KeyPackage.verify() and the Group leaf-validation path.

In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV released the caller's key, IV and additional authenticated data arrays with JNI's ReleaseByteArrayElements in mode 0, which commits the native copy back into the Java array. When an application passed the same Java array as both input and destination (e.g., encrypting in place over KeyParameter.getKey()), the later mode-0 release wrote the unchanged key bytes over the ciphertext, exposing the raw AES key. The fix releases read-only input arrays with JNI_ABORT, preventing the copy-back.

In Bouncy Castle for Java before 1.86, the HQC implementation leaked secret-derived data through two side channels: GF(2^8) arithmetic used lookup tables indexed by field elements, and the fixed-weight support sampler stopped scanning on collision and stored positions at a secret index. An attacker observing cache behavior or decapsulation timing can recover information about the HQC private key.

The Twenty20 Image Before-After plugin for WordPress in all versions up to and including 2.0.5 is vulnerable to Stored Cross-Site Scripting via the 'offset' shortcode attribute due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages.

The Beaver Builder Page Builder plugin for WordPress up to version 2.11.0.5 is vulnerable to arbitrary shortcode execution. This is due to insufficient validation before running do_shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires a page with the Sidebar module containing a widget that displays attacker-controlled text, such as the Recent Comments widget with approved comments.

In Linux Mint Xreader up to 4.6.5, the function setup_document_content_list/g_strdup_printf in backend/epub/epub-document.c (EPUB File Handler) is vulnerable to path traversal. The attack can be performed remotely and the exploit has been publicly disclosed. Upgrading to version 4.6.6 fixes the issue.

The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation is possible via guest checkout because the malicious payload is embedded in a multipart Content-Disposition field name starting with 'wpcpo-'.

The Burst Statistics plugin for WordPress in all versions up to and including 3.7.1 is vulnerable to Improper Authentication leading to Account Persistence. The maybe_load_shared_dashboard() handler issues a genuine WordPress session cookie for the burst_statistics_viewer account to any visitor with a valid share token, and the plugin does not restrict the core password update endpoint or filter the edit_user capability, allowing an unauthenticated attacker to set an attacker-chosen password and permanently take over that account.

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping and lack of preparation on the SQL query. This allows unauthenticated attackers to append additional SQL queries to existing ones, potentially extracting sensitive information from the database. This is a second-order SQL injection: an attacker submits a crafted referrer URL to the wmcTrack endpoint, which persists the raw value, and the injection triggers when an administrator views the Traffic Sources dashboard.

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 due to improper verification of user permissions. This allows authenticated attackers with contributor-level access and above to permanently delete any reusable social message (nc_reusable_social post), including those authored by administrators or other privileged users.

The WPFront Notification Bar plugin for WordPress in versions up to and including 3.5.1 is vulnerable to Reflected Cross-Site Scripting. The debug-log output path (write_debug_logs) reflects the raw value of $_SERVER['REQUEST_URI'] through vprintf() directly inside a <script> block emitted on wp_footer, without any sanitization or escaping.

The Mail logging – WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. Successful exploitation requires a separately installed plugin, such as Contact Form 7, that passes unauthenticated user-controlled input into mail fields whose content PHPMailer includes in its failure error message.

The Photo Gallery by 10Web plugin for WordPress in versions up to and including 1.8.46 is vulnerable to Reflected Cross-Site Scripting via the 'thumb_url' parameter due to insufficient input sanitization and output escaping. The editimage_bwg AJAX action performs a capability check but no nonce verification, so the payload can be delivered via a crafted GET request without a CSRF token.

The VikAppointments Services Booking Calendar plugin for WordPress up to version 1.2.21 is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function. This allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution (e.g., by deleting wp-config.php). Exploitation requires at least one File-type custom field published on the confirmation page.

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This allows authenticated attackers with contributor-level access and above to include and execute arbitrary .php files on the server, enabling execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution if .php files can be uploaded and included.

The Smart Manager plugin for WordPress is vulnerable to generic SQL injection via the 'access_privileges' parameter in versions up to and including 8.97.0. Authenticated attackers with subscriber-level access and above can append SQL queries to existing queries to extract sensitive information from the database. Exploitation is only possible when an administrator has saved a role-based deny-list configuration that does not block the internal 'access-privilege' module.

The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress in versions up to and including 3.5.3 is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes due to insufficient input sanitization and output escaping.

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress in versions up to and including 3.0.19 is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. An unauthenticated attacker can read, create, update, clone, and delete email notification flows, including overwriting default reservation confirmation, cancellation, and admin alert emails with attacker-controlled content.

The WPC Estimated Delivery Date for WooCommerce plugin for WordPress in versions up to and including 4.0.1 is vulnerable to Reflected Cross-Site Scripting via the 'rule_data' parameter due to insufficient input sanitization and output escaping.