CVE Vulnerability Catalog

Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (KCcmBlockCipher) AEAD modes in Bouncy Castle for .NET (bc-csharp) before 2.7.0 allows a remote attacker to obtain decryptions of chosen ciphertexts via forged messages sent to an application that lets the output buffer of a failed decryption be observed (e.g., through buffer reuse or logging), because decryption writes recovered plaintext into the caller-supplied output buffer before checking the authentication tag and leaves it there on failure.

Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) in Bouncy Castle for .NET (bc-csharp) before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service via crafted ASN.1 encoding of deeply nested constructed elements (e.g., SEQUENCE inside SEQUENCE), because each nesting level is parsed by a further recursive call with no depth bound. About 2,000 levels (8 KB DER) are enough to exhaust a 1.5 MB thread stack and raise a StackOverflowException, which .NET cannot catch and which terminates the whole process.

The Relevanssi Premium plugin for WordPress in versions up to and including 2.31.4 is vulnerable to stored cross-site scripting (XSS) via the '_rt' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. This requires the click-tracking and logging feature to be enabled, and exploitation is trivial because a valid '_rt_nonce' is publicly emitted on every search-results page.

The CMB2 plugin for WordPress in versions up to and including 2.13.1 is vulnerable to stored cross-site scripting (XSS) via the '<textarea_code field id>' parameter (e.g., kl_code, kl_post_code) due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. The front-end save path requires only a CMB2 box nonce, which is emitted to all visitors including unauthenticated guests via a simple GET request, making the attack trivially reachable without credentials on sites exposing a public CMB2 form writing a textarea_code field.

The Otter Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.2.6 via the 'otter_form_widget_filter' parameter. This allows authenticated attackers with subscriber-level access and above to extract the email addresses of the five most recent form submitters, their submission dates, and the site's total form submission count.

The Download Monitor plugin for WordPress is vulnerable to stored XSS via postMessage to the admin editor. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject scripts that execute when a user accesses an injected page.

The Kubio AI Page Builder plugin for WordPress is vulnerable to stored XSS via the 'comment' parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject scripts that execute when a user accesses an injected page.

The MStore API WordPress plugin before 4.22.1 does not restrict which order fields a customer may update. Any authenticated user with a self-registerable account can change the status of their own unpaid order to a paid or fulfilled state and receive goods without paying.

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it. This allows users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site; from version 2.0.18 onward the issue requires a Contributor role or above.

The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it as the cart-item price and store-credit coupon value. This allows unauthenticated users to submit an arbitrary or negative amount, bypassing configured denominations and manipulating the order total to obtain products without paying.

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field. An unauthenticated attacker can set an arbitrary lower price for a purchase.

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API. This allows unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide.

The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user. This allows users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as zero-argument PHP callables on public page loads, leading to sensitive information disclosure and denial of service.

The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.

Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defeating the key authentication MTI/A0 is meant to provide. It also allows a malicious peer to learn the local static private key modulo the small factors of p-1, and to recover it entirely in groups with many such factors.

In bc-csharp before 2.7.0, the CMP/CRMF password-based MAC verifier (PKMacBuilder) does not limit iteration count unless an explicit maximum is provided. A remote attacker can send a CMP message or CRMF request with a very large iteration count, causing CPU exhaustion and denial of service.