CVE Vulnerability Catalog

In bc-csharp before 2.7.0, IesEngine.DecryptBlock shows an observable discrepancy between padding errors and MAC errors. An attacker who captured an IES/ECIES ciphertext can use a padding-oracle attack to recover plaintext.

In bc-csharp before 2.7.0, the DTLS handshake reassembly allocates memory based on the 24-bit length from the fragment header without checking the maximum handshake message size. A remote attacker can send crafted fragments, causing memory exhaustion and denial of service.

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an administrator viewing the log and send their browser to an attacker-controlled page.

In bc-csharp before 2.7.0, in stream mode of IesEngine, the MAC key is derived directly after a keystream that depends only on the static key pair and fixed parameters. An attacker who knows the plaintext of one message can forge shorter messages that are accepted as authentic.

In bc-csharp before 2.7.0, the DSTU 7624 CCM mode implementation (KCcmBlockCipher) processes the G1 block only when associated data is present. An attacker who observes encrypted messages of known or chosen content can forge ciphertexts with valid authentication tags.

In bc-csharp before 2.7.0, the AES-CCM implementation (CcmParameters and CcmBlockCipher) improperly validates the authentication tag length. An attacker can modify CCM-encrypted content without detection by using an AlgorithmIdentifier with a zero-length or out-of-range tag.

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing unauthenticated visitors to bypass the coming-soon page and reach the otherwise hidden site, including hidden published pages, by shaping the request so it is mistaken for a login request.

The BA Book Everything plugin for WordPress is vulnerable to stored XSS via the 'booking_service_qty' parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject scripts that execute when a user accesses an injected page.

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect visitors to an arbitrary external site.

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages, allowing unauthenticated visitors to retrieve the secret key of any active giveaway that has reCAPTCHA configured.

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in versions up to 3.3.34 via the external (Amazon S3) upload flow. The plugin trusts an attacker-supplied file path, allowing arbitrary file read, write, or deletion on the server.

The SiteOrigin Widgets Bundle plugin for WordPress (versions up to and including 1.73.2) is vulnerable to Local File Inclusion via the 'theme' parameter. An authenticated attacker with contributor-level access or higher can include and execute arbitrary .php files on the server, leading to PHP code execution. Exploitation requires sending a malicious widgetData payload with a legacy top-level theme key to the /wp-json/sowb/v1/widgets/previews REST endpoint.

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts plugin for WordPress before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request. This allows unauthenticated attackers to exhaust the site's PHP worker pool and make the entire site unavailable.

The Motors WordPress plugin before version 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions. This allows authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors plugin's paid featured-listing option is enabled, neither of which is a default configuration.

The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned listing-management role to inject arbitrary web scripts that execute when a listing is viewed by any visitor, including an administrator.

The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published.

The Ninja Forms plugin for WordPress (versions up to and including 3.15.4) is vulnerable to Stored Cross-Site Scripting via Paragraph Text (RTE) field submission due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page. This is only exploitable when the targeted Paragraph Text field has the Rich Text Editor (RTE) option enabled.

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access (who do not hold unfiltered_html) to store a payload that executes when the page is rendered.

The Popup Maker WordPress plugin through version 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce. This allows authenticated users with minimal privileges such as Subscribers to overwrite a site-wide option (the linked service account and API configuration) that should only be modifiable by administrators.