CVE Vulnerability Catalog

The Ninja Forms plugin for WordPress (versions up to and including 3.15.4) is vulnerable to Stored Cross-Site Scripting via Paragraph Text (RTE) field submission due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page. This is only exploitable when the targeted Paragraph Text field has the Rich Text Editor (RTE) option enabled.

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access (who do not hold unfiltered_html) to store a payload that executes when the page is rendered.

The Popup Maker WordPress plugin through version 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce. This allows authenticated users with minimal privileges such as Subscribers to overwrite a site-wide option (the linked service account and API configuration) that should only be modifiable by administrators.

The Avada theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to and including 7.16.1 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into clicking a link.

The Paytm Payment Gateway WordPress plugin before version 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation. This allows unauthenticated attackers to change the status of arbitrary orders, including marking unpaid orders as paid and reducing stock.

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to and including 3.1.15.1 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses an injected page. Exploitation requires an administrator to have enabled Autoptimize's 'Lazy-load images?' option, the w3-total-cache/w3-total-cache.php file to be present on disk with the plugin disabled, a class named Minify_HTML to be loaded into scope by another plugin, and the malicious comment to be approved by a moderator before the payload renders.

The Super Forms – Drag & Drop Form Builder plugin for WordPress (versions up to and including 6.3.316) is vulnerable to Privilege Escalation. The Register & Login add-on's before_email_success_msg() function in the register_login_action='update' flow trusts an attacker-supplied user_id value and passes it to wp_update_user() without any ownership or capability check. An authenticated attacker with Subscriber-level access can create a malicious form and submit it with an administrator's user_id and a new password/email, resulting in account takeover.

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The optional 'file_upload_auth' setting defaults to empty, meaning no authentication is required in the default configuration.

The Tabs Responsive WordPress plugin through version 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page.

The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.3.0. The process_paypal_callback function accepts a base64-encoded paypal_param GET parameter with no IPN validation, no cryptographic signature check, no ownership verification, and no nonce, allowing login as any existing user, including administrators.

The CTX Feed Pro plugin for WordPress up to version 7.6.12 is vulnerable to code injection due to insufficient input validation on the 'Feed Config' field, which is passed directly to the eval() function. This allows authenticated attackers with Administrator-level access and above to execute arbitrary PHP code on the server.

The Visitors Traffic Real Time Statistics Pro plugin for WordPress up to version 11.22 is vulnerable to unauthenticated stored Cross-Site Scripting via the page_title parameter of the ahcpro_track_visitor AJAX action. The action is accessible to logged-out users and stores the value without sanitization, which is later rendered in the admin dashboard without escaping, allowing arbitrary JavaScript execution.

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to and including 2.3.0. The revert_switch handler trusts the attacker-controlled original_user_id cookie as the privileged identity, and the nonce and capability check is performed on that cookie instead of the actual requester.

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. The manipulation of the Title argument in the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity results in SQL injection. The attack can be launched remotely, and the exploit is now public.

A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. The function fetch_url in mcp_server_fetch/server.py is affected by manipulation of the url/path argument, leading to server-side request forgery. The attack can be initiated remotely, and the exploit has been publicly disclosed. A fix is awaiting acceptance.

Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications.

Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path could cause clients to accept an unauthorized member into the end-to-end encrypted media session.

A security flaw has been discovered in calcom cal.diy up to 6.2.0. It affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Manipulation results in missing authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used. The pull request to fix this issue awaits acceptance.

A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown function of the file admin_reservefilter.php. Manipulation of the argument filter leads to SQL injection. The attack can be launched remotely. The exploit is publicly available and might be used.

A vulnerability was determined in itsourcecode Pet Shop Management System 1.0. The affected element is an unknown function of the file admin_reject_completed.php. Manipulation of the argument ID causes SQL injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.