CVE Vulnerability Catalog

In JetBrains YouTrack before 2026.2.19422, iDOR in inbox threads allowed reading other users' notifications.

In JetBrains YouTrack before 2026.2.19422, missing authorisation allowed reloading of translation catalogs.

In JetBrains YouTrack before 2026.2.19422, privilege escalation was possible via user group membership changes.

In JetBrains YouTrack before 2026.2.19422, stored XSS via Mermaid and LaTeX content was possible. The vulnerability allows execution of arbitrary script in the user's browser.

In JetBrains YouTrack before 2026.2.19422, DoS attack was possible via crafted PSD attachments.

In JetBrains YouTrack before 2026.2.19422, iDOR in the issue activities API allowed reading restricted issues.

In JetBrains YouTrack before 2026.2.19422, privilege escalation was possible via user group links. The vulnerability allows a user to gain higher privileges than intended.

In JetBrains YouTrack before 2026.2.19422, HTML injection in VCS command failure notifications was possible.

In JetBrains YouTrack before 2026.2.19422, missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues. The vulnerability enables bypassing access controls.

The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Payments module to be enabled and a form to be configured to accept both PayPal and Stripe as payment gateways.

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer in all versions up to, and including, 1.5.97 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the 'list_readmore_numberofwords' Other Parameters setting to be configured with a positive integer value; the default value of 0 bypasses the decode-and-truncate branch entirely and is not exploitable through this sink.

The Awesome Support – WordPress HelpDesk & Support Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users against other accounts because the AJAX handlers accept an arbitrary gdpr-user ID without verifying it belongs to the requester, and the required wpas-gdpr-nonce is emitted via wp_localize_script to every logged-in user on frontend plugin pages and on /wp-admin/profile.php.

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing an authenticated attacker to log in as any WordPress Administrator by directly supplying an Administrator's user ID to the wpcsa_login endpoint and receiving a full Administrator session cookie without supplying the Administrator's password. This makes it possible for authenticated attackers to perform a direct session takeover, gaining full Administrator-level access to the site.

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives initial storage because WooCommerce's sanitize_text_field() and wc_clean() do not strip entity-encoded strings containing no literal '<' character, allowing unauthenticated guest-checkout orders to plant the malicious content.

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users who can store a payload in user meta fields such as the biography, session_tokens (via a crafted User-Agent at login), or persisted_preferences (via the REST API), which are then promoted to the site-wide redux_demo option when a media URL repair is triggered on the demo panel.

The Ad Inserter plugin for WordPress up to version 2.8.18 is vulnerable to Reflected XSS via the 's' search parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks a crafted link. Exploitation requires an ad block with {title} or {short-title} placeholder enabled on search pages.

The Duplicate Post plugin for WordPress up to version 1.5.6 is vulnerable to Stored XSS via the 'noti_token' parameter. Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access or higher to inject arbitrary scripts that execute when a user accesses an injected page. This requires the site owner to enable User Level Permissions for the Subscriber role.

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to open the stored submission entry in the Forminator Entries view and interact with the planted link, at which point WordPress core's jQuery-based click handler on '.contextual-help-tabs a' evaluates the entity-decoded href as HTML, firing the attacker's payload in the administrator's authenticated wp-admin session.

The Super Forms – Drag & Drop Form Builder plugin for WordPress up to version 6.3.316 is vulnerable to arbitrary file and directory deletion. The vulnerability stems from a missing capability check in the `super_save_form` AJAX handler, allowing Subscriber-level users to create or modify forms and enable the `file_upload_submission_delete` setting, combined with the `submit_form` function passing the attacker-controlled `files[].subdir` value directly to `SUPER_Common::delete_dir()` without sanitization. The `ABSPATH` guard can be trivially bypassed by using a `subdir` value of `wp-config.php`, enabling recursive deletion of files and directories on the server, up to the entire WordPress installation.