CVE Vulnerability Catalog

The Ad Inserter plugin for WordPress up to version 2.8.18 is vulnerable to Reflected XSS via the 's' search parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks a crafted link. Exploitation requires an ad block with {title} or {short-title} placeholder enabled on search pages.

The Duplicate Post plugin for WordPress up to version 1.5.6 is vulnerable to Stored XSS via the 'noti_token' parameter. Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access or higher to inject arbitrary scripts that execute when a user accesses an injected page. This requires the site owner to enable User Level Permissions for the Subscriber role.

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to open the stored submission entry in the Forminator Entries view and interact with the planted link, at which point WordPress core's jQuery-based click handler on '.contextual-help-tabs a' evaluates the entity-decoded href as HTML, firing the attacker's payload in the administrator's authenticated wp-admin session.

The Super Forms – Drag & Drop Form Builder plugin for WordPress up to version 6.3.316 is vulnerable to arbitrary file and directory deletion. The vulnerability stems from a missing capability check in the `super_save_form` AJAX handler, allowing Subscriber-level users to create or modify forms and enable the `file_upload_submission_delete` setting, combined with the `submit_form` function passing the attacker-controlled `files[].subdir` value directly to `SUPER_Common::delete_dir()` without sanitization. The `ABSPATH` guard can be trivially bypassed by using a `subdir` value of `wp-config.php`, enabling recursive deletion of files and directories on the server, up to the entire WordPress installation.

The Autoptimize plugin for WordPress up to version 3.1.15.1 is vulnerable to Stored Cross-Site Scripting via the REQUEST_URI path. The vulnerability is due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires the Critical CSS feature to be active with a valid API key configured.

MISP contains a reflected XSS vulnerability in the analyst data notes panel. The seed path parameter supplied via URL is passed directly into inline JavaScript without sanitization. An attacker can trick an authenticated user into visiting a crafted URL, allowing arbitrary JavaScript execution in the victim's browser. Affects versions prior to the fix (commit 58925dbf0, post v2.5.48).

MISP contains a reflected XSS vulnerability in legacy taxonomy tag confirmation forms (add and disable tag). The forms echoed user-supplied tag names without escaping. An attacker can trick an administrator into visiting a crafted URL with a malicious tag, allowing arbitrary JavaScript execution in the admin's session. Affects versions <2.5.48.

MISP contains an authorization bypass in the event flattening feature. When requesting an event with the flatten option, object-level access control is not re-applied to attributes, allowing unauthorized access. The initial fix introduced an issue with deleted attributes, which was resolved in the final version.

This CVE number has been rejected. Reason for rejection: this is rejected.

MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor. Because the system did not record whether a given TOTP period had already been consumed, the same code remained valid for its entire time window (typically 30 seconds). An attacker who captures a legitimate code during a user's login could replay it to authenticate a second session as that user.

colmux in collectl before version 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it. This allows a local user on a monitored host to inject escape sequences into the terminal of an operator running colmux, via a crafted process name (argv[0]).

The bbp style pack plugin for WordPress up to version 6.4.8 is vulnerable to Stored XSS via 'display_name' and 'bbp_reply_content' parameters. Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access or higher to inject arbitrary scripts that execute when a user accesses an injected page. Successful exploitation requires wrapping the reply in a <pre> block to prevent quote conversion.

The Calculated Fields Form plugin for WordPress up to version 5.5.1.3 is vulnerable to Reflected DOM-Based XSS via the 'x' parameter (attacker-chosen name matching the form's url.<name> predefined value). Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user clicks a crafted link. Exploitation requires a Text Area field with 'url.<name>' Predefined Value and predefinedClick disabled.

The Calculated Fields Form plugin for WordPress up to version 5.5.1.3 is vulnerable to Reflected DOM-Based XSS via the 'x' parameter (any URL parameter consumed by the form's calculated equation). Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user clicks a crafted link. Exploitation requires a public form with a Select2 dropdown populated via a calculated equation using GETURLPARAMETER() and setChoices().

The LearnPress – WordPress LMS Plugin for WordPress up to version 4.4.8 is vulnerable to Insecure Direct Object Reference (IDOR) via the `CourseMaterialTemplate::render_material_items()` callback exposed on the public `lp-ajax-handle` (load_content_via_ajax) endpoint. The endpoint is explicitly listed in the no-nonce allowlist and performs no capability check, and the handler decides authorization against one attacker-supplied identifier (course_id) while fetching material rows via a second, independently attacker-supplied identifier (item_id) with no check that the lesson belongs to the authorized course. This allows unauthenticated attackers to read and download course-material files (uploaded and external file paths/URLs) belonging to lessons in paid or enrollment-required courses, provided any single course on the site has 'No Required Enroll' enabled and owns at least one material file.

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress up to version 3.0.1 is vulnerable to Reflected XSS via URL. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user accesses an injected page. Exploitation requires the victim to be on a mobile user-agent and click the WeChat share icon, but script execution is automatic once the dialog opens.

Multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, and Apeos C3567 1.1.3, have a path traversal vulnerability in the web management interface. The vulnerability is in the handling of externally supplied parameters. A specially crafted malicious request may trigger unintended processing.

The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the `checkout_form` parameter of the `login_customer_after_checkout` function. This is due to the publicly accessible `wu_ajax_nopriv_wu_validate_form` AJAX handler accepting a freely obtainable checkout nonce, and the `checkout_form=wu-finish-checkout` parameter causing `get_validation_rules()` to discard all validation rules while `finish_checkout_form_fields()` returns an empty step list — forcing `is_last_step()` to return true and routing the request directly into full order processing — after which `maybe_create_customer()` resolves the attacker-supplied `email_address` to an existing WordPress user ID without any authentication or ownership verification, and `login_customer_after_checkout()` calls `wp_set_auth_cookie()` for that user ID via a passwordless code path. This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including a Network Super Admin — simply by knowing their email address. Exploitation requires that the targeted user account has no pre-existing Ultimate Multisite customer record; accounts such as a Network Super Admin on a fresh Multisite install, or any administrator or editor added before Ultimate Multisite was configured, satisfy this condition and are therefore exploitable.

The Ad Inserter plugin for WordPress up to version 2.8.18 is vulnerable to Reflected XSS via the Referer header. Insufficient input sanitization and output escaping on the '{search-query}' dynamic tag allow unauthenticated attackers to execute arbitrary JavaScript in the context of the site for any visitor, including a signed-in administrator. Exploitation requires an ad block with the '{search-query}' tag and automatic insertion enabled.

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress up to version 1.2.3 is vulnerable to privilege escalation. The vulnerability stems from the `wp_update_user_meta` MCP tool in `execute_tool` gating writes solely with `current_user_can('edit_user', $uid)` – which WordPress core's `map_meta_cap` resolves to the `read` primitive when the target user ID matches the caller's own – while enforcing an incomplete meta key blocklist that covers only `user_pass`, `user_activation_key`, and `session_tokens`, leaving the `wp_capabilities` and `wp_user_level` meta keys entirely unprotected. This allows authenticated attackers with Subscriber-level access and above to elevate their privileges to Administrator by issuing a `wp_update_user_meta` call over the MCP JSON-RPC endpoint with `key=wp_capabilities` and an arbitrary role array such as `{'administrator': true}` targeting their own user ID.