CVE Vulnerability Catalog

The Remove NoFollow Commenter URL plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0. Missing nonce validation in the gmz_comment_settings_save function allows unauthenticated attackers to modify the plugin's comment-display setting.

The Google Plus One Bottom plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 0.0.2. Missing nonce validation in the googlePlusOneAdmin function allows unauthenticated attackers to modify plugin settings, including the plusone-lang, plusone-callback, and plusone-url options.

The Laiser Tag plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.2.5. Missing nonce validation in the addOptionsPageFields function allows unauthenticated attackers to update plugin settings, including the API key, tag blacklist, relevance threshold, batch size, and tagging toggles.

The Tectite Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.3. Missing nonce validation in the admin_init function allows unauthenticated attackers to modify plugin settings, including the tectite_forms_button option.

The JTL-Connector for WooCommerce plugin up to version 2.4.1 has an authorization vulnerability. Missing capability checks and nonce verification in several admin actions allow authenticated attackers with Subscriber-level access or higher to modify plugin settings, download a ZIP archive of developer log files, and delete those files.

The DeMomentSomTres Shortcodes plugin for WordPress up to version 1.1.1 is vulnerable to Stored XSS via the 'width' and 'align' attributes in the 'callout' shortcode. Attackers with contributor-level access can inject arbitrary scripts that execute when a page is visited.

The Remove meta boxes per user role plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.01. Missing nonce validation on the 'remove-meta-boxes-per-user-role' page allows unauthenticated attackers to modify or reset the plugin's per-role meta box visibility settings.

The ZeM STL plugin for WordPress up to version 1.0 has a Stored XSS vulnerability via the [zemstl] shortcode. The 'url', 'color', and 'bgcolor' attributes are not properly sanitized, allowing authenticated users (Contributor+) to inject scripts.

The Easy Cart plugin for WordPress up to version 1.8 has a Stored XSS vulnerability via the 'add_to_cart' shortcode. The sanitize_text_field() function does not escape double quotes in attributes, allowing authenticated users (Contributor+) to inject scripts.

The BirdSeed plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 2.2.0. Missing nonce validation in the birdseed_plugin_settings_page() function allows unauthenticated attackers to change the plugin's BirdSeed token setting by saving it to the database via update_option().

The Word Replacer plugin for WordPress is vulnerable to stored XSS via the 'replacement' parameter. All versions up to 0.4 are affected, requiring administrator access.

The hiWeb Migration Simple plugin for WordPress up to version 2.0.0.1 is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'new_domain' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts that execute when an administrator clicks a link.

The FPW Category Thumbnails plugin for WordPress up to version 1.9.5 is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'fpw_fs_get_file' AJAX action. This is due to insufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level access and above can inject arbitrary web scripts that execute when an administrator accesses the plugin's settings page.

The rognone plugin for WordPress up to version 0.6.2 is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'a' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts that execute when a user clicks a link.

The rognone plugin for WordPress up to version 0.6.2 is vulnerable to Reflected Cross-Site Scripting via the 'mode' parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a victim clicks a link.

The WP Nano AD plugin for WordPress up to version 1.31 is vulnerable to Stored Cross-Site Scripting via the 'blogrole_link' parameter. Insufficient input sanitization and output escaping allow authenticated attackers with administrator-level access to inject scripts that execute on every page visit. This affects only multi-site installations and installations where unfiltered_html is disabled.

MLflow 3.9.0 with basic-auth enabled fails to enforce authorization for Gateway API endpoints: ListGatewaySecretInfos, ListGatewayEndpoints, and ListGatewayModelDefinitions. Any authenticated user, regardless of permissions, can enumerate all gateway secrets, endpoint configurations, and model definitions.

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. The Import function in internal/http/tts_config.go of the TTS Configuration Endpoint component leads to server-side request forgery. The exploit has been disclosed publicly.

A Server-Side Request Forgery (SSRF) vulnerability was found in DedeCMS 5.7.88 in the file /plus/download.php?open=1. The base64_decode function manipulates the Link argument, allowing a remote attacker to send requests from the server to internal resources. The exploit is publicly available.

A buffer overflow vulnerability in the UPnP DeletePortMapping() command in Zyxel VMG4005-B50B firmware versions through 5.13(ABRL.5.4)C0 could allow an adjacent attacker to trigger a temporary denial-of-service (DoS) condition affecting the UPnP function of the affected device.