CVE Vulnerability Catalog

Improper export of application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete files with Samsung Contacts' privilege.

Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete files with Samsung Contacts' privilege.

The ProSolution WP Client plugin before version 2.0.9 does not sanitize a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check. This allows unauthenticated users to read arbitrary data from the database and to delete the records the plugin stores.

The Contact Form to Any API plugin before version 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.

The CheckView plugin before version 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView-specific string. This makes it possible for unauthenticated attackers to bypass the REST nonce check and perform any REST action available to a logged-in administrator, such as creating a new administrator account, via a crafted link an administrator is tricked into opening.

The Login & Register Forms WordPress plugin before version 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response. This allows unauthenticated users to obtain registered users' email addresses, including administrators'.

The Login & Register Forms WordPress plugin before version 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data. This allows unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.

The Login & Register Forms WordPress plugin before version 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls. This allows unauthenticated attackers to take over the account of any user who recently completed a reset verification, including an administrator.

The BricksForge WordPress plugin before version 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions. This allows unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account. Exploitation requires the site to have a form using the password reset action in update mode; the server-side current-password verification is disabled by default, so the vulnerable state is the default once the action is used.

The File Manager WordPress plugin before version 6.9.1 does not perform any capability check on one of its file manager connector endpoints. This allows any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data.

The File Manager WordPress plugin before version 6.9.1 does not have authorisation checks on one of its REST API routes. This allows unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.

The File Manager WordPress plugin before version 6.9.1 does not properly authorise its file management commands. This allows any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's configuration secrets and to denial of service.

The Salon Booking System WordPress plugin before version 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps. This allows unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.

The Squeeze WordPress plugin before version 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the upload_files capability (Author and above) to write an executable PHP file into the uploads directory and achieve remote code execution.

The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the plugin has not been configured, allowing them to create arbitrary posts and pages and to disclose author account and taxonomy information.

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the browser of any user, including administrators, who loads the checkout page.

The vitepos WordPress plugin before version 3.6.0 and Vitepos WordPress plugin before version 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to reset any user's password, including an administrator's, and take over the account.

The HT Contact Form WordPress plugin before version 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data (name, email, phone, address) stored in form drafts.

The AutoNetTV Relay WordPress plugin before version 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker who triggers the due task can receive the administrator's session cookie and gain administrator access without credentials.

The Eventin WordPress plugin before version 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files.