CVE Vulnerability Catalog

A vulnerability in curl during upload mishandles HTTP/2 RST_STREAM received from the server, leading to a use-after-free of a struct Curl_easy object.

The LifterLMS plugin for WordPress is vulnerable to Local File Inclusion in versions up to and including 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. The llms_get_template() helper performs extract() on the shortcode attribute array before resolving the template path, allowing attacker-supplied 'template_name' and 'default_path' attributes to overwrite local parameters and control the path passed to a PHP include.

Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Restricted Site Access: from n/a through 7.6.2.

The CP Multi View Event Calendar (cp-multi-view-calendar) plugin for WordPress is vulnerable to SQL Injection due to improper neutralization of special elements used in SQL commands. This issue affects versions from n/a through 1.4.41.

The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (profile.php) + comment (wp-comments-post.php)' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires two coordinated inputs from the same authenticated attacker: an HTML comment payload stored in a comment body (preserved verbatim by WordPress comment kses) and a matching simple_html_dom noise key placed in the attacker's display_name (which survives esc_attr() intact), with substitution occurring after both filters have run during the plugin's default-on output-buffering pass over the full rendered page.

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name + comment' parameter in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the plugin's Output Buffering option is enabled (disabled by default), and requires the attacker to have at least one previously approved comment on the site so that subsequent comments are auto-approved by WordPress core.

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_images (file_info[2] = title)' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name' parameter in all versions up to and including 2.4.3 due to insufficient input sanitization and output escaping. The save-time sanitizer mbw_htmlspecialchars2() is ineffective because the exploit payload relies solely on unquoted HTML attribute syntax using only spaces, alphanumerics, and characters such as =, parentheses, and dots.

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Record of Consent Extension for Complianz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'uid' parameter in all versions up to and including 2.5 due to insufficient input sanitization and output escaping. The enforcing nonce is emitted via wp_localize_script on wp_enqueue_scripts and is therefore readable by any unauthenticated frontend visitor, and no capability or role check gates the write path.

A Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users.

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL, and Criteria is never validated against an allow-list. An authenticated staff user with the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers, api_keys, and sessions.

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The jobid parameter passed to C4::Scheduler::remove_at_job is not validated, and Schedule::At::remove substitutes it into an atrm command string without quoting or escaping, executing it through a single-argument system() call that invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can execute arbitrary OS commands as the Koha application user.

The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 2.4.3 via the '<mode>_type' parameter. This allows unauthenticated attackers to include and execute arbitrary .php files on the server, enabling access control bypass, sensitive data disclosure, or code execution. Exploitation is trivial via an unauthenticated POST to any page rendering a public [mb_board] shortcode, and on standard PHP installations pearcmd.php can be leveraged to write and include an attacker-controlled payload in a single request.

The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 1.17.1 via deserialization of untrusted input. This allows authenticated attackers with administrator-level access and above to inject a PHP Object. No known POP chain is present in the vulnerable software, so impact only occurs if another plugin or theme with a POP chain is installed.

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This allows authenticated attackers with custom-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page.

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0. The `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacks any capability check for role assignment and the `save_custom_fields_to_user_meta()` function uses an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning hard-coded defaults that unconditionally enable meta writing. This allows unauthenticated attackers to create an Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1`; the required nonce is publicly emitted into the `front_end_data` JavaScript object on every front-end page.

The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the 'jkit_post_block' and 'jeg_find_author' AJAX actions in versions up to 3.2.19. Authenticated attackers with Subscriber-level access and above can enumerate all registered users and reconstruct email addresses using substring search as an oracle.

The Appointment Booking Plugin – LatePoint for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 5.7.3 via the 'params[customer][first_name]' parameter. Authenticated attackers with subscriber-level access and above can extract privileged booking data including admin_notes, agent contact details, transaction tokens, and payment request URLs.

The ShopMagic – email automation for WordPress plugin is vulnerable to Local File Inclusion in all versions up to and including 4.9.0 via the 'billing_address.first_name' parameter. This allows unauthenticated attackers to include and execute arbitrary .php files on the server, enabling access control bypass, sensitive data disclosure, or code execution. Exploitation requires a published recipe processing the {{ customer.first_name }} placeholder — the built-in "New Order email with social media profile links" recipe satisfies this by default, making the default configuration exploitable with no account, cookie, or nonce.