CVE Vulnerability Catalog

The Better Post & Filter Widgets for Elementor plugin through version 1.9.1 contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation.

The Contact Form by Supsystic plugin through version 1.10.7 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The Media Library Assistant plugin through version 3.42 contains an insertion of sensitive information into sent data vulnerability that allows retrieval of embedded sensitive data.

The JetSmartFilters plugin by Crocoblock contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 3.8.6.1.

The JetElements For Elementor plugin by Crocoblock contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 2.9.2.5.

The Media Library Assistant WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability. The issue affects versions up to and including 3.42.

The Royal Elementor Addons WordPress plugin contains an authorization bypass through a user-controlled key vulnerability. The issue affects versions up to and including 1.7.1069.

The Royal Elementor Addons WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 1.7.1069.

IsMyGym by Zuinq Studio contains a Reflected Cross-Site Scripting (XSS) vulnerability in the reservation endpoint, where the 'ret' parameter is reflected in the HTTP response without proper sanitization. Successful exploitation could allow an attacker to inject arbitrary JavaScript executed in the victim's browser context.

In PGYER codefever up to 0c35e60f006f9d558cc33a159baf110659351990, the _detail function in application/controllers/doc.php (URI Sanitizer component) allows path traversal via manipulation of the uri_string argument. The attack can be carried out remotely and the exploit has been publicly disclosed. The patch identifier is e4433eee96883a222403854e8ac38b3146774a07.

In rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d, the verifyiprange function in lib/Flux/PaymentNotifyRequest.php (PayPal IPN Handler component) allows an origin validation error via manipulation of the X-Real-IP argument. The attack can be carried out remotely and the exploit is publicly available. The vendor was contacted but did not respond.

The WP Discussion Board WordPress plugin contains a missing authorization vulnerability allowing exploitation of incorrectly configured access control levels. The issue affects versions up to and including 2.6.0.

The Better Post & Filter Widgets for Elementor plugin (up to version 1.9.1) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthenticated users to perform actions they should not have access to.

The Booking and Rental Manager plugin (up to version 2.8.2) contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This may enable unauthenticated users to access restricted functionality.

The Image Gallery block plugin (up to version 2.4.1) has a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This allows an attacker to store malicious script that executes in a user's browser.

The Gutenberg Blocks by Kadence Blocks plugin (up to version 3.8.0.1) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. An attacker can store malicious script that executes in a user's browser.

The Ad Inserter plugin (up to version 2.8.18) has a Reflected XSS vulnerability due to improper neutralization of input during web page generation. This allows an attacker to reflect malicious script in the server response, which executes in the victim's browser.

The Royal Elementor Addons plugin (up to version 1.7.1069) contains a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. An attacker can exploit client-side DOM manipulation to execute malicious script.

In BRAIN2 versions up to and including 3.09, under specific installation conditions, the password of a Windows service account may be written in cleartext to a setup log file. The issue occurs when Microsoft SQL Server access is configured using Integrated Security and the Windows account for the BRAIN2 MainService is specified during the installation wizard. The setup log file is stored in the temporary directory of the installing administrator and is generally accessible only to users with administrative privileges.

The Bopo – WooCommerce Product Bundle Builder plugin (up to version 1.2.3) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This may enable unauthenticated users to access restricted functionality.