CVE Catalog

A stored cross-site scripting vulnerability has been identified in the Online Payments – Get Paid with PayPal, Square & Stripe plugin for WordPress, affecting all versions through 3.20.0. The vulnerability arises from inadequate input sanitization and output escaping of user-supplied attributes in the plugin's shortcodes. This flaw allows authenticated attackers with contributor-level access or higher to inject arbitrary scripts into pages, which are executed when users access the compromised page.

A reflected cross-site scripting vulnerability has been identified in the s2Member WordPress plugin, specifically in versions through 241216. The issue arises from the plugin's use of the add_query_arg function without proper escaping, allowing unauthenticated attackers to inject arbitrary scripts. These scripts could be executed if a user is tricked into clicking a link that contains the injected script.

A vulnerability exists in the Hitachi HVAC Energy Saving Program due to insecure loading of dynamic link libraries. This flaw could enable local attackers to disclose information or execute arbitrary code on affected systems. The vulnerability requires user interaction, such as opening a malicious file.

A vulnerability has been identified in the Hitachi USB-CONVERTERCABLE DRIVER that allows local attackers to potentially execute arbitrary code or disclose information on affected systems. This vulnerability arises from insecure loading of dynamic link libraries (DLLs) and requires user interaction, such as opening a malicious file, to be exploited.

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the MemorialDay plugin for WordPress, affecting all versions through 1.0.4. The issue arises from inadequate nonce validation, allowing unauthenticated attackers to manipulate settings and inject malicious scripts by tricking a site administrator into clicking a link.

An out-of-bounds write vulnerability has been identified in several FUJIFILM multifunction printers, including the DocuPrint CP225w and CP228w models, as well as the CM225fw and CM228fw models, all running specific firmware versions or earlier. This vulnerability arises from inadequate verification of data length, allowing for out-of-bounds writes that can lead to a denial-of-service condition. When an affected printer processes a specially crafted printer job file, it may freeze, requiring a reboot to recover.

A PHP Object Injection vulnerability has been identified in the Affiliate Links: WordPress Plugin for Link Cloaking and Link Management, affecting all versions through 3.0.1. The vulnerability arises from the deserialization of untrusted input during a file export, allowing unauthenticated attackers to inject a PHP object. While the vulnerable plugin itself does not have a known object injection chain, the issue could be exploited if another plugin or theme with a suitable chain is installed, potentially leading to unauthorized file deletion, sensitive data exposure, or arbitrary code execution.

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the SpeedSize Image & Video AI-Optimizer plugin for WordPress, affecting all versions through 1.5.1. The vulnerability arises from inadequate nonce validation in the 'speedsize_clear_css_cache_action' function, allowing unauthenticated attackers to clear the plugin's cache by sending a forged request, provided they can persuade a site administrator to click a link.

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Shopwarden – Automated WooCommerce monitoring & testing plugin for WordPress, affecting all versions through 1.0.11. The vulnerability arises from inadequate nonce validation in the save_setting() function, allowing unauthenticated attackers to update arbitrary options. This could lead to privilege escalation if an attacker tricks a site administrator into clicking a link that triggers the forged request.

A stored cross-site scripting vulnerability has been identified in the Mortgage Calculator / Loan Calculator plugin for WordPress, affecting all versions up to and including 1.5.20. The vulnerability arises from inadequate input sanitization and output escaping of user-supplied attributes in the plugin's 'mlcalc' shortcode. This flaw allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which are executed when users access the affected pages.

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Mortgage Lead Capture System plugin for WordPress, affecting all versions through 8.2.10. The vulnerability arises from inadequate nonce validation on the 'wprequal_reset_defaults' action, allowing unauthenticated attackers to reset the plugin's settings. Exploitation requires tricking a site administrator into clicking a link that initiates the forged request.

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Option Editor plugin for WordPress, specifically in version 1.0. The issue arises from a lack of nonce validation in the plugin_page() function, allowing unauthenticated attackers to manipulate arbitrary options on a WordPress site. Exploitation requires tricking an administrator into clicking a link, which could then be used to, for example, change the default user role for new registrations to administrator, potentially granting admin access to the attacker.

A stored cross-site scripting vulnerability has been identified in the Reaction Buttons plugin for WordPress, affecting all versions through 2.1.6. The issue arises from inadequate input sanitization and output escaping, allowing authenticated attackers with administrator-level permissions to inject arbitrary scripts. These scripts execute when users access the compromised pages. This vulnerability is present only in multi-site installations where unfiltered_html has been disabled.

A vulnerability exists in the Team Builder – Meet the Team plugin for WordPress, in all versions through 1.3. The issue arises from a lack of proper capability checks in the save_team_builder_options() function, allowing authenticated attackers with Subscriber-level access or higher to unauthorizedly modify the plugin's settings.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the WordPress Reset plugin, affecting all versions through 1.6. The issue arises from inadequate nonce validation in the reset_db_page() function, allowing unauthenticated attackers to reset various database tables, including comments, themes, and plugins. This exploitation requires tricking a site administrator into clicking a link that initiates the forged request.

A privilege escalation vulnerability allowing account takeover has been identified in the GetBookingsWP Appointments Booking Calendar Plugin for WordPress, affecting all versions through 1.1.27. The vulnerability arises because the plugin fails to properly verify a user's identity before allowing changes to account details such as email addresses. This flaw enables authenticated attackers with subscriber-level access or higher to alter the email addresses of any user, including administrators. Once the email is changed, the attacker can reset the user's password and gain access to their account.

A vulnerability allowing sensitive information exposure has been identified in the File Uploads Addon for WooCommerce plugin, affecting all WordPress versions through 1.7.1. The issue arises from the 'uploads' directory, where unauthenticated attackers can access sensitive data, including customer-uploaded file attachments, stored insecurely in the /wp-content/uploads directory.

A vulnerability allowing sensitive information exposure has been identified in the 1 Click WordPress Migration Plugin, in all versions through 2.2. The issue resides in the class-ocm-backup.php file, where unauthenticated attackers can extract sensitive data, including usernames and password hashes, during the backup process.

A SQL injection vulnerability has been identified in the Simple Signup Form plugin for WordPress, affecting all versions through 1.6.5. The vulnerability arises from inadequate escaping of user-supplied parameters in the 'id' attribute of the 'ssf' shortcode, coupled with a lack of proper preparation for the existing SQL query. This flaw allows authenticated attackers with Contributor-level access and above to inject additional SQL queries into existing ones, potentially leading to the extraction of sensitive information from the database.

A stored cross-site scripting vulnerability has been identified in the Simplebooklet PDF Viewer and Embedder plugin for WordPress, affecting all versions through 1.1.0. The vulnerability arises from inadequate input sanitization and output escaping of user-supplied attributes in the 'simplebooklet' shortcode. This flaw allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which are executed when users access the affected pages.

A stored cross-site scripting vulnerability has been identified in the Zigaform Price Calculator & Cost Estimation Form Builder Lite plugin for WordPress. This issue affects all versions up to and including 7.4.2. The vulnerability arises from inadequate input sanitization and output escaping of user-supplied attributes in the plugin's 'zgfm_fvar' shortcode. As a result, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which are executed when users access the affected page.

A stored cross-site scripting vulnerability has been identified in the Simple Pricing Tables for WPBakery Page Builder (formerly Visual Composer) plugin for WordPress. This issue affects all versions through 1.0 and arises from inadequate input sanitization and output escaping of user-supplied attributes. As a result, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which will execute when a user views the affected page.

A stored cross-site scripting vulnerability has been identified in the Simple Charts plugin for WordPress, affecting all versions through 1.0. The issue arises from inadequate input sanitization and output escaping of user-supplied attributes in the 'simple_chart' shortcode. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages, which are executed when users access the injected content.

A stored cross-site scripting vulnerability has been identified in the WP-Asambleas plugin for WordPress, affecting all versions through 2.85.0. The issue arises from inadequate input sanitization and output escaping of user-supplied attributes in the 'polls_popup' shortcode. This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary scripts into pages, which are executed when users access the affected page.

A stored cross-site scripting vulnerability has been identified in the WP-BibTeX plugin for WordPress, affecting all versions through 3.0.1. The issue arises from inadequate input sanitization and output escaping of user-supplied attributes in the plugin's 'WpBibTeX' shortcode. This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which are executed when users access the affected pages.

A stored cross-site scripting vulnerability has been identified in the CATS Job Listings plugin for WordPress, affecting all versions through 2.0.9. The issue arises from inadequate input sanitization and output escaping of user-supplied attributes in the plugin's 'catsone' shortcode. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages, which are executed when users access the affected pages.

A stored cross-site scripting vulnerability has been identified in the Gumlet Video plugin for WordPress, affecting all versions through 1.0.3. The issue arises from inadequate input sanitization and output escaping of user-supplied attributes in the plugin's 'gumlet' shortcode. This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which are executed when users access the affected pages.

A stored cross-site scripting vulnerability has been identified in the Zigaform – Form Builder Lite plugin for WordPress, affecting all versions through 7.4.2. The issue arises from inadequate input sanitization and output escaping on user-supplied attributes, particularly within the 'zgfm_rfvar' shortcode. This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which are executed when users access the affected pages.

A stored cross-site scripting vulnerability has been identified in the Simple Map No Api plugin for WordPress, affecting all versions through 1.9. The issue arises from inadequate input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary scripts. These scripts are executed when a user accesses the compromised page.

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the 1 Click WordPress Migration Plugin, specifically in versions through 2.2. The issue arises from inadequate nonce validation in the cancel_actions() function, allowing unauthenticated attackers to cancel active backups by sending a forged request, provided they can persuade a site administrator to click a link.

A full path disclosure vulnerability exists in the WooODT Lite – Delivery & Pickup Date Time Location for WooCommerce plugin for WordPress, affecting all versions through 2.5.1. The vulnerability arises because the 'bycwooodt_get_all_orders.php' file is publicly accessible and can generate error messages visible to users. This exposure allows unauthenticated attackers to retrieve the full path of the web application, potentially aiding in the exploitation of other vulnerabilities. While the disclosed information alone is not harmful, it could be used in conjunction with another vulnerability to compromise an affected website.

A full path disclosure vulnerability has been identified in the BigBuy Dropshipping Connector for WooCommerce plugin, affecting all versions prior to and including 2.0.0. The vulnerability arises because the 'generate-default.php' file in the '/vendor/cocur/slugify/bin/' directory is directly accessible, leading to an error that reveals the full path of the web application. This information could assist in exploiting other vulnerabilities, although on its own, it is not harmful and requires the presence of another vulnerability to cause damage to the website.

A full path disclosure vulnerability has been identified in the Actionwear Products Sync plugin for WordPress, affecting all versions through 2.3.2. The issue arises because the composer-setup.php file is publicly accessible with 'display_errors' enabled. This configuration allows unauthenticated attackers to retrieve the full path of the web application, potentially aiding in the exploitation of other vulnerabilities. While the disclosed information is not harmful on its own, it could be used in conjunction with another vulnerability to compromise an affected website.

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the magayo Lottery Results plugin for WordPress, affecting all versions through 2.0.12. The vulnerability arises from inadequate nonce validation on the 'magayo-lottery-results' page, allowing unauthenticated attackers to manipulate settings and inject malicious scripts. Exploitation requires tricking a site administrator into clicking a link that initiates the forged request.

A stored cross-site scripting vulnerability has been identified in the WP-FormAssembly plugin for WordPress, affecting all versions through 2.0.11. The issue arises from inadequate input sanitization and output escaping of user-supplied attributes in the plugin's 'formassembly' shortcode. This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary scripts into pages, which are executed when users access the affected pages.

A stored cross-site scripting vulnerability has been identified in the Library Bookshelves plugin for WordPress, affecting all versions through 5.10. The issue arises from inadequate input sanitization and output escaping on user-supplied attributes within the 'bookshelf' shortcode. This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which are executed when users access the affected pages.

A stored cross-site scripting vulnerability has been identified in the Open Hours – Easy Opening Hours plugin for WordPress, affecting all versions up to and including 1.0.9. The vulnerability arises from inadequate input sanitization and output escaping of user-supplied attributes in the plugin's 'open-hours-current-status' shortcode. This flaw allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages, which are executed when users access the affected page.

A stored cross-site scripting vulnerability has been identified in the Easy MLS Listings Import plugin for WordPress, affecting all versions through 2.0.1. The issue arises from inadequate input sanitization and output escaping of user-supplied attributes in the 'homeasap-featured-listings' shortcode. This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which are executed when users access the affected pages.

A cache poisoning vulnerability has been identified in the Rapid Cache plugin for WordPress, affecting all versions through 1.2.3. The vulnerability arises because the plugin stores HTTP headers in the cached data, allowing unauthenticated attackers to inject custom, potentially unsanitized HTTP headers. This injection could lead to cross-site scripting (XSS) attacks.

A local privilege escalation vulnerability has been identified in the PAM module pam_cap.so of libcap, affecting all Linux distributions. The issue arises because the module incorrectly parses group names in the /etc/security/capability.conf file. Group names not starting with '@' are misinterpreted as valid group names, potentially allowing unintended users to inherit capabilities and escalate privileges. This vulnerability can be exploited by crafting specific usernames to manipulate the inherited capability set.

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the ProfileGrid – User Profiles, Groups and Communities plugin for WordPress, affecting all versions through 5.9.4.2. The vulnerability arises in the pm_messenger_show_messages function, where insufficient validation on a user-controlled key allows authenticated attackers with Subscriber-level access and above to access and read private conversations of other users.

A limited server-side request forgery (SSRF) vulnerability has been identified in the ProfileGrid – User Profiles, Groups and Communities plugin for WordPress, affecting all versions through 5.9.4.2. The vulnerability arises in the pm_upload_image function, allowing authenticated attackers with Subscriber-level access and above to send web requests to arbitrary locations. This could be exploited to download and view images or to check the existence of non-image files, both on local and remote hosts.

A missing authentication vulnerability has been identified in the LuxCal Web Calendar, specifically in versions prior to 5.3.3M (MySQL) and prior to 5.3.3L (SQLite). The vulnerability resides in the dloader.php script, where authentication is not properly enforced. Exploiting this vulnerability could allow unauthorized access to arbitrary files on the server.

A path traversal vulnerability has been identified in the LuxCal Web Calendar, specifically in versions prior to 5.3.3M (MySQL) and prior to 5.3.3L (SQLite). The vulnerability resides in the dloader.php script, allowing attackers to access arbitrary files on the server.

A SQL injection vulnerability has been identified in the LuxCal Web Calendar, affecting versions prior to 5.3.3M (MySQL) and prior to 5.3.3L (SQLite). The vulnerability resides in retrieve.php, where unsanitized input is directly embedded into SQL statements, allowing attackers to manipulate database queries. Exploitation of this vulnerability could lead to unauthorized deletion, modification, or retrieval of database information.

A SQL injection vulnerability has been identified in the LuxCal Web Calendar versions prior to 5.3.3M (MySQL) and prior to 5.3.3L (SQLite). The vulnerability resides in the pdf.php file, where improper handling of external input allows attackers to manipulate SQL queries. Exploitation of this vulnerability could lead to unauthorized deletion, modification, or retrieval of database information.

An authentication bypass vulnerability has been identified in FileMegane versions above 1.0.0.0 prior to 3.4.0.0. This vulnerability allows for user impersonation, potentially leading to unauthorized access to restricted file contents.

A server-side request forgery (SSRF) vulnerability has been identified in FileMegane versions greater than 3.0.0.0 and prior to 3.4.0.0. This vulnerability allows the execution of arbitrary backend Web API requests, which could potentially lead to rebooting the services.

A command injection vulnerability has been identified in acmailer CGI versions through 4.0.3 and acmailer DB versions through 1.1.5. This vulnerability allows attackers to execute arbitrary operating system commands on the server.

A vulnerability allowing XML External Entity (XXE) attacks has been identified in RSA Authentication Manager versions prior to 8.7 SP2 Patch 1. This issue arises in the license file processor, where an attacker can upload a license file containing an XML external entity. While typical data exfiltration associated with XXE attacks is not possible, the vulnerability allows arbitrary files to be downloaded by the RSA Authentication Manager server, potentially leading to unauthorized access to sensitive information or files.