The FV Flowplayer Video Player WordPress plugin is vulnerable to stored Cross-Site Scripting (XSS) via the 'synopsis' shortcode attribute in all versions up to and including 7.5.54.7212. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the 'Parse Vimeo and YouTube links' option to be enabled and the 'liststyle' attribute set to "season". The vulnerability has a high severity with a CVSS score of 7.2.
The Form Maker by 10Web plugin for WordPress up to version 1.15.48 is vulnerable to a blind SQL Injection via the 'inputs' parameter. This vulnerability allows unauthenticated attackers to append SQL queries due to insufficient input escaping and lack of query preparation. The nonce required to exploit this is publicly accessible on pages rendering the form, making exploitation trivial. The vulnerability can lead to unauthorized extraction of sensitive database information.
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the 'phone' listing field. This vulnerability exists in all versions up to and including 8.10.2.1. Authenticated users with subscriber-level access or higher can inject malicious scripts due to insufficient input sanitization and output escaping. The plugin grants subscriber roles permissions to edit and publish listings without moderation, enabling exploitation. The vulnerability has a CVSS 3.1 score of 6.4, indicating medium severity.
The Contact Form DB for Enfold WordPress plugin versions up to and including 2.0.2 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper input sanitization and output escaping of contact form field values, allowing unauthenticated attackers to inject malicious scripts. These scripts execute when a user views the injected page, affecting the admin interface where the payload is reflected unescaped in HTML attributes and table cells.
The Smart Forms plugin for WordPress, up to and including version 2.6.104, is vulnerable to stored Cross-Site Scripting (XSS) via the 'formString' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access affected pages. The AJAX handler that saves form values lacks nonce verification unless a specific option is enabled, meaning default installations permit unauthenticated submission and storage of malicious payloads.
The JTL-Connector for WooCommerce WordPress plugin is vulnerable to a time-based SQL Injection via the 'product.push' identity endpoint in all versions up to and including 2.4.3. This vulnerability allows unauthenticated attackers to inject additional SQL queries due to insufficient escaping and lack of prepared statements, potentially exposing sensitive database information. Exploitation occurs before the product handling logic, enabling the attack even if downstream processes would normally reject the request.
The Verified Reviews (Avis Vérifiés) WordPress plugin versions up to and including 2.4.6 contain a stored cross-site scripting (XSS) vulnerability via the 'moderation' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages. Additionally, an authentication bypass exists due to improper signature verification using loose comparisons, enabling attackers to bypass checks with crafted JSON payloads.
The PO/MO Editor plugin for WordPress up to version 1.4.2 contains a stored cross-site scripting (XSS) vulnerability via the 'podata' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users load the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, allowing attacker-controlled translation files to replace legitimate ones.
The Cryptocurrency Donation Box – Bitcoin & Crypto Donations WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the data_object parameter in all versions up to and including 2.2.13. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages. The vulnerability arises because the AJAX action cdbbc_payment_verify is accessible without authentication and the nonce check can be bypassed due to the nonce being publicly exposed in JavaScript.
The Document Gallery plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to and including 5.1.1. This vulnerability arises from insufficient input sanitization and output escaping in the 'dg_thumber_webhook' action request body. Exploitation requires that logging be enabled in the plugin's Advanced settings, which is only enabled by default when WP_DEBUG is true; otherwise, an administrator must enable it manually. An unauthenticated attacker can inject arbitrary scripts that execute when a user accesses the affected page.
The Countdown Timer – Widget Countdown WordPress plugin versions 3.0.0 through 3.0.1 are vulnerable to stored Cross-Site Scripting (XSS) via the 'redirect_url' shortcode attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.
Tutor LMS – eLearning and online course solution plugin for WordPress versions up to and including 4.1.0 is vulnerable to reflected Cross-Site Scripting (XSS) via the 'tab' parameter. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires a specific condition where a lesson page has an empty nav-items array, which can occur naturally under certain content and comment settings. This vulnerability has a medium severity rating with a CVSS score of 4.7.
FV Player 8 WordPress plugin versions up to and including 8.1.7 are vulnerable to stored cross-site scripting (XSS) via the 'synopsis' shortcode attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. Additionally, unauthenticated visitors can exploit this vulnerability if the 'Parse Vimeo and YouTube links' setting is enabled, as it processes shortcodes in comment text.
The AGE-GATE WordPress plugin (versions up to and including 1.0) contains a critical remote code execution vulnerability due to an unauthenticated admin.php endpoint that lacks WordPress loading and security checks. This allows attackers to inject unsanitized POST parameters into PHP source code, enabling code execution on the server without authentication.
The Gmedia Photo Gallery WordPress plugin up to version 1.25.1 contains a time-based SQL Injection vulnerability via the 'gmedia__in' parameter. This flaw allows unauthenticated attackers to inject additional SQL queries due to insufficient input escaping and lack of proper query preparation. The vulnerability is exploitable without any authentication because the mobile app endpoint dispatches the library action without validating feature flags, nonces, or user sessions.
This content is a request for participation in an academic survey related to a cybersecurity project. It does not describe a security threat or vulnerability.
Multiple Rakuten Mobile smartphones were shipped using Android Verified Boot (AVB) with AOSP test keys instead of unique production keys. This means the devices rely on publicly known private test keys for boot verification.
TeamPlus Messenger by TEAMPLUS TECHNOLOGY has a code injection vulnerability (CWE-94) that allows unauthenticated remote attackers to inject and execute arbitrary JavaScript. Exploitation requires tricking a user into interacting with crafted content and confirming a Windows security warning, leading to code execution with the current user's privileges. Versions from 16.8.0 through 17.0.6 are affected. The vulnerability has a high severity score of 8.6 CVSS 4.0.
TeamPlus Messenger versions 16.8.0 through 17.0.6 contain a code injection vulnerability (CWE-94) that allows unauthenticated remote attackers to execute arbitrary JavaScript by tricking users into opening a crafted link. Successful exploitation requires the user to confirm a Windows security warning, after which arbitrary code can run with the current user's privileges.
Epic Games Unreal Engine up to version 5.8.0 has an insecure default configuration in the LaunchURL Blueprint node, allowing all URL schemes. On Windows, this can lead to execution of local files via ShellExecuteW() when a file:/// URI is used. This vulnerability affects any Unreal Engine game that loads user-generated content with Blueprints, enabling potential command execution from malicious local or remote files. It is classified as CWE-1188 and has a high severity with a CVSS score of 7.7.