Threat database

A reflected Cross-site Scripting (XSS) vulnerability exists in WP Swings Upsell Order Bump Offer for WooCommerce through version 3.1.6. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of the affected website.

A stack read overflow vulnerability exists in Apache Qpid Proton C versions through 0.40.0 due to a misconfigured wildcard TLS certificate. The flaw does not affect wildcard certificates compliant with the RFC9525 standard. The issue is resolved in version 0.41.1, which restricts accepted certificates to those compliant with RFC9525.

A vulnerability in Apache Qpid Proton C through version 0.40.0 allows a deeply nested message body decoded by pn_message_body() to overflow the stack and cause a crash. The issue is fixed in version 0.41.1.

A signature verification vulnerability exists in the update installation process due to inconsistent validation of update bundle contents. An attacker with administrative privileges can supply a crafted update bundle that passes signature verification but executes an unsigned script with root privileges. This allows the attacker to read or modify sensitive data, alter appliance configuration, or shut down the appliance.

A reflected Cross-site Scripting (XSS) vulnerability exists in OceanWP through version 4.2.7. This vulnerability involves improper neutralization of input during web page generation, which can allow an attacker to inject malicious scripts that execute in the context of a victim's browser.

A vulnerability in Apache Qpid Proton C's OpenSSL TLS implementation causes the APIs pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() to add to rather than replace the default system trust anchors. This behavior can lead to trusting unexpected peer certificates. The issue does not affect the Win32 SChannel TLS implementation. It affects versions through 0.40.0 and is fixed in version 0.41.1.

A reflected Cross-site Scripting (XSS) vulnerability exists in PluginUs.Net TableOn posts-table-filterable component. This vulnerability affects versions up to and including 1.0.7. It allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of the affected application.

Two OS command injection vulnerabilities exist in the update installation functionality due to insufficient validation of update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that executes arbitrary commands with root privileges. This allows reading or modifying sensitive data, changing appliance configuration, or shutting down the appliance.

An authentication bypass vulnerability exists in myCred up to version 4.0.1 that allows identity spoofing. This flaw could enable an attacker with some privileges to bypass authentication controls, potentially leading to limited integrity impact without affecting confidentiality or availability.

A critical SQL Injection vulnerability (CVE-2026-115964) exists in StylemixThemes Motors plugin up to version 1.4.126. This vulnerability allows an unauthenticated attacker to perform Blind SQL Injection, potentially leading to high confidentiality impact and partial denial of service.

OmniRoute versions 3.8.0 up to but not including 3.8.52 have a vulnerability allowing holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without knowing the current password. This can enable attackers to lock out legitimate operators, take over dashboard login, or disable login requirements.

A weak authentication vulnerability exists in the 'Login with phone number' component of Hamid Alinia Login, affecting versions up to 1.8.78. This flaw allows authentication abuse, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a high severity score of 8.8 (CVSS 3.1) and requires low privileges to exploit without user interaction.

A missing authorization vulnerability exists in the GEO my WordPress plugin (geo-my-wp) up to version 4.5.5.5. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized data disclosure. The vulnerability has a high severity rating with a CVSS score of 7.5, indicating network exploitable conditions without user interaction and resulting in high confidentiality impact but no integrity or availability impact.

The Everest Forms plugin for WordPress versions up to and including 3.6.2 suffers from a sensitive information exposure vulnerability. Unauthenticated attackers can exploit this flaw to extract arbitrary WordPress post meta values, such as license keys, API tokens, SMTP credentials, and secrets related to Stripe or AWS. This is possible because the submission nonce is publicly available in every embedded form and can also be generated anonymously via a specific action, requiring no authentication.

The LiteSpeed Cache plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter affecting all versions up to and including 7.9.1. This flaw arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires the HTML Minify option to be enabled and a companion plugin that renders stored comment content in a raw-text context such as a JSON-LD script block on the same page.

The HT Mega Addons for Elementor WordPress plugin (up to version 3.2.7) contains a stored DOM-based cross-site scripting (XSS) vulnerability via the href attribute of anchor tags inside the .htmega-tab-nav parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires a co-installed plugin like wpDiscuz with its rich editor enabled, an HT Mega Tabs widget on the same page, and a victim clicking the injected link.

The Greenshift WordPress plugin (animation and page builder blocks) is vulnerable to stored DOM-based cross-site scripting (XSS) via the 'comment' parameter in all versions up to and including 13.2.1. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access affected pages. Exploitation requires specific conditions involving administrator-published pages with certain block configurations that trigger the vulnerable script processing comment excerpts.

The Greenshift WordPress plugin, used for animation and page builder blocks, suffers from a Stored DOM-Based Cross-Site Scripting (XSS) vulnerability via the 'comment' parameter in all versions up to and including 13.2.1. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view affected pages. Exploitation requires a specific page configuration involving an Advanced HTML Element block with Split Text animation wrapping a Latest Comments block displaying comment excerpts.

Checkmk versions prior to 2.5.0p18, 2.4.0p39, 2.3.0p52, and version 2.2.0 (EOL) have improper certificate validation due to inclusion of a root CA that trusts eMudhra (emSign) intermediate certificates with publicly known private keys. This flaw arises from the bundled Certificate Authority stores using "certifi" and "webpki-roots". The vulnerability could allow attackers to exploit the trust in these compromised intermediate certificates.

A broken access control vulnerability in Foxit's official website HTML-to-PDF conversion service allows unauthorized users to access documents submitted by others due to a shared token mechanism.