Threat database

The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.

The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing unauthenticated users to store malicious scripts that are executed in the browser of any privileged user, such as an administrator, who opens the block editor.

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders.

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network.

The LiteSpeed Cache plugin for WordPress versions up to and including 7.9.1 has a vulnerability that allows unauthenticated attackers to access sensitive WooCommerce customer data. When the Cache REST feature is enabled (default setting), personalized WooCommerce Store API GET responses are cached publicly without varying by session tokens. This flaw enables attackers to retrieve other shoppers' billing and shipping information, cart contents, and session tokens, potentially hijacking live cart sessions.

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'multi_media' Field Array Key in all versions due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses_post sanitization applied at save time operates only on array leaf values, leaving array keys entirely unsanitized; the injected key is then rendered directly into an id="filelist-<KEY>" HTML attribute without esc_attr() in Redux_Multi_Media::render(), allowing attribute breakout.

The Motors WordPress plugin (up to version 1.4.128) contains a file deletion vulnerability allowing authenticated users with Subscriber-level access or higher to delete image files belonging to other users within the uploads directory. This occurs due to improper ownership checks on a user meta field that accepts attacker-controlled input, enabling deletion of avatars, dealer logos, and uploaded media. The vulnerability is limited to image files within the uploads directory and does not affect files outside this path.

STMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check whether the allowed number of channels is exceeded.

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via theme_opts Parameter via User Profile in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the host theme to have registered a Redux field of a CSS-emitting type (such as link_color, border, or typography) with an output CSS selector, as only the field types 'spinner', 'slider', 'color', and 'date' receive per-type value validation that would block the entity-encoded payload.

The GiveWP WordPress plugin up to version 4.19.1 contains a privilege escalation vulnerability via improper sanitization of the donor_default_user_role parameter. Authenticated users with the GiveWP Manager role or higher can assign elevated WordPress roles, including Administrator, to new donor accounts through an import JSON path that bypasses sanitization. This allows unauthorized assignment of privileged roles to new users.

@twilio-labs/netlify-okta-auth versions through 1.0.2 have a vulnerability where the iss (issuer) claim is not properly verified. This flaw affects the process of making an outbound HTTP request to retrieve a public signing key and may lead to additional impacts if the oktaUrl configuration is missing or incorrect.

A vulnerability has been found in OpenHands up to 1.24.0. This impacts an unknown function of the component Landing Page. Such manipulation leads to missing authentication. The attack must be carried out from within the local network. The exploit has been disclosed to the public and may be used. Upgrading to version 1.25.0 will fix this issue. The name of the patch is c5efa3ae415def0a903c82d2b17b748e663b1995. Upgrading the affected component is recommended.

A vulnerability was determined in itsourcecode Airline Reservation System 1.0. This affects an unknown function of the file /admin/manage_booked.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slides_to_show' parameter in all versions up to, and including, 5.126.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file admin/add_category.php of the component Category Management. Performing a manipulation of the argument category_title results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.

CVE-2026-123025 is a critical OS Command Injection vulnerability in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin up to version 4.17. A remote authenticated user with privileges to issue or renew certificates via the WebGUI or API can execute arbitrary commands as root due to unsafe interpolation of user-controlled fields into shell commands without validation or escaping.

GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) call can be forged.

The WP PageNavi Style WordPress plugin up to version 1.4 contains a vulnerability where some settings are not properly sanitized or escaped, and there is no CSRF protection when saving these settings. This flaw allows an attacker to perform a CSRF attack that causes a logged-in administrator to store arbitrary JavaScript, which is then executed in the browsers of site visitors.

The CatFolders WordPress plugin versions before 2.5.7 lack authorization checks on a folder maintenance action. This flaw allows users with subscriber-level roles to reset per-user ownership of all media folders and disable the plugin's user restriction setting.

The CatFolders WordPress plugin before version 2.5.7 contains a SQL injection vulnerability. This flaw arises because the plugin does not properly sanitize and escape a user-controlled sort setting used in a SQL query. Authenticated users with upload capability (Author role and above) can exploit this to perform SQL injection attacks.