The MC4WP: Mailchimp for WordPress plugin versions before 4.15.0 contain a vulnerability where the plugin does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner. This flaw allows unauthenticated visitors to subscribe arbitrary email addresses to any audience within the site's connected Mailchimp account.
The PublishPress Revisions WordPress plugin before version 4.3.1 contains an access control vulnerability. It fails to verify that a user requesting to duplicate or revise a post actually has access to that specific post, only checking if they can edit posts of that type. This allows users with contributor-level access and above to duplicate private, draft, pending, or scheduled posts owned by other users and read their full content.
A vulnerability in the REST Data Panache component of Quarkus allows an authenticated user to infer sensitive data values by exploiting a failure to enforce security constraints on entity properties when those constraints are applied via the @SecureField annotation on getter methods. This flaw affects filtering and sorting operations in generated REST resources, potentially exposing confidential information despite the values being omitted from the response.
The Static Snapshot WordPress plugin up to version 0.2.1 contains a vulnerability where it fails to sanitize shell metacharacters in user-supplied input before using it in operating system commands. This flaw allows unauthenticated attackers to execute arbitrary commands on the server hosting the plugin.
The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin versions before 2.4.4 contains a vulnerability where it fails to validate user capabilities or ownership of targeted posts in an AJAX action. This flaw allows users with contributor-level roles to inject arbitrary JavaScript into any post, which executes when a higher privileged user edits the post.
A vulnerability in Keycloak's Standard Token Exchange V2 allows authenticated requesters to indefinitely extend access for service accounts by repeatedly exchanging tokens. The system issues new tokens with a fresh lifetime based on the requester client's configuration rather than limiting it to the original token's expiration. This flaw enables persistent access even if the original client is disabled by an administrator.
A vulnerability in the SAML brokering component of Keycloak allows users to bypass ProxyRestriction constraints set by upstream identity providers. This flaw enables unauthorized login to downstream services despite explicit restrictions on session sharing. Exploitation requires a specific SAML brokering configuration and the presence of ProxyRestriction conditions from a trusted upstream provider. The issue stems from Keycloak's failure to enforce these ProxyRestriction constraints during the brokering process.
A vulnerability in the Keycloak Account REST API allows a malicious client owner with client registration privileges to manipulate their security tokens to reference another user's active session. This flaw enables unauthorized access and modification of the victim's account information, potentially leading to full account takeover by changing recovery email and resetting the password. Exploitation requires specific session timing and user interaction. No effective mitigation is currently available that meets Red Hat's criteria for ease of use and applicability.
The AutomatorWP WordPress plugin versions before 6.0.7 contain a vulnerability where it does not verify that the user completing Zoom and AWeber integration connections is authorized. This flaw allows unauthenticated attackers to replace stored integration credentials with their own, redirecting data sent to these services into accounts they control. Exploitation requires the integration to be already connected and knowledge of the site's OAuth client identifier.
The Surfer WordPress plugin versions before 1.8.1.759 expose a sensitive API credential on the post editor page to users with contributor-level access and above. This credential is used as the sole authorization mechanism for privileged REST API actions, enabling these users to escalate their privileges to publish arbitrary posts and perform other restricted operations.
A vulnerability exists in the ansible-core user module when the generate_ssh_key option is enabled. The module attempts to protect key files against symlinks but only checks the ~/.ssh directory with os.path.exists(), allowing an unprivileged user to replace ~/.ssh with a symlink to a root-writable directory. This causes the privileged module to write SSH key files through the symlink and change ownership to the user, potentially enabling local privilege escalation to root via files placed in directories processed by schedulers or dynamic MOTD. This is an incomplete fix of a previous vulnerability (CVE-2024-9902).
The Ever Accounting WordPress plugin versions before 2.3.3 contain a vulnerability in the CSV import routine that fails to restrict file paths to an allowed directory. This flaw allows users with the custom Accounting Manager role, which lacks administrator privileges, to delete arbitrary files on the server, including critical files like wp-config.php, potentially taking the entire site offline.
The WCFM Membership WordPress plugin versions prior to 2.12.1 contain a vulnerability where the plugin does not verify payment completion before activating a paid membership. This flaw allows any authenticated Subscriber or Customer to activate a paid vendor membership without payment, thereby gaining unauthorized marketplace vendor privileges.
The All-in-One Video Gallery WordPress plugin versions prior to 5.1.0 contain a stored cross-site scripting (XSS) vulnerability. This occurs because the plugin does not properly escape or sanitize the stored thumbnail URL of videos before outputting it in the admin video list or when written outside its own editor. As a result, users with the Subscriber role can inject malicious scripts that execute in the context of administrator users.
A vulnerability in the PublishPress Revisions WordPress plugin before version 4.3.1 allows users with Contributor-level permissions, who normally cannot publish content, to bypass the editorial approval process and publish posts or pages directly. This flaw undermines the intended content review workflow.
A vulnerability in Keycloak's TokenManager component allows an attacker holding an old stateless access token to gain access to a newly created service account if it shares the same client ID as a previously deleted one. This occurs because Keycloak falls back to using the username for user identification without verifying the token's original subject when the original user ID no longer exists. Exploitation requires administrative actions to delete and recreate clients with the same ID while an attacker retains a valid token.
The iubenda All-in-one Compliance for GDPR / CCPA Cookie Consent WordPress plugin before version 3.13.7 improperly escapes content re-emitted through its bundled HTML parser. This flaw allows unauthenticated users to inject arbitrary web scripts into pages, which execute in the context of any visitor viewing them, including logged-in administrators.
The Cool Media Filter WordPress plugin versions through 1.0.1 have a vulnerability where no capability or nonce checks are performed when updating role capabilities. This flaw allows any authenticated user, including low-privileged roles like subscribers, to escalate their privileges to administrator and take over the site.
The WHIZZ WordPress plugin up to version 1.1.8 has a vulnerability where it does not properly validate the password-reset key before updating a user's password. Instead, it relies solely on a nonce that is accessible to unauthenticated visitors. This flaw allows attackers to set arbitrary passwords for any user account, including administrators, enabling full account takeover.
A vulnerability in the Admin REST API of Keycloak allows an attacker operating a client within a realm to capture and reuse an administrator's access token. This is due to the Admin API failing to verify the intended audience of bearer tokens during authentication. Exploitation can lead to unauthorized administrative actions and potentially full realm compromise.