Threat database

A missing authorization vulnerability in TMS IvyForms (ivyforms) allows attackers to exploit incorrectly configured access control security levels. This affects versions up to and including 1.5.1. The vulnerability does not impact confidentiality or availability but can lead to integrity issues due to unauthorized actions.

A Cross-Site Scripting (XSS) vulnerability exists in the Media Library Assistant plugin by David Lingren, allowing improper neutralization of script-related HTML tags. This vulnerability affects versions up to and including 3.43. The flaw could allow an attacker to inject code, potentially leading to limited confidentiality impact without requiring user interaction or privileges.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the WP Data Access plugin by Passionate Programmer Peter, affecting versions up to 5.5.90. This vulnerability allows an attacker to induce a user to perform unwanted actions on the affected system. The vulnerability has a CVSS score of 6.5, indicating medium severity, with an impact primarily on availability. No public exploits or patches are currently documented.

A Cross-Site Scripting (XSS) vulnerability exists in Ditty News Ticker by Metaphor Creations, LLC, due to improper neutralization of script-related HTML tags. This allows code injection in affected versions up to 3.1.71. The vulnerability has a medium severity rating with a CVSS score of 4.3.

A missing authorization vulnerability exists in WP Desk Dropshipping XML for WooCommerce up to version 1.7.4. This flaw allows improper access control, potentially enabling unauthorized users with limited privileges to perform actions they should not be allowed to. The vulnerability has a medium severity rating with a CVSS score of 4.3.

A missing authorization vulnerability exists in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services up to version 1.0.20. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 5.3.

A stored cross-site scripting (XSS) vulnerability exists in Aguila Technologies WP Customer Area plugin versions up to 8.4.3. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that can be executed in the context of other users. The flaw impacts confidentiality, integrity, and availability to a limited extent. No public exploits or patches are currently documented.

A stored cross-site scripting (XSS) vulnerability exists in Untapwp Vidplex versions up to 1.0.3. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity.

A stored cross-site scripting (XSS) vulnerability exists in BdThemes Element Pack Elementor Addons up to version 10.0.2. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that can impact confidentiality, integrity, and availability.

A missing authorization vulnerability exists in Everest Forms up to version 3.6.3, allowing exploitation of incorrectly configured access control security levels. This flaw could permit unauthorized access to certain functionalities or data within the plugin. The vulnerability has a CVSS score of 4.3, indicating a medium severity level.

A critical buffer overflow vulnerability exists in TOTOLINK CA300-PoE version 6.2c.884 within the setWanConfig function of /cgi-bin/cstecgi.cgi. This flaw can be exploited remotely by manipulating the pppoeUser, priDns, or secDns arguments, potentially allowing an attacker to execute arbitrary code or cause a denial of service. Public exploit code is available, increasing the risk of exploitation.

A missing authorization vulnerability exists in Cozmoslabs Paid Member Subscriptions plugin up to version 3.1.3. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions. The vulnerability has a medium severity with a CVSS score of 5.3.

A critical buffer overflow vulnerability exists in TOTOLINK CA300-PoE version 6.2c.884 in the setLanguageCfg function of /cgi-bin/cstecgi.cgi. This flaw allows remote attackers with high privileges to manipulate the langType argument, potentially leading to complete compromise of confidentiality, integrity, and availability. Public exploit code has been released.

A missing authorization vulnerability exists in WP Desk Autopay dla WooCommerce pay-wp plugin versions up to 2.3.0. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions that impact the integrity of the system. The vulnerability has a medium severity rating with a CVSS score of 5.3.

A missing authorization vulnerability exists in StylemixThemes Motors plugin for motors-car-dealership-classified-listings, affecting versions up to 1.4.128. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The vulnerability has a CVSS score of 4.3, indicating medium severity, with impact limited to integrity without affecting confidentiality or availability.

A missing authorization vulnerability exists in Ahmad JS Help Desk js-support-ticket up to version 5.0.3. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions that impact the integrity of the system. The vulnerability has a medium severity rating with a CVSS score of 5.3.

The wpForo Forum plugin for WordPress versions up to and including 3.2.1 is vulnerable to SQL Injection via the 'data' parameter. This vulnerability arises from insufficient escaping of user-supplied input and inadequate preparation of SQL queries. Exploitation requires specific forum configuration with searchable topic form fields of type checkbox or select/autocomplete with multi-choice enabled. An unauthenticated attacker can exploit this to append SQL queries and extract sensitive database information.

A missing authorization vulnerability exists in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat, affecting versions up to 6.1.9. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionalities. The vulnerability has a medium severity with a CVSS score of 5.3, indicating limited impact on confidentiality and no impact on integrity or availability.

A missing authorization vulnerability exists in WebberZone Contextual Related Posts plugin versions up to 4.5.3. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality or data. The vulnerability has a CVSS score of 4.3, indicating a medium severity impact primarily affecting confidentiality. No public exploits or patches are currently documented.

A Cross-Site Scripting (XSS) vulnerability exists in Better Notifications for WP plugin by Made with Fuel Ltd. This issue allows improper neutralization of script-related HTML tags, enabling code injection. The vulnerability affects versions up to and including 1.10.1. The CVSS score is 5.3, indicating a medium severity risk. No public exploits or patches are currently documented.