Threat database

A Cross-Site Scripting (XSS) vulnerability exists in StylemixThemes MasterStudy LMS up to version 3.7.56 due to improper neutralization of script-related HTML tags. This flaw allows an attacker with low privileges to inject code that can be executed in the context of other users' browsers. The vulnerability has a medium severity rating with a CVSS score of 4.3.

A missing authorization vulnerability exists in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress, affecting versions up to 2.3.18. This flaw allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a medium severity rating with a CVSS score of 5.3.

The wpForo Forum plugin for WordPress versions up to and including 3.2.2 is vulnerable to stored Cross-Site Scripting (XSS) via the 'post[body]' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with subscriber-level access or higher to inject malicious scripts that execute when other users view the affected pages.

A stored cross-site scripting (XSS) vulnerability exists in Elementor Website Builder versions up to 4.3.5. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers with limited privileges and requiring user interaction to potentially execute malicious scripts. The flaw impacts confidentiality, integrity, and availability to a limited extent.

The YML for Yandex Market plugin for WordPress versions up to and including 5.10.0 contains a vulnerability that allows unauthenticated attackers to access sensitive information. Specifically, attackers can extract the merchant's plaintext Yandex Market API key from a publicly accessible log file. This exposure requires that the plugin's y4ym_keeplogs option is enabled and that a Yandex Market API key is stored, conditions that are typical in normal plugin usage.

A Cross-Site Scripting (XSS) vulnerability exists in WPDeveloper NotificationX plugin versions up to 3.3.6. This flaw involves improper neutralization of script-related HTML tags, allowing an attacker to inject code. The vulnerability has a medium severity with a CVSS score of 5.3. No patch or remediation information is currently provided.

A missing authorization vulnerability exists in the ThemeGrill User Registration plugin up to version 5.3.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 4.3.

A stored cross-site scripting (XSS) vulnerability exists in The Events Calendar plugin by Liquid Web / StellarWP, affecting versions up to 6.18.3. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of other users. The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity impact on confidentiality, integrity, and availability. No official patch or remediation information is currently provided.

A Cross-Site Scripting (XSS) vulnerability exists in Brainstorm Force CartFlows up to version 3.3.0 due to improper neutralization of script-related HTML tags. This flaw allows an attacker to inject code into web pages. The vulnerability has a medium severity with a CVSS score of 5.3. No patch or remediation information is currently provided.

A missing authorization vulnerability exists in Saeed MC Woocommerce Wishlist (smart-wishlist-for-more-convert) versions up to 2.0.3. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The vulnerability has a medium severity rating with a CVSS score of 5.3.

A missing authorization vulnerability exists in Brainstorm Force CartFlows up to version 3.3.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 5.3.

A missing authorization vulnerability exists in BdThemes Ultimate Store Kit Elementor Addons (ultimate-store-kit) up to version 4.0.1. This flaw allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a medium severity rating with a CVSS score of 5.3, indicating limited confidentiality impact without integrity or availability effects. No patch or fix information is currently available.

A Cross-Site Request Forgery (CSRF) vulnerability exists in Blubrry Podcasting PowerPress Podcasting up to version 11.18.0. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability has a high severity with a CVSS score of 8.8, indicating a significant risk to confidentiality, integrity, and availability.

The Zephyr Project Manager plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'zpm_profile_picture' parameter affecting all versions up to and including 3.3.209. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute in administrator browsers when the autocomplete mention lookup renders the avatar field. Exploitation requires an administrator to view the injected content, as the attacker cannot trigger the vulnerability alone.

A missing authorization vulnerability exists in myCred up to version 4.0.2, allowing exploitation of incorrectly configured access control security levels. This flaw can lead to unauthorized modification of data or actions without proper permissions.

A Cross-Site Scripting (XSS) vulnerability exists in The Events Calendar plugin by Liquid Web / StellarWP, allowing improper neutralization of script-related HTML tags. This vulnerability affects versions up to and including 6.18.3. The flaw could allow an attacker to inject code that is executed in the context of the affected web page. The vulnerability has a CVSS score of 5.3, indicating a medium severity level.

A missing authorization vulnerability exists in Blubrry Podcasting PowerPress Podcasting powerpress, affecting versions up to 11.18.0. This flaw allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized access with limited privileges. The vulnerability has a medium severity rating with a CVSS score of 5.4.

A missing authorization vulnerability exists in Wpmet Metform up to version 4.3.3. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 4.3.

A missing authorization vulnerability exists in WC Lovers WCFM Membership (wc-multivendor-membership) up to version 2.12.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 4.3.

A missing authorization vulnerability exists in Brainstorm Force SureForms up to version 2.13.0. This flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized actions that impact data integrity. The vulnerability has a medium severity rating with a CVSS score of 5.3 and does not affect confidentiality or availability.