A stored cross-site scripting (XSS) vulnerability exists in WP Recipe Maker plugin versions up to 10.9.1. This vulnerability is due to improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a medium severity rating with a CVSS score of 6.5.
A critical buffer overflow vulnerability exists in TOTOLINK CA300-PoE version 6.2c.884 in the setLanConfig function of /cgi-bin/cstecgi.cgi. The flaw arises from improper handling of the lanDns, lanSecDns, and langType arguments, allowing remote attackers to execute code or cause denial of service. Public exploit code is available, increasing the risk of exploitation. No patch or remediation information is provided.
A stored cross-site scripting (XSS) vulnerability exists in Saeed MC Woocommerce Wishlist (smart-wishlist-for-more-convert) versions up to 2.0.3. This vulnerability arises from improper neutralization of input during web page generation, allowing an attacker with limited privileges to inject malicious scripts that can be executed in the context of other users.
A Cross-Site Scripting (XSS) vulnerability exists in ProfilePress wp-user-avatar plugin versions up to 4.17.7 due to improper neutralization of script-related HTML tags. This flaw allows an attacker to inject code into web pages, potentially leading to limited confidentiality impact. The vulnerability has a medium severity score of 5.3 and does not require user interaction or privileges to exploit. No public exploits or known active exploitation have been reported. No patch or remediation information is currently available.
A missing authorization vulnerability exists in WP Lab WP-Lister Lite for Amazon (wp-lister-for-amazon) up to version 2.9.2. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized information disclosure. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A stored cross-site scripting (XSS) vulnerability exists in Contact Form 7 – Post Fields (cf7-post-fields) up to version 2.6.0. This vulnerability arises from improper neutralization of input during web page generation, allowing an attacker with limited privileges to inject malicious scripts that can execute in the context of other users. The vulnerability has a CVSS v3.1 score of 6.5, indicating a medium severity level with potential impacts on confidentiality, integrity, and availability.
A missing authorization vulnerability exists in myCred up to version 4.0.2, allowing exploitation of incorrectly configured access control security levels. This flaw does not impact confidentiality or availability but can lead to integrity issues due to unauthorized actions.
A missing authorization vulnerability exists in weDevs weDocs (up to version 2.6.1) that allows exploitation of incorrectly configured access control security levels. This flaw could permit unauthorized access to certain information or functionality due to insufficient authorization checks.
A missing authorization vulnerability exists in Infomaniak Network VOD (vod-infomaniak) up to version 1.5.15. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a CVSS score of 4.3, indicating a medium severity level.
The Advanced Form Integration plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input in all versions up to and including 2.10.2. Exploitation requires a previously configured active NexForms integration and presence of a PHP Object Injection POP chain in another installed plugin or theme. Without such a POP chain, the vulnerability has no impact. If exploited, it may allow attackers to delete files, retrieve sensitive data, or execute code depending on the POP chain available.
The Vanquish Upload Files for WooCommerce plugin for WordPress contains a directory traversal vulnerability in all versions up to and including 2.7.13. Authenticated users with subscriber-level access or higher can exploit this flaw via the 'vanupfi_file_name' parameter to read arbitrary files on the server. The vulnerability arises from an authorization bypass triggered by supplying a non-existent order ID, which causes an internal check to be bypassed. A traversal payload can then be used to access sensitive files such as wp-config.php.
The WebToffee WP Backup and Migration plugin for WordPress versions up to and including 1.6.1 contains a generic SQL Injection vulnerability via the 'description' parameter. This flaw allows authenticated users with subscriber-level access or higher to inject additional SQL queries due to insufficient escaping and preparation of the SQL statement. Exploitation requires an administrator to perform a local database export and restore operation, which is the plugin's primary function. The attacker cannot trigger the vulnerability without administrator action.
The aBlocks WordPress plugin up to version 2.18.0 is vulnerable to stored cross-site scripting (XSS) via the 'headingTag' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.
The TranslatePress WordPress plugin for multilingual AI translation is vulnerable to stored cross-site scripting (XSS) in all versions up to and including 3.3.8. The vulnerability arises from insufficient input sanitization and output escaping of certain parameters, allowing unauthenticated attackers to inject malicious scripts that execute when users view affected pages.
The GamiPress WordPress plugin, used for gamification with points, badges, and ranks, contains a SQL Injection vulnerability in all versions up to and including 8.1.1. This flaw arises from insufficient escaping of user-supplied input in the 'input_<field_id>.<part>' parameter related to Gravity Forms integration. Authenticated users with subscriber-level access or higher can exploit this to append SQL queries and extract sensitive database information. Exploitation requires a configured GamiPress achievement tied to a Gravity Forms field value submission event with the form published.
The Paystack WooCommerce Payment Gateway plugin for WordPress versions up to and including 5.8.5 is vulnerable to sensitive information exposure via the 'key' parameter. This vulnerability allows unauthenticated attackers to enumerate sequential order IDs and extract customer personally identifiable information (PII) such as billing name, email, phone number, billing and shipping addresses, and purchased product details. Exploitation requires that the merchant has enabled the optional custom metadata feature in the Paystack gateway settings.
The aBlocks WordPress plugin versions up to and including 2.18.0 contain a vulnerability that allows authenticated users with contributor-level access or higher to expose the full content of password-protected posts by using a shortcode with the post's ID. Users with author-level access or above can publish posts embedding this shortcode, thereby exposing protected content to unauthenticated visitors.
A vulnerability in the Trainer v2 TrainJob API allows users with permissions to create TrainJobs to inject valueFrom.secretKeyRef into environment variable definitions. This can lead to exfiltration of sensitive secrets from the namespace and privilege escalation if the TrainJob RBAC is broader than the Secret read RBAC. The issue affects a Technology Preview feature in Red Hat OpenShift AI and has a low impact. Mitigation involves aligning TrainJob creation permissions with Secret read permissions or restricting the valueFrom.secretKeyRef field via a validating webhook.
The WP Data Access – App Builder plugin for WordPress contains a SQL Injection vulnerability in the 'engine' parameter affecting all versions up to and including 5.5.90. Authenticated users with subscriber-level access or higher can exploit this flaw if an administrator has configured a Data Project page to allow lower-privileged roles. This vulnerability allows attackers to append additional SQL queries to extract sensitive database information.
A vulnerability in OpenBMB Internet of Agents affects the fetch_chat_record function in the Message Handler component due to improper access control on the comm_id argument. This flaw allows remote attackers to potentially access unauthorized information. The vulnerability has a high severity score of 7.3 and public exploit code is available. The project has been informed but has not yet responded or issued a fix.