Threats affecting pkg:generic/libucl

The Webmention plugin for WordPress versions up to and including 5.10.1 contains a stored cross-site scripting (XSS) vulnerability via the Open Graph og:title meta tag. This vulnerability arises from insufficient input sanitization, allowing unauthenticated attackers to inject arbitrary scripts. However, exploitation requires an administrator to approve the injected webmention comment, as the payload is stored in comment content without proper filtering.

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin up to version 5.16.5 has a vulnerability that allows unauthenticated attackers to access complete invoice PDFs of other customers. This occurs via the 'invoice_number' parameter in the document filename when the plugin's yearly invoice number reset option is enabled. Exploitation requires the attacker to place a guest checkout order that triggers a processing email within 60 seconds of a victim's order sharing the same yearly-reset invoice number. The exposed invoice contains sensitive information such as billing and shipping addresses, private order notes, line items, prices, dates, order ID, and invoice number.

The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress contains a critical PHP Object Injection vulnerability in all versions up to and including 7.1.1. This flaw arises from insufficient sanitization of the 'customer_note' checkout field, allowing unauthenticated attackers to execute arbitrary code on the server by exploiting the invoice generation process triggered during checkout.

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress versions up to and including 5.16.4 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient input sanitization and output escaping of certain parameters such as billing_address.first_name, last_name, company, and customer_note. An incomplete fix introduced in version 5.16.2 attempted to block raw-tag payloads but was bypassed by entity-encoded payloads, allowing script injection that executes when a user accesses the affected page.

The SureCart WordPress plugin up to version 4.9.4 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. The injected scripts execute when users visit pages that load SureCart's web-component bundle, such as those containing a SureCart Buy Button block. For exploitation, the injected comment must be auto-approved or approved by a moderator.

CVE-2026-118599 is a file overwrite vulnerability in GNOME Epiphany affecting versions 47.0 and later. The vulnerability arises when installing WebExtension packages from .xpi files, which can be crafted as TAR archives containing hard links. This allows an attacker to overwrite existing user-writable files without warning during installation or opening of the malicious .xpi. The issue requires user interaction and does not affect confidentiality or availability directly. A fix is available that restricts support to ZIP format only.

A logic error in GNOME Epiphany's site permission handling causes camera and microphone access to be granted when the user only approves clipboard or website data access permissions. This flaw allows a malicious site that obtains clipboard or storage access approval to use getUserMedia without additional prompts, exposing audiovisual confidentiality. The vulnerability affects Epiphany versions 45.0 through at least 51.x and requires user interaction to approve a clipboard or website-data-access prompt. A fix has been implemented in the upstream repository.

The WooCommerce Extra Product Options Pro plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability in all versions up to and including 3.3.2. This flaw arises from insufficient input sanitization and output escaping of the '<fieldname>_start' and '<fieldname>_end' parameters on product pages that have a Date & Time Range Picker extra field configured. An unauthenticated attacker can exploit this vulnerability by tricking a user into clicking a crafted link, causing arbitrary scripts to execute in the user's browser. The required field names are visible in the product page source, making exploitation easier without prior knowledge.

The Germanized for WooCommerce WordPress plugin up to version 4.1.4 has a vulnerability allowing unauthorized access to private customer data via activation token reuse. This occurs when the 'Disable login for unactivated customers' setting is set to No (non-default) and double opt-in is enabled. An authenticated attacker with Subscriber-level access can change their account email to a victim's billing email and redeem their original activation token, causing guest orders to be linked to the attacker's account and exposing sensitive billing information. Exploitation requires public customer registration and token redemption within one day.

The FlexStock – Product Stock Sync with Google Sheets for WooCommerce WordPress plugin versions up to 3.17.2 contain a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient input sanitization and output escaping of the 'products[].post_content' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability is exacerbated by the exposure of a REST bearer token in the Dashboard page source without proper capability checks, allowing exploitation without higher privileges.

The Debug Log Manager plugin for WordPress (up to version 2.5.2) contains a stored cross-site scripting (XSS) vulnerability via the 'message' and 'pageUrl' parameters. This flaw allows unauthenticated attackers to inject malicious scripts that execute when a user accesses an affected page. Exploitation requires that debug logging with JavaScript error logging is enabled and that the attacker can obtain a publicly emitted nonce to bypass security checks.

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress versions up to 3.15.5 is vulnerable to a reflected DOM-based cross-site scripting (XSS) flaw. This vulnerability arises from insufficient input sanitization and output escaping of a 'querystring:<key>' URL parameter, allowing unauthenticated attackers to inject arbitrary scripts. The attack exploits the server's resolution of the {field:*} placeholder, causing the client-side code to reconstruct field content from unsanitized query parameters, potentially executing malicious scripts when a user clicks a crafted link.

WP Directory Kit plugin for WordPress versions up to and including 1.6.0 is vulnerable to an SQL Injection via the 'idfield' parameter. This vulnerability allows unauthenticated attackers to inject additional SQL queries due to insufficient escaping and lack of proper query preparation, potentially exposing sensitive database information.

The BuddyBoss Platform WordPress plugin up to version 3.6.0 is vulnerable to stored Cross-Site Scripting (XSS) via the Group Name field. Authenticated users with subscriber-level access or higher can inject malicious scripts if the setting allowing all members to create social groups is enabled, which is the default configuration. This vulnerability arises from insufficient input sanitization and output escaping.

The NextGEN Gallery plugin for WordPress (versions up to 4.4.1) contains a vulnerability that allows authenticated users with custom-level access or higher to execute remote code on the server. This occurs due to unrestricted file upload and unsafe handling of metadata in the render_image function, combined with a bypassable signature check. Attackers must own at least one gallery, a condition retained indefinitely even if permissions are later revoked.

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'post_images' parameter affecting all versions up to 2.8.197. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute in the browsers of administrators or editors when they access the pending listing's edit screen. This vulnerability enables a privilege escalation chain through normal editorial workflows.

OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body, causing authorization checks to be performed under that other client identity. This affects the client_credentials and Resource Owner Password Credentials grant flows. The flaw arises because OAuthlib does not require the client_id in the request body to match the authenticated client's client_id before validating grant types and scopes. As a result, a low-privilege client can obtain tokens with scopes or grant types intended for a higher-privilege client if the application validator authorizes based on the client_id argument passed by OAuthlib. The vulnerability is fixed in version 2024.3.1_9.

pyasn1 versions up to 0.6.4 contain a denial of service vulnerability in the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process uses a quadratic-time algorithm that can cause high CPU usage and exhaustion when processing attacker-controlled input. This affects BER, CER, and DER decoders. The issue is fixed in pyasn1 version 0.6.5.

CVE-2026-119196 affects pyasn1 versions up to 0.6.4 and certain molecule versions, causing quadratic CPU consumption when decoding constructed BIT STRING values with many fragments. This can lead to CPU exhaustion and denial of service if attacker-controlled ASN.1 data is processed. The vulnerability arises from inefficient bit shifting during decoding in BER and CER decoders, and permissive DER schema-driven decoding. The issue is fixed in molecule version 3.0.5.

pyasn1 versions up to 0.6.4 have a quadratic-time denial of service vulnerability in decoding constructed OCTET STRINGs, character strings, and indefinite-length ANY types. The decoder repeatedly concatenates fragments inefficiently, causing CPU usage to grow quadratically with the number of fragments. This can lead to CPU exhaustion if attacker-controlled ASN.1 input is decoded without proper limits. The issue affects BER and CER decoding and certain non-conforming DER inputs. No confidentiality or integrity impact is reported.