The Defender Security WordPress plugin versions before 6.4.1 improperly trust user-supplied IP address values without verifying their source. This flaw allows unauthenticated attackers to spoof IP addresses, bypass IP-based protections such as login lockout and IP banning, impersonate allowlisted IPs, and corrupt activity logs.
The Abilities Bridge WordPress plugin versions prior to 1.4.2 lack nonce validation when re-authenticating REST API requests from logged-in session cookies. This vulnerability enables attackers to perform Cross-Site Request Forgery (CSRF) attacks that can cause a logged-in administrator to execute arbitrary REST API actions, including creating new administrator accounts and taking over the site.
A vulnerability in the Notification API of Synology DiskStation Manager (DSM) before versions 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files due to improper neutralization of input during web page generation. This issue is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability has a CVSS 3.1 base score of 5.4, indicating a medium severity level.
The Crop Thumbnails WordPress plugin versions before 1.10.0 lack proper object-level authorization when reading and re-cropping media attachments. This flaw allows any authenticated user with the upload capability, such as the default Author role, to access and modify metadata and thumbnail files of media attachments owned by other users.
The Descope WordPress plugin versions before 1.2.0 contain a vulnerability where the plugin does not validate authentication tokens before creating WordPress sessions. This allows an unauthenticated attacker to obtain a session for any existing user account, including administrators, by supplying the target account's email address.
The Mine CloudVod WordPress plugin versions prior to 2.6.6 allow unauthenticated attackers to request cloud storage upload credentials via certain REST API routes. This vulnerability enables attackers to obtain signed upload policies and temporary credentials for Alibaba Cloud OSS, Tencent Cloud COS, and Dogecloud accounts configured on the site, potentially allowing them to upload or overwrite files in the site's cloud storage.
The Clockinator Lite WordPress plugin versions prior to 1.1.0 contain vulnerabilities that allow unauthenticated users to perform SQL injection attacks. These vulnerabilities stem from insufficient access restrictions on record deletion actions and the use of user-supplied table names in SQL queries without proper validation or escaping. Exploitation can lead to deletion of data from any database table and extraction of sensitive information such as password hashes.
The TI WooCommerce Wishlist WordPress plugin versions prior to 2.13.0 contain a vulnerability where unauthenticated visitors can manage wishlists belonging to other users if they know or guess the wishlist's share key. This allows unauthorized deletion of items from other customers' wishlists.
The WP Remote Users Sync WordPress plugin versions before 2.3.0 allow unrestricted writing of user metadata keys via incoming synchronization requests. This flaw enables a site with the shared synchronization keys to modify the capabilities of any existing user account, potentially escalating privileges to administrator.
An OS command injection vulnerability exists in Air Terminal 6 by SoftBank Corp. This flaw allows an authenticated user with access to the web management console to execute arbitrary commands with root privileges. The vulnerability has a high severity rating with a CVSS score of 8.0. No affected versions or patch information are currently provided.
The AskAny WordPress plugin versions before 2.2.1 have a vulnerability where the plugin does not verify that a chat session belongs to the requester before returning or modifying it. This flaw allows unauthenticated users who can obtain or guess another visitor's session identifier to access that visitor's chat transcript, personal details such as name, email address, and IP address, and to add or overwrite messages in the conversation.
The Oxygen MyData for WooCommerce WordPress plugin versions before 3.0.9 lack proper authorization and do not validate the authenticity of requests on a payment callback. This flaw allows unauthenticated users to mark arbitrary WooCommerce orders as completed.
Akaunting version 3.3.0 has a stored cross-site scripting (XSS) vulnerability in the custom invoice payment terms feature. An authenticated Manager can inject malicious JavaScript by saving a crafted payment-term value. This payload executes when an authorized user opens the Invoice Settings for the same company, leading to script execution in the victim's authenticated session.
The Mine CloudVod WordPress plugin versions before 2.6.6 have a vulnerability where the plugin does not verify that an order belongs to the requesting user before disclosing its payment status. This flaw allows any authenticated user, including those with subscriber-level access, to view other customers' order statuses, purchased items, and, during an Alipay payment process, the buyer's Alipay account identifier.
The Photo Gallery by 10Web WordPress plugin versions before 1.8.49 contains a vulnerability where a shortcode attribute that sets a gallery watermark image is not properly escaped before rendering into an HTML image attribute. This flaw allows users with Contributor-level access and above to perform Stored Cross-Site Scripting (XSS) attacks that execute in the browsers of any users viewing the published gallery, including administrators.
The Defender Security WordPress plugin versions before 6.4.1 do not limit the number of failed two-factor authentication attempts by default. This allows an attacker who already knows a user's password to brute-force the one-time authentication code, potentially bypassing the second factor of authentication.
The WP Directory Kit WordPress plugin versions before 1.6.3 contain a vulnerability where a parameter used to order results on an admin screen is not properly sanitized or escaped. This flaw allows users with the custom Listing Admin role or higher to perform SQL injection attacks by bypassing the plugin's keyword deny-list filtering.
A vulnerability in the synomount component of Synology DiskStation Manager (DSM) before versions 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files. This issue involves external control of system or configuration settings. The vulnerability has a medium severity with a CVSS score of 4.3 and does not impact confidentiality or availability but impacts integrity.
A vulnerability in Synology DiskStation Manager (DSM) before versions 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files due to improper neutralization of input during web page generation in the DSMNotify component.
A server-side request forgery (SSRF) vulnerability exists in the Credential API of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote authenticated users to read specific files on the affected system. The vulnerability has a medium severity rating with a CVSS score of 4.3. No public exploit or known active exploitation is reported. No patch links are provided in the data, and the vendor advisory status is not confirmed.