Threats affecting pkg:generic/arrow

CVE-2026-124965 is a stored cross-site scripting (XSS) vulnerability in rtCamp Inc.'s rtMedia plugin for WordPress, BuddyPress, and bbPress. It affects versions up to and including 4.7.16. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that can execute in users' browsers. The CVSS score is 6.5, indicating a medium severity level.

A weakness in the password recovery mechanism of the RelyWP reCAPTCHA for WooCommerce plugin (up to version 1.4.7) allows exploitation of the password recovery process. This vulnerability does not impact confidentiality or availability but can lead to integrity issues. It has a medium severity score of 5.3 (CVSS 3.1). No patch or remediation information is currently provided.

A missing authorization vulnerability exists in VillaTheme CURCY woo-multi-currency plugin versions up to 2.2.21. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of data or settings. The vulnerability has a medium severity rating with a CVSS score of 5.3.

A reflected Cross-site Scripting (XSS) vulnerability exists in the Custom Post Types and Custom Fields creator – WCK plugin, affecting versions up to 2.4.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute arbitrary scripts in the context of the affected web application.

An SQL Injection vulnerability exists in Alejandro Alex Reservations (alex-reservations) affecting versions up to 2.4.8. This flaw allows an attacker to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. The vulnerability has a high severity score of 9.3 and can lead to significant confidentiality and availability impacts.

A stored Cross-site Scripting (XSS) vulnerability exists in the wpLingua Translation Service plugin for WordPress, affecting versions up to 3.1.1. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts that execute in the context of users' browsers.

A reflected Cross-site Scripting (XSS) vulnerability exists in the Dimitri Grassi Salon booking system up to version 10.31.14. This vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that execute in the context of a victim's browser. The vulnerability has a high severity score of 7.1 (CVSS 3.1) and impacts confidentiality, integrity, and availability.

A missing authorization vulnerability exists in Andy Moyle Church Admin (church-admin) versions up to 5.1.8. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to denial of service. The vulnerability does not impact confidentiality or integrity but can affect availability.

A Missing Authorization vulnerability exists in Noor Alam Gmail SMTP (versions up to 1.2.3.23) that allows exploitation due to incorrectly configured access control security levels. This flaw permits unauthorized network attackers to access sensitive data without authentication, impacting confidentiality but not integrity or availability.

A weak authentication vulnerability exists in VideoWhisper.com Broadcast Live Video (videowhisper-live-streaming-integration) up to version 7.3.15. This flaw allows authentication abuse, potentially enabling unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 5.3.

A Cross-Site Scripting (XSS) vulnerability exists in the s2Member plugin by Cristián Lávaque due to improper neutralization of script-related HTML tags. This vulnerability allows an attacker to inject code into web pages. It affects s2Member versions up to 261106. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality only.

A critical SQL Injection vulnerability (CVE-2026-124970) exists in WP BASE Booking plugin versions up to 6.5.2. This vulnerability allows an unauthenticated attacker to perform blind SQL injection, potentially leading to high confidentiality impact and partial denial of service. No patch information is currently available.

A reflected Cross-site Scripting (XSS) vulnerability exists in Themeisle Woody ad snippets insert-php up to version 2.7.10. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in a victim's browser. The vulnerability has a high severity rating with a CVSS score of 7.1.

A reflected cross-site scripting (XSS) vulnerability exists in Denishua WPJAM Basic plugin versions up to 7.1.2. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in users' browsers. The vulnerability has a high severity rating with a CVSS score of 7.1.

A stored cross-site scripting (XSS) vulnerability exists in Ahmad WP Job Portal (wp-job-portal) versions up to and including 2.7.2. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers with low privileges and requiring user interaction to execute malicious scripts in the context of affected users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity.

A Blind SQL Injection vulnerability exists in Tribulant Software Newsletters (newsletters-lite) affecting versions up to 4.18.1. This flaw allows an attacker with low privileges to execute crafted SQL commands that can cause partial data disclosure and limited denial of service.

Grid Community Toolkit versions before 6.2.20261111 (and globus-gss-assist before 12.9) contain a heap out-of-bounds write vulnerability in the function globus_gss_assist_token_get_fd(). This flaw is triggered by SSLv2 record lengths below 3. Remote unauthenticated attackers can exploit this by sending crafted GSI handshake records to services such as globus-gatekeeper and myproxy, causing heap memory corruption and service crashes.

A deserialization of untrusted data vulnerability exists in Tribulant Software Newsletters (newsletters-lite) up to version 4.18.2. This flaw allows object injection, which can lead to high-impact consequences including confidentiality, integrity, and availability compromise.

CVE-2026-124260 is a reflected Cross-site Scripting (XSS) vulnerability in the WP Photo Album Plus plugin for WordPress. It affects versions up to and including 9.3.06.001. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of the victim's browser.

Dell PowerStore contains an integer overflow vulnerability that can be exploited by an adjacent attacker to bypass volume bounds checks. This vulnerability may lead to data destruction or denial of service conditions. The flaw is identified as CVE-2026-107523 and has a high severity rating with a CVSS score of 8.7.