The Soledad WordPress theme up to version 8.7.7 contains a stored cross-site scripting (XSS) vulnerability in its social profile fields. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when any user visits the attacker's author archive page. This vulnerability arises from insufficient input sanitization and output escaping, exposing the injected payload publicly regardless of post publication status.
The Directorist WordPress plugin before version 8.11 has a vulnerability where it does not verify ownership of a listing before processing a featured-listing checkout. This allows any authenticated user, including subscribers, to publish and feature another user's pending listing if the featured listing fee is zero.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization vulnerability that allows low-privileged users to query arbitrary indices and access sensitive data. This issue arises from missing authorization checks in the affected versions.
A vulnerability in The Directorist WordPress plugin before version 8.11 allows authenticated users with Subscriber-level access or higher to access private and unpublished draft listing details of other users via an AJAX action. This occurs because the plugin does not verify ownership of the listing before returning its metadata, potentially exposing sensitive contact information.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that allows an authenticated attacker to send unauthorized requests from the system. This vulnerability could enable attackers to enumerate internal network resources or facilitate further attacks.
The Live Composer WordPress plugin versions before 2.1.23 contain a vulnerability where certain custom post type slug settings are not properly sanitized and escaped before being used in front-end links. This flaw allows high privilege users, such as administrators, to perform stored cross-site scripting (XSS) attacks even if the unfiltered_html capability is disabled, such as in multisite WordPress setups.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that allows a remote attacker to bypass protections blocking requests to internal network addresses. This flaw enables the attacker to make the server contact internal services and retrieve partial responses, potentially exposing sensitive information.
The Tutor LMS WordPress plugin up to version 4.1.2 contains an Insecure Direct Object Reference (IDOR) vulnerability in the init_routes function. Authenticated users with subscriber-level access or higher who possess a valid Tutor LMS API key/secret can exploit this flaw to access paid course content without enrollment, retrieve quiz answer keys, and enumerate sensitive user information including email addresses, usernames, and registration data of instructors and administrators.
A vulnerability in The Directorist WordPress plugin before version 8.11 allows any authenticated user to access payment receipt information of other users' orders. This includes sensitive details such as payment amounts, methods, status, and transaction IDs.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 use weaker than expected cryptographic algorithms. This weakness could allow an attacker to decrypt highly sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.9.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 contain a vulnerability where a hard-coded cryptographic key is used to protect stored credentials. An attacker with access to the stored data could decrypt sensitive credentials by exploiting this hard-coded key.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where the backup server's identity is not properly verified during the establishment of secure connections for analytics backups. This flaw could allow a network-positioned attacker to intercept backup data and potentially credentials if used.
A vulnerability in The Directorist WordPress plugin before version 8.11 allows an administrator of one site in a multisite network to perform email-verification bulk actions on users of other sites without proper permission checks. This can result in locking out users, including the network Super Administrator, until they re-verify their email addresses.
The Stackable – Page Builder Gutenberg Blocks plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'update_block_style' endpoint. This affects all versions up to and including 3.19.9. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages.
The WP Google Review Slider WordPress plugin versions prior to 18.11 lack nonce validation when updating the active Google Places configuration. This flaw allows attackers to modify or destroy the configuration by tricking a site administrator into clicking a crafted link.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization vulnerability where tenant context verification is insufficient. This flaw allows an authenticated attacker to potentially access resources belonging to other tenants without proper authorization.
A cross-site scripting (XSS) vulnerability exists in the FV Flowplayer Video Player WordPress plugin before version 7.5.57.7212. The plugin fails to escape shortcode attribute values embedded in comments when rendering them into the media player markup. This allows unauthenticated visitors to store malicious script payloads in comments that execute in the context of any visitor who plays the commented video, including administrators, if the non-default comment-shortcode-parsing setting is enabled.
The Directorist WordPress plugin versions before 8.11 contain a vulnerability where the plugin does not verify ownership of attachment IDs when updating listing images. This flaw allows authenticated users with Subscriber-level access or higher to permanently delete arbitrary media library attachments, including those uploaded by administrators, along with their associated files.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an authorization vulnerability. A remote authenticated attacker could exploit improper authorization checks on request URL values to access sensitive information belonging to other users. This vulnerability does not impact integrity or availability but can lead to unauthorized information disclosure.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a critical vulnerability that allows remote attackers to execute arbitrary code. This is due to improper neutralization of special elements in operating system commands, leading to command injection risks.