Threats affecting pkg:generic/radare2

The Pie Register WordPress plugin up to version 3.8.4.16 is vulnerable to stored cross-site scripting (XSS) via the 'first_name' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires public registration to be enabled and the registration form to include a Profile Picture field. An attacker can register with a crafted payload and then post a comment that triggers the script execution for all visitors of the affected page.

CVE-2026-83495 is a privilege escalation vulnerability in Red Hat OpenShift AI's Trainer v2 TrainJob API. It allows users with permission to create TrainJobs to inject valueFrom.secretKeyRef into environment variables, enabling them to read and exfiltrate secrets from the namespace. This occurs when TrainJob RBAC permissions are broader than Secret read permissions. The issue affects a Technology Preview feature and has low impact. Mitigation involves aligning TrainJob creation RBAC with Secret read permissions or restricting secretKeyRef usage via webhook allowlists.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Komfortkasse for WooCommerce WordPress plugin versions before 1.4.9. The plugin improperly validates REST API requests, bypassing WordPress's nonce verification. This flaw allows an attacker to forge requests in a logged-in administrator's browser to create a new administrator account, potentially leading to full site takeover.

The iLeads SMS Gateway by Exsile WordPress plugin before version 2.0.0 contains an improper privilege management vulnerability. Several AJAX actions that update site options do not verify user capabilities or nonces, allowing any authenticated user, including low-privileged roles like subscribers, to modify arbitrary WordPress options. This can lead to privilege escalation, such as enabling user registration with the administrator role as the default, effectively granting administrative access to unauthorized users.

The Event Tickets with Ticket Scanner WordPress plugin versions before 3.2.9 contain an SQL injection vulnerability in several admin listings. This flaw allows users with admin area access to inject malicious SQL code due to improper escaping of search values in SQL queries. The vulnerability is fixed in version 3.2.9.

A vulnerability in the Event Tickets with Ticket Scanner WordPress plugin before version 3.1.14 allows users with any role granted access to the plugin's admin area, including Subscribers, to view and remove other customers' ticket codes and names. This occurs because the plugin does not properly verify if a user is authorized to manage WooCommerce orders before returning or removing ticket data.

The Magic Link WordPress plugin versions before 2.2.6 contain an improper privilege management vulnerability. This flaw allows any authenticated user, including low-privileged subscribers, to generate a valid login link for an administrator account and gain unauthorized access. The issue is fixed in version 2.2.6.

A stored cross-site scripting (XSS) vulnerability exists in the Add From Server Lite WordPress plugin versions before 6.0.0. This flaw allows users with the Author role and above to upload SVG files containing JavaScript code, bypassing restrictions on unfiltered HTML. The vulnerability is fixed in version 6.0.0.

The Fiber Admin WordPress plugin versions before 4.0.1 lack authorization checks in certain AJAX actions. This flaw allows unauthenticated users to reorder arbitrary posts, including drafts, private posts, and navigation menu items, as well as taxonomy terms if term ordering is enabled. The issue is fixed in version 4.0.1.

CVE-2026-121491 is a code injection vulnerability in the Fiber Admin WordPress plugin versions 3.1.0 up to but not including 4.0.1. The flaw arises because the plugin does not validate or escape a request header before writing it into a PHP file during an unprotected admin hook. This allows unauthenticated attackers to execute arbitrary code if the plugin's custom database error page is enabled and they successfully race against an administrator saving settings.

The Tournamatch WordPress plugin versions prior to 4.7.1 allow unauthenticated users to access the team invitation listing, exposing the email addresses of invited users. This exposure of sensitive information can lead to privacy violations and potential targeted attacks against those users.

The Tournamatch WordPress plugin versions prior to 4.7.1 contain a vulnerability where the plugin does not properly validate or restrict file paths when deleting previously stored profile or team images. This flaw allows users with the Subscriber role to delete arbitrary files on the server, including critical files like wp-config.php, potentially leading to a full site takeover.

A stored cross-site scripting (XSS) vulnerability exists in the Live Composer WordPress plugin versions before 2.1.23. The flaw arises because a pagination setting supplied via post-listing module shortcodes is not properly escaped before being output in an HTML attribute. This allows users with Contributor role or higher to inject malicious scripts that persist and execute in other users' browsers.

A vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.11 allows any authenticated user to create payment-attempt records for orders that do not belong to them. This occurs because the plugin does not verify ownership of the order targeted by its checkout payment-retry REST action.

A vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.11 allows any authenticated user to access payment receipt details of orders they do not own. This includes sensitive information such as payment amounts, methods, statuses, and transaction IDs.

A vulnerability in the Directorist WordPress plugin before version 8.11 allows authenticated users with Subscriber-level access or higher to delete arbitrary media library attachments, including those uploaded by administrators. This occurs because the plugin does not verify ownership of attachment IDs when updating listing images.

A vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.11 allows an Administrator on a multisite network to perform email-verification bulk actions on users of other sites without proper authorization checks. This flaw enables an Administrator to lock out users, including the network Super Administrator, by forcing them to re-verify their email addresses.

A vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.11 allows any authenticated user to publish and feature another user's pending listing without ownership verification when the featured listing fee is zero.

A vulnerability in the Directorist WordPress plugin before version 8.11 allows authenticated users with Subscriber-level access or higher to access private and unpublished draft listing details of other users. This occurs because the plugin does not verify ownership of the listing before returning its metadata via an AJAX action.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the WP Google Review Slider WordPress plugin versions before 18.11. The plugin fails to perform nonce validation when updating its active Google Places configuration, which could allow an attacker to alter or destroy this configuration if they can trick a site administrator into clicking a crafted link.