Threats affecting pkg:generic/radare2

The Fiber Admin WordPress plugin versions before 4.0.1 lack authorization checks in certain AJAX actions. This flaw allows unauthenticated users to reorder arbitrary posts, including drafts, private posts, and navigation menu items, as well as taxonomy terms if term ordering is enabled. The issue is fixed in version 4.0.1.

CVE-2026-121491 is a code injection vulnerability in the Fiber Admin WordPress plugin versions 3.1.0 up to but not including 4.0.1. The flaw arises because the plugin does not validate or escape a request header before writing it into a PHP file during an unprotected admin hook. This allows unauthenticated attackers to execute arbitrary code if the plugin's custom database error page is enabled and they successfully race against an administrator saving settings.

The Tournamatch WordPress plugin versions prior to 4.7.1 allow unauthenticated users to access the team invitation listing, exposing the email addresses of invited users. This exposure of sensitive information can lead to privacy violations and potential targeted attacks against those users.

The Tournamatch WordPress plugin versions prior to 4.7.1 contain a vulnerability where the plugin does not properly validate or restrict file paths when deleting previously stored profile or team images. This flaw allows users with the Subscriber role to delete arbitrary files on the server, including critical files like wp-config.php, potentially leading to a full site takeover.

A stored cross-site scripting (XSS) vulnerability exists in the Live Composer WordPress plugin versions before 2.1.23. The flaw arises because a pagination setting supplied via post-listing module shortcodes is not properly escaped before being output in an HTML attribute. This allows users with Contributor role or higher to inject malicious scripts that persist and execute in other users' browsers.

A vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.11 allows any authenticated user to create payment-attempt records for orders that do not belong to them. This occurs because the plugin does not verify ownership of the order targeted by its checkout payment-retry REST action.

A vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.11 allows any authenticated user to access payment receipt details of orders they do not own. This includes sensitive information such as payment amounts, methods, statuses, and transaction IDs.

A vulnerability in the Directorist WordPress plugin before version 8.11 allows authenticated users with Subscriber-level access or higher to delete arbitrary media library attachments, including those uploaded by administrators. This occurs because the plugin does not verify ownership of attachment IDs when updating listing images.

A vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.11 allows an Administrator on a multisite network to perform email-verification bulk actions on users of other sites without proper authorization checks. This flaw enables an Administrator to lock out users, including the network Super Administrator, by forcing them to re-verify their email addresses.

A vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.11 allows any authenticated user to publish and feature another user's pending listing without ownership verification when the featured listing fee is zero.

A vulnerability in the Directorist WordPress plugin before version 8.11 allows authenticated users with Subscriber-level access or higher to access private and unpublished draft listing details of other users. This occurs because the plugin does not verify ownership of the listing before returning its metadata via an AJAX action.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the WP Google Review Slider WordPress plugin versions before 18.11. The plugin fails to perform nonce validation when updating its active Google Places configuration, which could allow an attacker to alter or destroy this configuration if they can trick a site administrator into clicking a crafted link.

A stored cross-site scripting (XSS) vulnerability exists in the FV Flowplayer Video Player WordPress plugin before version 7.5.57.7212. The flaw occurs because shortcode attribute values embedded in comments are not escaped before rendering into the media player markup. This allows an unauthenticated visitor to inject a script payload into a comment that executes in the session of any visitor, including administrators, who plays the commented video when the non-default comment-shortcode-parsing setting is enabled.

A stored cross-site scripting (XSS) vulnerability exists in the Live Composer WordPress plugin versions before 2.1.23. The plugin fails to properly sanitize and escape certain custom post type slug settings before using them in front-end links. This flaw allows high privilege users, such as administrators, to inject malicious scripts even when the unfiltered_html capability is disabled, for example in multisite WordPress setups.

A vulnerability in the Advanced Custom Fields (ACF®) WordPress plugin before version 6.8.11 allows users with contributor-level access and above to write custom fields restricted to administrators onto their own posts. This occurs because the plugin does not re-apply its field-group location rules when saving values submitted through the post editor save path.

A vulnerability in the Advanced Custom Fields (ACF®) WordPress plugin before version 6.8.11 allows users with contributor-level access and above to bypass authorization checks during bidirectional relationship synchronization. This flaw permits such users to add or remove references to their own objects on posts, users, or terms they normally cannot edit.

A vulnerability in the Advanced Custom Fields (ACF®) WordPress plugin before version 6.8.11 allows users with post-editing permissions (Contributor and above) to access titles and non-public statuses of other users' unpublished posts due to missing read-permission checks on relational fields.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability involving inefficient regular expression complexity that can lead to a Regular Expression Denial of Service (ReDoS) attack. Additionally, these versions suffer from improper neutralization of wildcard query operators. This vulnerability has a critical severity rating with a CVSS score of 9.6.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 contain a vulnerability where a hard-coded cryptographic key is used to protect stored credentials. An attacker with access to the stored data could decrypt sensitive credentials by exploiting this hard-coded key. This vulnerability does not require user interaction or privileges but has a high impact on confidentiality.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 use a cryptographically weak pseudo-random number generator (PRNG), which could allow a local attacker to obtain sensitive information. This vulnerability is identified as CWE-338 and has a medium severity rating with a CVSS score of 5.1.