Threats affecting pkg:generic/opencv

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Komfortkasse for WooCommerce WordPress plugin versions before 1.4.9. The plugin improperly validates REST API requests, bypassing WordPress's nonce verification. This flaw allows an attacker to forge requests in a logged-in administrator's browser to create a new administrator account, potentially leading to full site takeover.

The iLeads SMS Gateway by Exsile WordPress plugin before version 2.0.0 contains an improper privilege management vulnerability. Several AJAX actions that update site options do not verify user capabilities or nonces, allowing any authenticated user, including low-privileged roles like subscribers, to modify arbitrary WordPress options. This can lead to privilege escalation, such as enabling user registration with the administrator role as the default, effectively granting administrative access to unauthorized users.

The Event Tickets with Ticket Scanner WordPress plugin versions before 3.2.9 contain an SQL injection vulnerability in several admin listings. This flaw allows users with admin area access to inject malicious SQL code due to improper escaping of search values in SQL queries. The vulnerability is fixed in version 3.2.9.

A vulnerability in the Event Tickets with Ticket Scanner WordPress plugin before version 3.1.14 allows users with any role granted access to the plugin's admin area, including Subscribers, to view and remove other customers' ticket codes and names. This occurs because the plugin does not properly verify if a user is authorized to manage WooCommerce orders before returning or removing ticket data.

The Magic Link WordPress plugin versions before 2.2.6 contain an improper privilege management vulnerability. This flaw allows any authenticated user, including low-privileged subscribers, to generate a valid login link for an administrator account and gain unauthorized access. The issue is fixed in version 2.2.6.

A stored cross-site scripting (XSS) vulnerability exists in the Add From Server Lite WordPress plugin versions before 6.0.0. This flaw allows users with the Author role and above to upload SVG files containing JavaScript code, bypassing restrictions on unfiltered HTML. The vulnerability is fixed in version 6.0.0.

The Fiber Admin WordPress plugin versions before 4.0.1 lack authorization checks in certain AJAX actions. This flaw allows unauthenticated users to reorder arbitrary posts, including drafts, private posts, and navigation menu items, as well as taxonomy terms if term ordering is enabled. The issue is fixed in version 4.0.1.

CVE-2026-121491 is a code injection vulnerability in the Fiber Admin WordPress plugin versions 3.1.0 up to but not including 4.0.1. The flaw arises because the plugin does not validate or escape a request header before writing it into a PHP file during an unprotected admin hook. This allows unauthenticated attackers to execute arbitrary code if the plugin's custom database error page is enabled and they successfully race against an administrator saving settings.

The Tournamatch WordPress plugin versions prior to 4.7.1 allow unauthenticated users to access the team invitation listing, exposing the email addresses of invited users. This exposure of sensitive information can lead to privacy violations and potential targeted attacks against those users.

The Tournamatch WordPress plugin versions prior to 4.7.1 contain a vulnerability where the plugin does not properly validate or restrict file paths when deleting previously stored profile or team images. This flaw allows users with the Subscriber role to delete arbitrary files on the server, including critical files like wp-config.php, potentially leading to a full site takeover.

A stored cross-site scripting (XSS) vulnerability exists in the Live Composer WordPress plugin versions before 2.1.23. The flaw arises because a pagination setting supplied via post-listing module shortcodes is not properly escaped before being output in an HTML attribute. This allows users with Contributor role or higher to inject malicious scripts that persist and execute in other users' browsers.

A vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.11 allows any authenticated user to create payment-attempt records for orders that do not belong to them. This occurs because the plugin does not verify ownership of the order targeted by its checkout payment-retry REST action.

A vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.11 allows any authenticated user to access payment receipt details of orders they do not own. This includes sensitive information such as payment amounts, methods, statuses, and transaction IDs.

A vulnerability in the Directorist WordPress plugin before version 8.11 allows authenticated users with Subscriber-level access or higher to delete arbitrary media library attachments, including those uploaded by administrators. This occurs because the plugin does not verify ownership of attachment IDs when updating listing images.

A vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.11 allows an Administrator on a multisite network to perform email-verification bulk actions on users of other sites without proper authorization checks. This flaw enables an Administrator to lock out users, including the network Super Administrator, by forcing them to re-verify their email addresses.

A vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.11 allows any authenticated user to publish and feature another user's pending listing without ownership verification when the featured listing fee is zero.

A vulnerability in the Directorist WordPress plugin before version 8.11 allows authenticated users with Subscriber-level access or higher to access private and unpublished draft listing details of other users. This occurs because the plugin does not verify ownership of the listing before returning its metadata via an AJAX action.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the WP Google Review Slider WordPress plugin versions before 18.11. The plugin fails to perform nonce validation when updating its active Google Places configuration, which could allow an attacker to alter or destroy this configuration if they can trick a site administrator into clicking a crafted link.

A stored cross-site scripting (XSS) vulnerability exists in the FV Flowplayer Video Player WordPress plugin before version 7.5.57.7212. The flaw occurs because shortcode attribute values embedded in comments are not escaped before rendering into the media player markup. This allows an unauthenticated visitor to inject a script payload into a comment that executes in the session of any visitor, including administrators, who plays the commented video when the non-default comment-shortcode-parsing setting is enabled.

A stored cross-site scripting (XSS) vulnerability exists in the Live Composer WordPress plugin versions before 2.1.23. The plugin fails to properly sanitize and escape certain custom post type slug settings before using them in front-end links. This flaw allows high privilege users, such as administrators, to inject malicious scripts even when the unfiltered_html capability is disabled, for example in multisite WordPress setups.