Threats affecting pkg:generic/radare2

CVE-2026-16709 is a cross-site scripting (XSS) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary JavaScript in another user's browser session by injecting script content through improperly neutralized user input when a web page is updated.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 and 10.0.8.0 through 10.0.8.12 contain a path traversal vulnerability. This flaw allows a remote attacker with limited privileges to craft a URL request that can access files outside the intended directories on the system. The vulnerability could lead to unauthorized disclosure of arbitrary files.

CVE-2026-108178 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves an improperly implemented security check that can cause token validation to be incomplete, allowing a token to be accepted for unintended purposes.

CVE-2026-105459 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves improper verification of cryptographic signatures, where a token can be accepted without full signature validation. This flaw could allow an attacker to gain unauthorized access to an organization by joining it without a valid invitation.

CVE-2026-105002 is a high-severity code injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw allows arbitrary code execution by the management service when certain non-default configurations enable evaluation of customization content as code without proper restrictions.

The Redux Framework WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'content' parameter in all versions up to and including 4.5.16. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users access the affected pages. This vulnerability requires the site's theme to register a color_scheme field on user profiles, which exposes a nonce on the profile page accessible to subscribers.

The Affiliate Program Suite — SliceWP Affiliates WordPress plugin is affected by a SQL Injection vulnerability via the 'email' parameter in all versions up to and including 1.2.14. This flaw allows unauthenticated attackers to inject arbitrary SQL queries due to insufficient input escaping and lack of proper query preparation. The vulnerability is triggered during WooCommerce My Account registration through a guest-accessible nonce, enabling data extraction from the database without requiring authentication.

Tutor LMS plugin for WordPress up to version 4.1.2 has an authorization bypass vulnerability due to missing validation on a user-controlled key. Authenticated users with subscriber-level access and a valid API key can access paid course content without enrollment, retrieve quiz answers, and enumerate sensitive user information including instructors and administrators.

TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress versions up to 3.3.8 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. Exploitation requires that the attacker's comment is previously approved under WordPress's default moderation settings and that a secondary language is configured in TranslatePress.

The Redux Framework WordPress plugin up to version 4.5.16 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can export the entire Redux options panel configuration, including sensitive data such as API keys and credentials. This occurs because the plugin does not properly verify user authorization when exporting data. Exploitation requires a theme or plugin to register a Redux import_export field on a user profile, exposing a nonce in the subscriber's profile page source.

The Stop Spammers Classic WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in versions up to and including 2026.6. An unauthenticated attacker can submit a crafted 'author' POST parameter that is stored without proper escaping. This stored value is later rendered in the admin Log Report page inside a JavaScript string in a way that allows injection of arbitrary scripts. Exploitation requires an administrator with manage_options capability to click a specific 'Report to SFS' link, which only appears if the StopForumSpam API key is configured.

The Stackable – Page Builder Gutenberg Blocks WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in versions up to and including 3.19.9. This flaw exists in the 'update_block_style' endpoint due to insufficient input sanitization and output escaping. Authenticated users with contributor-level access or higher can exploit this to inject malicious scripts that execute when other users view the affected pages.

The Soledad WordPress theme by pencidesign contains a stored cross-site scripting (XSS) vulnerability in its Social Profile Fields. This affects all versions up to and including 8.7.7. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when any user visits the attacker's author archive page, which is publicly accessible even if the attacker has not published posts.

IBM Aspera Faspex versions 5.0.0 through 5.0.19 contain an authorization vulnerability that allows an authorized user to bypass normal user restrictions and gain full administrative privileges. This flaw is classified as CWE-863 (Incorrect Authorization) and has a critical severity rating with a CVSS score of 9.8.

The Jupiter X Core plugin for WordPress up to and including version 4.62.0 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to enumerate and render arbitrary published post types not intended for public viewing, including sensitive Flamingo CF7 submission records with personal data. Exploitation requires a specific widget configuration ('Is Archive Template' enabled) common in Jupiter X sites, and the nonce used for verification is ineffective as an authorization barrier.

The MotoPress Appointment Booking Lite plugin for WordPress versions up to and including 2.4.8 is vulnerable to a stored cross-site scripting (XSS) flaw via its public REST endpoint '/motopress/appointment/v1/customers/create'. This endpoint allows unauthenticated attackers to inject arbitrary scripts because the 'name' parameter is not sanitized before database insertion and not escaped on output in the admin bookings list. The vulnerability affects users with limited capabilities, such as the Appointment Employee role, enabling script execution when viewing injected pages.

The Social Slider Feed plugin for WordPress has a stored cross-site scripting (XSS) vulnerability in the 'slidespeed' parameter affecting all versions up to and including 2.3.8. Authenticated users with subscriber-level access or higher can exploit this flaw to inject malicious scripts that execute on any page embedding the affected feed shortcode. This occurs due to insufficient input sanitization and output escaping, combined with a missing permission check that allows subscribers to bypass capability restrictions and manipulate feed settings.

The payever WooCommerce Gateway plugin for WordPress versions up to and including 4.8.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload executable PHP files, leading to remote code execution. This is due to three WooCommerce-API callbacks lacking authentication and capability checks, combined with an insecure file upload routine that writes attacker-controlled files before validating their type. Additionally, an unauthenticated hard-coded credential identity overwrite issue exists independently.

The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter. This affects all versions up to and including 7.5.56.7212. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the 'Parse Vimeo and YouTube links' option to be enabled and that the injected comment is approved before execution occurs on pages viewed by site visitors.

The iubenda All-in-one Compliance plugin for WordPress versions up to and including 3.13.6 is vulnerable to a stored cross-site scripting (XSS) flaw. This vulnerability arises from improper handling of HTML comments inside IUB-COOKIE-BLOCK markers, allowing unauthenticated attackers to inject arbitrary scripts via moderated comments that execute when viewed by users after administrator approval.