Threats affecting pkg:generic/hunspell

NexoPOS versions through 6.3.0 have a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions. This occurs because the CashRegistersService does not verify that the user performing actions on a register session matches the session's assigned user. Attackers with the default permission nexopos.use.registers can submit requests to forcibly close sessions or alter cash balances via the API endpoint POST /api/cash-registers/{action}/{register}.

The Ultimate Member WordPress plugin up to version 2.14.0 is vulnerable to stored cross-site scripting (XSS) via the 'user_url' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected profile pages. Exploitation requires a visitor to click the injected Website URL link, which is enabled by default in new installations.

The AI Marketing Expert WordPress plugin (up to version 1.2.8) contains a stored DOM-based cross-site scripting (XSS) vulnerability in the 'name' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute in the context of administrators accessing the injected pages. Exploitation requires the chatbot module to be active with at least one configured bot. The attack involves storing the payload via unauthenticated REST calls, which is then delivered through the JavaScript widget's auto-polling mechanism.

The All-in-One Video Gallery plugin for WordPress, up to and including version 4.9.7, contains a stored cross-site scripting (XSS) vulnerability via the 'more_link' parameter. This flaw allows authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.

nopCommerce versions before 5.00.0 have a missing authorization vulnerability in the admin ProductController handlers RelatedProductAddPopup, CrossSellProductAddPopup, and AssociatedProductAddPopup. This flaw allows authenticated vendors to submit another vendor's product ID to inject their products into the victim's related, cross-sell, and grouped product listings.

The affiliate-toolkit WordPress plugin (up to version 3.9.2) is vulnerable to stored cross-site scripting (XSS) via the 'atkp_product_producturl' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Exploitation requires the plugin's AJAX loading or AJAX handler feature to be enabled, or contributor-level access if these features are disabled by default.

GROWI has an authorization bypass vulnerability in its tag update and page update APIs. This flaw arises from improper use of a user-controlled key, allowing authenticated attackers to access page contents without proper read permissions and save them to pages they can edit.

GROWI has an authorization bypass vulnerability affecting its page viewing and commenting features. This flaw arises from improper use of a user-controlled key, allowing authenticated attackers to access page contents and comments without proper read permissions. The vulnerability has a medium severity rating with a CVSS score of 4.2.

CVE-2026-118272 is a medium severity vulnerability in a2ui-project a2ui up to version 0.10.6. It affects the DataContext.dispatchExpressionError function in the Error Handler component, allowing remote attackers to cause information exposure through error messages. Public exploit code is available. A patch identified by commit 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01 addresses the issue.

The Jupiter X Core plugin for WordPress contains an authentication bypass vulnerability in its Twitter/X social login handler affecting all versions up to and including 4.61.0. The flaw arises because the plugin fails to update the OAuth token after exchanging the oauth_verifier, causing it to authenticate users based on the site administrator's Twitter credentials rather than the visitor's. This allows unauthenticated attackers to gain authenticated access as the WordPress user linked to the Twitter app owner's email, typically the site administrator.

A resource consumption vulnerability exists in a2ui-project a2ui up to version 0.10.6 in the data-context Resolver component. The issue affects the file renderers/web_core/src/v0_9/rendering/data-context.ts and can be exploited remotely without user interaction. The vulnerability has a medium severity with a CVSS score of 4.3 and has been publicly disclosed. A patch identified by commit eb314e14fabd29cfb4a74e1202afc4fe2081efa2 is available to address this issue.

A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as c76e17272e52c12c6dcf68905b1df978c39e9aa5. It is advisable to implement a patch to correct this issue.

CVE-2026-118384 is a vulnerability in GNU mtools up to version 4.0.49 involving an out-of-bounds write in the parse_vses function within the vfat.c source file. This flaw is due to a numeric range comparison without a minimum check (CWE-839). The vulnerability has a CVSS 3.1 base score of 6.1, indicating a medium severity level. It requires local access with low complexity and no privileges but user interaction is needed. The impact includes integrity loss and high availability impact, but no confidentiality impact is reported.

CVE-2026-118274 is a medium severity vulnerability in the a2ui-project a2ui component up to version 0.10.6. It affects an unknown functionality within the Binder component's generic-binder.ts file, leading to resource consumption. The vulnerability can be exploited remotely without user interaction and requires low privileges. A patch identified by commit c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e is available to fix the issue.

CVE-2026-118273 is a medium severity vulnerability in a2ui-project's a2ui component up to version 0.10.6. The flaw exists in the DataModel.set function of the file renderers/web_core/src/v0_9/state/data-model.ts and can be exploited remotely to cause resource consumption. Exploit code has been published. A patch identified by commit 82789191ce551f4d7a095d273773fb24bd764c9d is available to remediate this issue.

The AI Engine – MCP Server & AI Chatbot for WordPress plugin (versions up to and including 3.8.4) contains a path traversal vulnerability in the upload_file function. Authenticated users with subscriber-level access or higher can exploit this flaw to delete arbitrary media files on the server. Exploitation requires the Public API option to be enabled by an administrator and depends on the hourly cleanup_files task running after a malicious upload. The vulnerability has a medium severity rating with a CVSS score of 4.2.

The All-in-One Video Gallery plugin for WordPress versions up to 4.9.7 contains a stored cross-site scripting (XSS) vulnerability via the 'custom_fields[embedcode]' parameter. Authenticated users with subscriber-level access or higher can exploit this flaw by injecting malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, combined with a logic flaw in the save_meta_data() handler and overly permissive capabilities granted to subscribers. A patch is available to address this issue.