Threats affecting pkg:generic/lucene

A reflected Cross-Site Scripting (XSS) vulnerability exists in the Knowledge Building WordPress plugin versions before 0.7.3. The flaw arises because several user-supplied values are not properly escaped before being echoed back in the response of an AJAX action accessible to unauthenticated users, with the response served as HTML. This allows an attacker to inject malicious scripts that could execute in the context of users viewing the affected content.

The Knowledge Building WordPress plugin versions before 0.7.3 contain a stored cross-site scripting (XSS) vulnerability in the reply comment feature. This flaw allows unauthenticated users to submit comments that are not sanitized or escaped and are published without moderation. As a result, attackers can execute stored XSS attacks against any visitor of the affected posts, including administrators. The vulnerability is fixed in version 0.7.3.

AskAny WordPress plugin versions before 2.2.0 allow unauthenticated users to upload files with dangerous types, such as PHP, due to lack of proper validation of file extensions or content. This vulnerability enables arbitrary code execution when visitor attachments are enabled. The issue is fixed in version 2.2.0.

AutomatorWP WordPress plugin versions before 6.0.8 contain a Cross-Site Request Forgery (CSRF) vulnerability in its Zoom and AWeber integration connections. This flaw allows an attacker to trick a logged-in administrator into replacing stored integration credentials with the attacker's own, redirecting data sent to these services to the attacker's account. Exploitation requires the integration to be connected and knowledge of the site's OAuth client identifier. The issue is fixed in version 6.0.8.

A cross-site scripting (XSS) vulnerability exists in the Live Composer WordPress plugin versions before 2.1.24. This flaw allows users with Contributor role or higher to inject malicious scripts via certain shortcode attributes, which are not properly escaped before being output inside HTML tag attributes. The payload executes in the browsers of anyone viewing the affected post, including administrators reviewing submissions.

A path traversal vulnerability (CWE-22) exists in the Gravity Forms WordPress plugin versions before 3.2.2. This flaw allows unauthenticated users to upload files without proper file type restrictions via the chunked file upload feature. On servers configured to parse Server-Side Include (SSI) documents, such as Apache with SSI enabled, attackers can read server environment variables and files within the web root.

NotificationX WordPress plugin versions before 3.3.7 contain a missing authorization vulnerability in one of its REST routes. This flaw allows unauthenticated users to update plugin options and repeatedly trigger emails sent through the site's mail server.

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Schema & Structured Data for WP & AMP WordPress plugin versions before 1.70. This occurs when the Pretty Print option is enabled and the plugin does not safely encode structured data output, allowing users with Contributor role privileges to inject malicious scripts via custom fields mapped to schema properties.

The Schema & Structured Data for WP & AMP WordPress plugin before version 1.70 has a vulnerability that allows unauthenticated attackers to access approved comments on private, draft, and password-protected posts. This occurs because the plugin does not verify if a post is publicly viewable before returning its approved comments via the review feature. The issue affects all versions from 0 up to but not including 1.70.

The Schema & Structured Data for WP & AMP WordPress plugin before version 1.70 contains an authorization bypass vulnerability. This flaw allows users with the Contributor role or higher, who have been granted access to the plugin, to modify structured data settings of posts they do not own. The vulnerability arises because the plugin does not verify whether a user has permission to edit a post before allowing changes to its structured data. This issue is fixed in version 1.70.

A missing authorization vulnerability in the Schema & Structured Data for WP & AMP WordPress plugin before version 1.70 allows users with access to the plugin's settings to modify, re-author, unpublish, or trash any post or page on the site and write arbitrary post meta. This occurs because the plugin does not verify that the importing user has permission to edit the posts named in a settings backup, nor does it restrict the import to its own post types.

A Server-Side Request Forgery (SSRF) vulnerability exists in the Limit Login Attempts Security WordPress plugin versions before 3.4.2. This flaw allows users with administrator privileges to cause the site to make HTTP requests to arbitrary hosts, including internal network addresses, due to improper validation of a user-supplied setup value.

A SQL injection vulnerability exists in the WP Directory Kit WordPress plugin versions before 1.6.3. This flaw arises because the plugin does not properly sanitize and escape a parameter used in a SQL statement. Users with the custom Listing Admin role or higher can exploit this to perform SQL injection attacks. The issue is fixed in version 1.6.3.

WP Directory Kit versions before 1.6.3 contain a vulnerability that allows unauthenticated attackers to access sensitive user information. The plugin's public directory-search action does not restrict which database models and columns it returns, nor does it verify authorization. This flaw exposes personal data such as email addresses, logins, and private contact-form submissions to unauthorized actors.

CVE-2026-118241 is an authorization bypass vulnerability in the Smush WordPress plugin versions before 4.3.6. The plugin fails to verify that a user is authorized to act on a targeted media attachment, only checking a broad upload-files capability. This allows users with the Author role and above to optimize and restore media attachments owned by other users, potentially altering files on disk and consuming stored backups.

A vulnerability in the Contest Gallery WordPress plugin before version 34.0.3 allows authenticated users with Author-level access or higher to upload files with arbitrary names and extensions via the e-commerce sale file-replacement feature. This lack of sanitization enables overwriting of directory protection files, potentially leading to remote code execution.

The Dynific Addons for Elementor WordPress plugin before version 1.3.1 has a vulnerability that allows authenticated users with Contributor role or higher to access draft, private, and password-protected posts of other users without proper authorization. Additionally, users with Author role can republish this content to anonymous visitors. This issue arises from missing status or capability checks when resolving post identifiers in a shortcode.

A vulnerability in Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before version 1.3.1 allows any authenticated user, including those with minimal privileges such as Subscribers, to enable or disable plugin modules site-wide due to missing capability and nonce checks on an AJAX action that saves module configuration.

A stored cross-site scripting (XSS) vulnerability exists in the Dynific Addons for Elementor WordPress plugin before version 1.3.1. The flaw allows authenticated users with the Author role to publish posts with titles that execute malicious scripts in the browsers of users who view them, including administrators.

A stored cross-site scripting (XSS) vulnerability exists in the Dynific Addons for Elementor WordPress plugin versions before 1.3.1. Authenticated users with the Author role can inject malicious scripts via a user-controlled profile value that is not properly escaped before output in an Elementor widget. This payload executes in the browser session of anyone viewing the attacker's post, including administrators.