A missing authorization vulnerability in the weDevs WP ERP plugin (up to version 1.17.10) allows exploitation of incorrectly configured access control security levels. This flaw could permit users with limited privileges to access certain functionality or data without proper authorization. The vulnerability has a CVSS score of 4.3, indicating a medium severity impact primarily affecting confidentiality. No public exploits or patches are currently documented.
A stored cross-site scripting (XSS) vulnerability exists in weDevs Happy Addons for Elementor up to version 3.50.1. This vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact with potential confidentiality, integrity, and availability consequences. No patch or fix information is currently provided.
A stored cross-site scripting (XSS) vulnerability exists in bPlugins Flash & HTML5 Video html5-video-player up to version 2.14.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a medium severity with a CVSS score of 6.5.
A stored cross-site scripting (XSS) vulnerability exists in the Gutenberg Blocks by Kadence Blocks plugin for WordPress, affecting versions up to 3.8.0.2. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of affected users. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
A missing authorization vulnerability exists in the ThemeGrill User Registration plugin up to version 5.3.0. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability does not impact confidentiality or availability but can affect the integrity of the system.
A missing authorization vulnerability exists in WP User Manager up to version 2.9.26. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized information disclosure. The vulnerability has a CVSS score of 5.3, indicating a medium severity impact with low complexity and no required privileges or user interaction.
A missing authorization vulnerability exists in Webba Plugins Webba Booking (webba-booking-lite) up to version 6.5.4. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 4.3.
A missing authorization vulnerability exists in WPFunnels up to version 3.13.5, allowing exploitation of incorrectly configured access control security levels. This flaw does not require privileges or user interaction and impacts integrity without affecting confidentiality or availability.
A missing authorization vulnerability exists in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce up to version 2.3.24. This flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized modification of data or settings. The vulnerability has a medium severity rating with a CVSS score of 5.3. No public exploits or patches are currently documented.
A missing authorization vulnerability exists in WPFunnels up to version 3.13.5, allowing exploitation of incorrectly configured access control security levels. This flaw does not impact confidentiality or availability but can lead to integrity issues. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A stored cross-site scripting (XSS) vulnerability exists in bPlugins StreamCast through version 2.4.6 due to improper neutralization of input during web page generation. This vulnerability allows an attacker with low privileges to inject malicious scripts that can be executed in the context of other users. The flaw impacts confidentiality, integrity, and availability to a limited extent. No patch information is currently provided.
Elastic Cloud Enterprise (ECE) suffers from an improper link resolution vulnerability (CWE-59) that allows unauthorized read and write access to data of other deployments on the same host via a symlink attack. This vulnerability can lead to significant confidentiality, integrity, and availability impacts.
A missing authorization vulnerability exists in Brainstorm Force SureForms plugin versions up to 2.12.9. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions that impact the integrity of the system. The vulnerability does not affect confidentiality or availability but can cause integrity issues.
CVE-2026-115712 is an authorization vulnerability in Elastic Cloud Enterprise (ECE) where an authenticated user with read-only access can improperly modify platform-level settings. This occurs due to insufficient access control enforcement, allowing changes that should be restricted to platform administrators only.
Elastic Cloud Enterprise (ECE) has a vulnerability where sensitive information, including role tokens, is stored in files or directories accessible to lower-privileged platform components. This can allow an attacker with internal access to retrieve these secrets and potentially add unauthorized hosts with elevated roles. The vulnerability is identified as CWE-538 and has a CVSS score of 6.4, indicating a medium severity.
A missing authorization vulnerability exists in WP Desk Custom Price for WooCommerce (custom-price-for-woocommerce) versions up to 1.1.29. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized modifications. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A stored cross-site scripting (XSS) vulnerability exists in the Strong Testimonials plugin by WP Chill, affecting versions up to 3.3.15. This vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to execute malicious scripts in the context of another user. The vulnerability has a medium severity rating with a CVSS score of 6.5.
A vulnerability in Elastic Cloud Enterprise (ECE) involves insertion of sensitive information into an externally-accessible file or directory. After the ECE certificate rotation procedure, sensitive platform credentials and certificate authority private keys are retained in data accessible by lower-privileged components. An attacker with control over any host in the installation can leverage this to escalate privileges and gain full control of the ECE control plane and managed deployments.
Elastic Cloud Enterprise (ECE) suffers from an improper link resolution vulnerability (CWE-59) that can allow an attacker with high privileges on the host to bypass authentication and make unauthorized configuration changes to other deployments on the same host by exploiting symbolic link (symlink) attacks.
A vulnerability identified as Improper Link Resolution Before File Access (CWE-59) exists in Elastic Cloud Enterprise (ECE). This flaw can allow unauthorized disclosure and loss of data from other deployments on the same host through a symlink attack. The vulnerability has a high severity score of 8.2 CVSS v3.1, indicating significant confidentiality, integrity, and availability impacts. No specific affected versions or patch information are provided.