Threats affecting pkg:generic/zxc

A SQL injection vulnerability exists in the WP Ultimate CSV Importer WordPress plugin before version 9.3. This flaw occurs because values from imported files are not properly escaped before being used in SQL queries when importing LifterLMS content. The vulnerability allows high privilege users, such as administrators on single or multisite WordPress installations, to perform SQL injection attacks.

A vulnerability in WP Ultimate CSV Importer WordPress plugin versions before 9.2 and WP Ultimate CSV Importer Pro before 9.0.7 allows unauthenticated attackers to download exported post data. The plugins do not protect files created by their single post export feature, storing them in publicly accessible locations with predictable filenames. This exposure includes content and custom fields of any exported post, including non-public posts.

A stored cross-site scripting (XSS) vulnerability exists in the Lightbox with PhotoSwipe WordPress plugin before version 5.19.0. The plugin fails to properly sanitize link titles and other caption sources before inserting them as HTML into image lightbox captions. This flaw allows unauthenticated users to inject malicious scripts via comments, which are then executed in the context of users viewing the affected captions.

A cross-site scripting (XSS) vulnerability exists in the Checkout Files Upload for WooCommerce WordPress plugin versions 2.4.0 up to but not including 2.4.1. The plugin fails to properly verify uploaded file types at checkout, allowing unauthenticated users to upload HTML files disguised as images. When a shop manager or administrator views the uploaded file from the order screen, the malicious JavaScript executes in their browser. This issue is a regression of a previously fixed vulnerability (CVE-2025-4212) and was reintroduced in version 2.4.0.

SEOJuice WordPress plugin versions before 2.12.0 contain a Cross-Site Request Forgery (CSRF) vulnerability that disables WordPress's REST nonce protection site-wide. This allows unauthenticated attackers to perform any REST API action that requires cookie authentication by tricking a logged-in administrator into visiting a malicious page, including creating new administrator accounts.

The Swipe WordPress plugin versions up to 1.4 contain an authentication bypass vulnerability that allows unauthenticated attackers to obtain WordPress session cookies without proper login verification. This flaw enables attackers to log in as any existing user, including administrators, if that user has an active app session.

The Duplicate Post WordPress plugin versions before 1.5.8 contain a missing authorization vulnerability. This flaw allows users with roles granted access to the plugin, such as Contributors, to publish posts without proper permission checks. As a result, these users can create published posts, including posts attributed to other users, which they normally should not be able to do.

The Duplicate Post WordPress plugin versions before 1.5.8 contain an authorization flaw where users with roles granted access to the plugin, such as Contributor, can duplicate posts without verifying edit permissions. When the slug takeover option is enabled, this allows such users to move any readable post off its original permalink and publish their copy at that address.

The Duplicate Post WordPress plugin versions before 1.5.8 have a missing authorization check when saving global settings. This flaw allows users with any role granted access by an administrator, including low-privilege roles such as Subscriber, to overwrite global settings, including the role-access list itself.

A missing authorization vulnerability in the Flatsome WordPress theme before version 3.20.13 allows users with the Contributor role to publish their own content and change its post type via an AJAX save action without having the necessary permissions.

A vulnerability in the Flatsome WordPress theme before version 3.20.13 allows unauthenticated users to access unpublished post content via an AJAX action that lacks proper capability or nonce checks. This exposure includes draft and pending posts, potentially leaking sensitive information.

The Chargely Free Subscriptions For Woocommernce WordPress plugin version 1.0 and earlier exposes sensitive configuration data via an unauthenticated REST API route. This flaw allows attackers to retrieve the live WooCommerce REST API consumer key and secret, which provide full read and write access to the store.

The Email Marketing 4Dem WordPress plugin versions up to 2.0.5 contain a missing authorization vulnerability. This flaw allows unauthenticated users to invoke certain AJAX actions without capability checks, enabling them to delete stored configurations and records.

The Email Marketing 4Dem WordPress plugin up to version 2.0.5 lacks proper authorization checks on multiple AJAX actions and REST API routes. This flaw allows unauthenticated users to access and disclose stored plugin configuration and data, as well as modify the plugin's stored settings.

The Countdown, Coming Soon, Maintenance WordPress plugin up to version 3.0.8 has a vulnerability where it does not verify user permissions before returning post titles via an AJAX action. This allows any authenticated user, including subscribers, to view the titles of published posts of any post type, even those normally restricted by WordPress. However, draft, private, and pending posts are not disclosed.

The Countdown, Coming Soon, Maintenance WordPress plugin up to version 3.0.8 contains a cross-site scripting (XSS) vulnerability. This occurs because the plugin does not perform authorization or nonce checks when saving countdown data on post save, and its output sanitization allowlist permits script tags. As a result, users with Author-level access or higher can inject arbitrary scripts that execute when the affected content is viewed on the front end or in an administrator session.

The Optimole WordPress plugin up to version 4.2.19 contains a vulnerability that allows unauthenticated attackers to delete arbitrary files on the server due to insufficient file path validation. Exploitation requires the presence of PEAR's Archive_Tar library and an administrator to perform a rename action on an attachment after the attacker stages a malicious payload in a comment. This can lead to remote code execution if critical files like wp-config.php are deleted.

A critical authorization bypass vulnerability exists in the AutomatorWP Pro plugin for WordPress, specifically in the webhook addon, affecting all versions up to and including 1.4.4. This flaw allows unauthenticated attackers to reset passwords of any WordPress user account, including administrators, leading to full account takeover. Exploitation requires a specific plugin configuration involving a Receive Webhook trigger paired with an Update-User action with certain fields left blank or mapped to the webhook password tag.

This entry references internally found bugs fixed in Firefox ESR 153.1 and Firefox 154, but the provided data pertains to a Microsoft vulnerability (CVE-2026-74988) with minimal details. The description does not detail the nature of the vulnerability or its impact. No patch or remediation information is provided, and no active exploitation is reported.

This entry references internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1, and Firefox 154, but the provided data pertains to a Microsoft vulnerability (CVE-2026-74987) with minimal details. The description does not detail the nature of the vulnerability or its impact. No patch or remediation information is provided.