Kitodo.Production versions prior to 3.9.2 contain an XML External Entity (XXE) vulnerability due to insecure XML parser configurations that allow processing of external entities. Authenticated users uploading crafted EAD/XML files can exploit this to perform local file disclosure and server-side request forgery (SSRF). The issue is fixed in version 3.9.2.
Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue affects Mang Board WP: from n/a through 2.4.4.
The FunnelKit – Funnel Builder Plugin for WooCommerce Checkout for WordPress contains an authorization bypass vulnerability in all versions up to and including 3.16.0.6. This flaw allows unauthenticated attackers to retrieve billing personally identifiable information (PII) such as full name, street address, email address, and phone number for any WooCommerce order by submitting sequential order IDs. Exploitation requires the presence of a FunnelKit thank-you page rendering specific shortcodes. The vulnerability has a high severity rating with a CVSS score of 7.5.
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the wp_ajax_nopriv_mb_template endpoint is publicly accessible without authentication, nonce verification is not enforced for the content_reply mode, and admin-ajax.php responds with Content-Type: text/html, causing browsers to execute injected tags embedded in the JSON response body.
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitization bypass is further compounded by the ability to omit the data_type parameter in a modify request, which skips the HTMLPurifier branch entirely and leaves only mbw_htmlspecialchars2 encoding — fully reversed at render — as the sole barrier.
The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login.
Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1.
CVE-2026-109698 is a critical SQL Injection vulnerability in Kitae Park Mang Board WP, affecting versions prior to 2.4.5. The flaw allows an attacker to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability has a high CVSS score of 9.3, indicating network exploitable, low attack complexity, no privileges or user interaction required, and impacts confidentiality and availability. No official patch or remediation information is provided in the input data.
The Mang Board WordPress plugin (versions up to and including 2.4.0) contains a stored cross-site scripting (XSS) vulnerability via the 'data_type' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. It is caused by insufficient input sanitization and output escaping.
The Mang Board WordPress plugin up to version 2.4.3 is vulnerable to a Local File Inclusion (LFI) vulnerability via the '<mode>_type' parameter. This allows unauthenticated attackers to include and execute arbitrary PHP files on the server, potentially leading to code execution and access control bypass. Exploitation requires no authentication and can be performed via a POST request to any page rendering the [mb_board] shortcode, which lacks nonce or capability checks. The vulnerability is classified as CWE-98 and carries a high CVSS score of 8.1.
The Mang Board WordPress plugin is affected by a stored Cross-Site Scripting (XSS) vulnerability in the 'user_name' parameter in all versions up to and including 2.4.3. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The existing sanitizer mbw_htmlspecialchars2() does not prevent this attack due to the nature of the exploit payload.
The Mang Board WordPress plugin up to version 2.4.3 is vulnerable to stored Cross-Site Scripting (XSS) via the 'content' parameter. Authenticated users with custom-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.
The Booking Package WordPress plugin up to version 1.7.29 is affected by a stored cross-site scripting (XSS) vulnerability via the 'id' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.
The Booking Package plugin for WordPress up to version 1.7.29 has an authorization bypass vulnerability. This flaw allows unauthenticated attackers to access personally identifiable information of all booked customers, including names, emails, phone numbers, addresses, and cancellation tokens. The vulnerability arises because the plugin fails to properly verify user authorization. The nonce intended to protect the endpoint is a public CSRF token exposed on pages using the booking_package shortcode or widget, making it easily accessible to attackers.
WP Directory Kit versions up to 1.5.9 contain a time-based SQL Injection vulnerability in the 'display_name' profile field. Authenticated users with subscriber-level access can exploit this second-order injection by storing malicious input that is later unsanitized and executed in SQL queries, potentially exposing sensitive database information.
FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the 'shipping_first_name' parameter in all versions up to and including 3.16.0.5. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when a user accesses the affected page. The issue arises from insufficient input sanitization and output escaping.
CVE-2026-104634 is an incorrect type conversion vulnerability in the BeamMCP.Server component of ScriptKittyOS beam_mcp. It causes boolean values true, false, and null from an MCP client to be converted into strings "true", "false", and "nil" when passed to the host's dispatch function. This leads to logic errors where boolean checks behave incorrectly, potentially causing false to be treated as true. The issue affects beam_mcp versions from 0.1.0 up to but not including 0.10.1.
Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool's dispatch function with arguments that violate the input schema the server advertised. BeamMCP.Schema.validate/2 checked type, required, additionalProperties, enum and numeric bounds on the top-level arguments object only. Constraints inside nested objects and on array items (items, minItems, maxItems, minLength, maxLength, pattern, nested required, enum and additionalProperties: false) were advertised by tools/list and never checked at tools/call or prompts/get, and keywords outside the enforced subset (oneOf, anyOf, $ref) were advertised and ignored.
A host whose dispatch code relies on the schema it declared receives values the schema forbids, such as an out-of-range number or an undeclared key inside a nested object. What the host does with such a value decides the impact.
This issue affects beam_mcp: from 0.1.0 before 0.10.1.
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit) for WooCommerce: from n/a through 2.2.0.