davidfcarr vulnerabilities and threats

The Quick Playground WordPress plugin up to version 1.3.4 contains a path traversal vulnerability. This flaw allows authenticated administrators to read arbitrary files on the server by exploiting improper validation of a filename parameter. Exploitation requires the site to be synced with WordPress Playground or hosted on playground.wordpress.net. The vulnerability has a medium severity rating with a CVSS score of 4.4.

The Quick Playground plugin for WordPress is vulnerable to Path Traversal in versions up to and including 1.3.3. This is due to insufficient path validation in the qckply_zip_theme() function, which appends a user-controlled 'stylesheet' parameter directly to the theme root directory path without sanitizing directory traversal sequences. This makes it possible for unauthenticated attackers to trigger the creation of a ZIP archive containing arbitrary files from the server's filesystem — including wp-config.

CVE-2026-1830 is a critical vulnerability in the Quick Playground WordPress plugin up to version 1.3.1. It involves missing authorization checks on REST API endpoints, allowing unauthenticated attackers to retrieve a sync code and upload arbitrary PHP files via path traversal. This can lead to remote code execution on the affected server. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

Cross-Site Request Forgery (CSRF) vulnerability in davidfcarr My Marginalia my-marginalia allows Stored XSS.This issue affects My Marginalia: from n/a through <= 1.0.6.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in davidfcarr RSVPMarker rsvpmaker allows SQL Injection.This issue affects RSVPMarker : from n/a through <= 11.6.7.

Missing Authorization vulnerability in davidfcarr RSVPMarker rsvpmaker.This issue affects RSVPMarker : from n/a through <= 11.4.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davidfcarr RSVPMaker Volunteer Roles rsvpmaker-volunteer-roles allows Reflected XSS.This issue affects RSVPMaker Volunteer Roles: from n/a through <= 1.5.1.

Unrestricted Upload of File with Dangerous Type vulnerability in davidfcarr RSVPMaker for Toastmasters rsvpmaker-for-toastmasters allows Upload a Web Shell to a Web Server.This issue affects RSVPMaker for Toastmasters: from n/a through <= 6.2.4.