platforms:
32-bit Systems
x64-based Systems

product: Windows 10 Version 1607

vendor: Microsoft

status: affected

version_type: custom

product: Windows 10 Version 1809

platforms:
32-bit Systems
ARM64-based Systems
x64-based Systems

product: Windows 10 Version 21H2

product: Windows 10 Version 22H2

platforms:
ARM64-based Systems
x64-based Systems

product: Windows 11 version 22H2

product: Windows 11 version 22H3

product: Windows 11 Version 23H2

product: Windows 11 Version 24H2

product: Windows Server 2016

product: Windows Server 2016 (Server Core installation)

product: Windows Server 2019

product: Windows Server 2019 (Server Core installation)

ecosystem: windows/system

metric_type: Secondary

severity: high

part: o

vendor: microsoft

quality: metadata-backed

recipe_kind: composed

status: Analyzed

summary: Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.


product: Windows 10 Version 1507

product: Windows Server 2012

product: Windows Server 2012 (Server Core installation)

product: Windows Server 2012 R2

severity: medium

summary: Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

title: Microsoft Windows 10 1507 security vulnerability


product: Windows Server 2025

product: Windows Server 2025 (Server Core installation)

summary: Integer overflow or wraparound in Windows Hyper-V allows an authorized attacker to disclose information over an adjacent network.


product: Windows 10 Version 1809

product: Windows Server 2022

product: Windows Server 2022, 23H2 Edition (Server Core installation)

archetype: generic

summary: Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.


product: Windows 11 version 22H2

product: Windows 11 Version 25H2

metric_type: Primary

summary: Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.


product: libbiosig

vendor: The Biosig Project

version: Master Branch (35a819fa)

ecosystem: software/application

severity: critical

part: a

status: Modified

summary: A heap-based buffer overflow vulnerability exists in the RHS2000 parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted RHS2000 file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

title: Libbiosig Project Libbiosig security vulnerability


product: DataSpider Servista

vendor: Saison Technology Co.,Ltd.

version: 4.4 and earlier

archetype: xxe

vendor: saison

summary: Improper restriction of XML external entity reference issue exists in DataSpider Servista 4.4 and earlier. If a specially crafted request is processed, arbitrary files on the file system where the server application for the product is installed may be read, or a denial-of-service (DoS) condition may occur.


default_status: affected

product: BlueSpice

vendor: Hallo Welt! GmbH

version_type: semver

product: bluespice

vendor: hallowelt

summary: Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceAvatars) allows Cross-Site Scripting (XSS). This issue affects BlueSpice: from 5 through 5.1.1.


default_status: unknown

product: BIG-IP

status: unaffected

product: BIG-IP Next SPK

product: BIG-IP Next CNF

summary: When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

title: F5 Big-Ip Next Cloud-Native Network Functions security vulnerability


default_status: unaffected

product: One Time Password

vendor: Drupal

summary: Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.

title: One Time Password Project One Time Password security vulnerability


summary: Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Credentials.This issue affects One Time Password: from 0.0.0 before 1.3.0.


product: Quick Node Block

summary: Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.

title: Quick Node Block Project Quick Node Block security vulnerability


product: SEL-5056 Software-Defined Network Flow Controller

vendor: Schweitzer Engineering Laboratories

status: Deferred

summary: Password guessing limits could be bypassed when using LDAP authentication.


platforms:
Windows
SEL Blueframe

summary: OpenFlow discovery protocol can exhaust resources because it is not rate limited


summary: Improper limitation of pathname in Circuit Provisioning and File Import applications allows modification and uploading of files


product: SEL-5030 acSELerator QuickSet Software

summary: An authenticated user can modify application state data.


product: Vnet/IP Interface Package

vendor: Yokogawa Electric Corporation

version: R1.07.00 or earlier

vendor: yokogawa

summary: A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receives maliciously crafted packets, Vnet/IP software stack process may be terminated. The affected products and versions are as follows: Vnet/IP Interface Package (for CENTUM VP R6 VP6C3300, CENTUM VP R7 VP7C3300) R1.07.00 or earlier


title: A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation


product: Checkmate

vendor: BlueWave

summary: In BlueWave Checkmate before 2.1, an authenticated regular user can access sensitive application secrets via the /api/v1/settings endpoint.


ecosystem: operating-system

vendor: samsung

summary: In Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000, there is an improper access control vulnerability related to a log file.

title: Samsung Exynos 980 Firmware security vulnerability


summary: A vulnerability in the WebApl component of Mitel OpenScape Xpressions through V7R1 FR5 HF43 P913 could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. A successful exploit could allow an attacker to read files from the underlying OS and obtain sensitive information.

title: A vulnerability in the WebApl component of Mitel OpenScape Xpressions through V7R1 FR5 HF43 P913 could allow an unauthenticated...


vendor: MutonUfoAI

summary: The HttpAuth plugin in pGina.Fork through 3.9.9.12 allows authentication bypass when an adversary controls DNS resolution for pginaloginserver.

title: Mutonufoai Pgina.Fork security vulnerability


product: OTP

vendor: Erlang

version_type: otp

version_type: git

summary: Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

title: Erlang Otp security vulnerability


summary: Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.


summary: Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

title: Erlang Otp security vulnerability


product: ash

vendor: ash-project

summary: Incorrect Authorization vulnerability in ash-project ash allows Exploiting Incorrectly Configured Access Control Security Levels. This vulnerability is associated with program files lib/ash/actions/create/bulk.ex, lib/ash/actions/destroy/bulk.ex, lib/ash/actions/update/bulk.ex and program routines 'Elixir.Ash.Actions.Create.Bulk':run/5, 'Elixir.Ash.Actions.Destroy.Bulk':run/6, 'Elixir.Ash.Actions.Update.Bulk:run'/6. This issue affects ash: from 0.1.0 before 3.5.39.


summary: Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This vulnerability is associated with program files lib/ash/policy/authorizer/authorizer.ex and program routines 'Elixir.Ash.Policy.Authorizer':strict_filters/2. This issue affects ash: from 0.1.0 before 3.6.2.


summary: Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This vulnerability is associated with program files lib/ash/policy/policy.ex and program routines 'Elixir.Ash.Policy.Policy':expression/2. This issue affects ash: from 3.6.3 before 3.7.1.


product: NetFax Server

vendor: MICI Network Co. Ltd.

summary: An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials.


summary: An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint.


summary: An authenticated user can perform command injection via unsanitized input to the NetFax Server’s ping functionality via the /test.php endpoint.

title: Mici Network Co. Ltd. Netfax Server security vulnerability


product: DOMPurify

summary: In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier disputes the significance of this report because the "Uncontrolled data used in path expression" occurs "in a development helper script which starts a local web server if needed and must be manually started."


product: Lila

vendor: Lichess

vendor: lichess

summary: powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extracted from a DOM node and interpreted as HTML.

title: Lichess Powertip.Ts security vulnerability


product: discourse

vendor: discourse

summary: Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, sending a malicious URL in a PM to a bot user can cause a reduced the availability of a Discourse instance. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. No known workarounds are available.


product: radashi

vendor: radashi-org

ecosystem: javascript/npm

summary: Radashi is a TypeScript utility toolkit. Prior to version 12.5.1, the set function within the Radashi library is vulnerable to prototype pollution. If an attacker can control parts of the path argument to the set function, they could potentially modify the prototype of all objects in the JavaScript runtime, leading to unexpected behavior, denial of service, or even remote code execution in some specific scenarios. This issue has been patched in version 12.5.1. A workaround for this issue involves sanitizing the path argument provided to the set function to ensure that no part of the path string is __proto__, prototype, or constructor.

title: Radashi is a TypeScript utility toolkit


product: iTop

vendor: Combodo

product: itop

vendor: combodo

summary: Combodo iTop is a web based IT service management tool. In versions prior to 3.2.2, when displaying content in a browse brick in the user portal, a cross-site scripting attack can occur. This is fixed in versions 3.2.2 and 3.3.0.


product: hubble

vendor: cilium

summary: Hubble is a fully distributed networking and security observability platform for cloud native workloads. Prior to version 1.17.2, a network attacker could inject malicious control characters into Hubble CLI terminal output, potentially leading to loss of integrity and manipulation of the output. This could be leveraged to conceal log entries, rewrite output, or even make the terminal temporarily unusable. Exploitation of this attack would require the victim to be monitoring Kafka traffic using Layer 7 Protocol Visibility at the time of the attack. The issue is patched in Hubble CLI v1.17.2. Hubble CLI users who are unable to upgrade can direct their Hubble flows to a log file and inspect the output within a text editor.


vendor: Icinga

product: icinga

vendor: icinga

summary: Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. Prior to versions 2.12.12, 2.13.12, and 2.14.6, the VerifyCertificate() function can be tricked into incorrectly treating certificates as valid. This allows an attacker to send a malicious certificate request that is then treated as a renewal of an already existing certificate, resulting in the attacker obtaining a valid certificate that can be used to impersonate trusted nodes. This only occurs when Icinga 2 is built with OpenSSL older than version 1.1.0. This issue has been patched in versions 2.12.12, 2.13.12, and 2.14.6.

title: Icinga security vulnerability


product: powsybl-core

vendor: powsybl

summary: PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, there is a potential polynomial Regular Expression Denial of Service (ReDoS) vulnerability in the PowSyBl's DataSource mechanism. If successfully exploited, a malicious actor can cause significant CPU consumption due to regex backtracking — even with polynomial patterns. This issue has been patched in com.powsybl:powsybl-commons: 6.7.2.


product: jq

vendor: jqlang

summary: jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz);`. As of time of publication, no patched versions are available.

title: jq is a command-line JSON processor


product: wire-webapp

vendor: wireapp

summary: wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidated. A user that logged out of the Wire webapp, could have been automatically logged in again after re-opening the application. This does not happen when the user is logged in as a temporary user by selecting "This is a public computer" during login or the user selects "Delete all your personal information and conversations on this device" upon logout. The underlying issue has been fixed with wire-webapp version 2025-05-20-production.0. As a workaround, this behavior can be prevented by either deleting all information upon logout as well as logging in as a temporary client.


summary: Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, certain invites via email may result in HTML injection in the email body if the topic title includes HTML. This includes inviting someone (without an account) to a PM and inviting someone (without an account) to a topic with a custom message. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. This can be worked around if the relevant templates are overridden without `{topic_title}`.


product: xwiki-platform

vendor: xwiki

product: xwiki

summary: XWiki is a generic wiki platform. In XWiki 16.10.0, required rights were introduced as a way to limit which rights a document can have. Part of the security model of required rights is that a user who doesn't have a right also cannot define that right as required right. That way, users who are editing documents on which required rights are enforced can be sure that they're not giving a right to a script or object that it didn't have before. A bug in the implementation of the enforcement of this rule means that in fact, it was possible for any user with edit right on a document to set programming right as required right. If then a user with programming right edited that document, the content of that document would gain programming right, allowing remote code execution. This thereby defeats most of the security benefits of required rights. As XWiki still performs the required rights analysis when a user edits a page even when required rights are enforced, the user with programming right would still be warned about the dangerous content unless the attacker managed to bypass this check.

title: XWiki is a generic wiki platform


summary: Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a field with an error contains malicious content. Versions 2.7.13 and 3.2.2 protect rendered HTML content.


vendor: wire

summary: wire-webapp is the web application for the open-source messaging service Wire. A bug fix caused a regression causing an issue with function to delete local data. Instructing the client to delete its local database on user logout does not result in deletion. This is the case for both temporary clients (marking the device as a public computer on login) and regular clients instructing the deletion of all personal information and conversations upon logout. Access to the machine is required to access the data. If encryption-at-rest is used, cryptographic material can't be exported. The underlying issue has been fixed with wire-webapp version 2025-05-14-production.0. In order to mitigate potential impact, the database must be manually deleted on devices where the option "This is a public computer" was used prior to log in or a log out with the request to delete local data with the affected versions has happened before.


product: OctoPrint

vendor: OctoPrint

product: octoprint

vendor: octoprint

summary: OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows an attacker with the FILE_UPLOAD permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload folder where they then can be downloaded from. This vulnerability is fixed in 1.11.2.


vendor: vercel

severity: low

summary: Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active. This issue has been patched in versions 14.2.30 and 15.2.2.


vendor: Shopify

summary: ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the `ejson2env` tool has a vulnerability related to how it writes to `stdout`. Specifically, the tool is intended to write an export statement for environment variables and their values. However, due to inadequate output sanitization, there is a potential risk where variable names or values may include malicious content, resulting in additional unintended commands being output to `stdout`. If this output is improperly utilized in further command execution, it could lead to command injection, allowing an attacker to execute arbitrary commands on the host system. Version 2.0.8 sanitizes output during decryption. Other mitigations involve avoiding use of `ejson2env` to decrypt untrusted user secrets and/or avoiding evaluating or executing the direct output from `ejson2env` without removing nonprintable characters.


product: plane

vendor: makeplane

vendor: plane

summary: Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that are meant to be read-only, such as email. This can lead to account takeover when chained with another vulnerability such as cross-site scripting (XSS). Version 0.23 fixes the issue.


product: openexr

vendor: AcademySoftwareFoundation

vendor: openexr

summary: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.2 through 3.3.0, there is a heap-based buffer overflow during a write operation when decompressing ZIPS-packed deep scan-line EXR files with a maliciously forged chunk header. This is fixed in version 3.3.3.

title: Openexr security vulnerability


summary: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk. This is fixed in version 3.3.3.

title: Openexr security vulnerability


summary: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, when reading a deep scanline image with a large sample count in reduceMemory mode, it is possible to crash a target application with a NULL pointer dereference in a write operation. This is fixed in version 3.3.3.

title: Openexr security vulnerability


summary: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files. This is fixed in version 3.3.3.

title: Openexr security vulnerability


product: fiber

vendor: gofiber

summary: Fiber is an Express-inspired web framework written in Go. Starting in version 2.52.6 and prior to version 2.52.7, `fiber.Ctx.BodyParser` can map flat data to nested slices using `key[idx]value` syntax, but when idx is negative, it causes a panic instead of returning an error stating it cannot process the data. Since this data is user-provided, this could lead to denial of service for anyone relying on this `fiber.Ctx.BodyParser` functionality. Version 2.52.7 fixes the issue.


product: galette

vendor: galette

summary: Galette is a membership management web application for non profit organizations. Versions 1.1.5.2 and below allow a user to edit a group name and insert an XSS payload. This issue is fixed in version 1.2.0.


product: Block Country

summary: Cross-Site Request Forgery (CSRF) vulnerability in nitinmaurya12 Block Country block-country allows Stored XSS.This issue affects Block Country: from n/a through <= 1.0.

title: Nitinmaurya12 Block Country security vulnerability


product: Slick Google Map

vendor: Norbert

summary: Cross-Site Request Forgery (CSRF) vulnerability in Norbert Slick Google Map slick-google-map allows Stored XSS.This issue affects Slick Google Map: from n/a through <= 0.3.

title: Norbert Slick Google Map security vulnerability


product: ProfileGrid

vendor: Metagauss

summary: Missing Authorization vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid : from n/a through <= 5.9.5.1.

title: Metagauss Profilegrid security vulnerability


product: Uncanny Toolkit for LearnDash

vendor: Uncanny Owl

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Stored XSS.This issue affects Uncanny Toolkit for LearnDash: from n/a through <= 3.7.0.2.

title: Uncanny Owl Uncanny Toolkit For Learndash security vulnerability


product: Printeers Print & Ship

vendor: Printeers

summary: Path Traversal: '.../...//' vulnerability in Printeers Printeers Print & Ship allows Path Traversal.This issue affects Printeers Print & Ship: from n/a through 1.17.0.

title: Printeers Printeers Print & Ship security vulnerability


product: Progress Planner

vendor: Progress Planner

summary: Incorrect Privilege Assignment vulnerability in Progress Planner Progress Planner progress-planner allows Privilege Escalation.This issue affects Progress Planner: from n/a through <= 1.8.0.

title: Progress Planner security vulnerability


product: wpNamedUsers

vendor: andriassundskard

summary: Cross-Site Request Forgery (CSRF) vulnerability in andriassundskard wpNamedUsers wpnamedusers allows Stored XSS.This issue affects wpNamedUsers: from n/a through <= 0.5.

title: Andriassundskard Wpnamedusers security vulnerability


product: Simple Stripe

vendor: ZIPANG

summary: Cross-Site Request Forgery (CSRF) vulnerability in ZIPANG Simple Stripe simple-stripe allows Stored XSS.This issue affects Simple Stripe: from n/a through <= 0.9.17.

title: Zipang Simple Stripe security vulnerability


product: Ajax Search Lite

vendor: wpdreams

summary: Deserialization of Untrusted Data vulnerability in wpdreams Ajax Search Lite ajax-search-lite allows Object Injection.This issue affects Ajax Search Lite: from n/a through <= 4.13.3.

title: Wpdreams Ajax Search Lite security vulnerability


product: Memberlite Shortcodes

vendor: Jason C.

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason C. Memberlite Shortcodes memberlite-shortcodes allows Stored XSS.This issue affects Memberlite Shortcodes: from n/a through 1.4.1.


summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm_Force Ultimate Addons for WPBakery Page Builder ultimate_vc_addons allows Stored XSS.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through < 3.21.1.

title: Brainstorm Force Ultimate Addons For Wpbakery Page Builder security vulnerability


product: Education WordPress Theme | HiStudy

vendor: Rainbow-Themes

ecosystem: php/wordpress

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rainbow-Themes Education WordPress Theme | HiStudy histudy allows SQL Injection.This issue affects Education WordPress Theme | HiStudy: from n/a through < 3.1.0.

title: Rainbow-Themes Education Wordpress Theme | Histudy security vulnerability


product: Blanka - One Page WordPress Theme

vendor: CocoBasic

summary: Path Traversal: '.../...//' vulnerability in CocoBasic Blanka - One Page WordPress Theme blanka-wp allows PHP Local File Inclusion.This issue affects Blanka - One Page WordPress Theme: from n/a through < 1.5.

title: Cocobasic Blanka - One Page Wordpress Theme security vulnerability


product: AnyComment

vendor: Alexander

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alexander AnyComment anycomment allows SQL Injection.This issue affects AnyComment: from n/a through <= 0.3.6.

title: Alexander Anycomment security vulnerability


product: Fix Multiple Redirects

vendor: jurajpuchky

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jurajpuchky Fix Multiple Redirects fix-multiple-redirects allows Reflected XSS.This issue affects Fix Multiple Redirects: from n/a through <= 1.2.3.

title: Jurajpuchky Fix Multiple Redirects security vulnerability


product: Password only login

vendor: Calvaweb

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Calvaweb Password only login password-only-login allows Reflected XSS.This issue affects Password only login: from n/a through <= 0.2.

title: Calvaweb Password Only Login security vulnerability


product: Magic Slider

vendor: LambertGroup

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Magic Slider magic_slider allows Reflected XSS.This issue affects Magic Slider: from n/a through <= 2.2.

title: Lambertgroup Magic Slider security vulnerability


product: Survey Maker

vendor: Ays Pro

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.1.8.8.

title: Ays Pro Survey Maker security vulnerability


product: Custom CSS

vendor: FRESHFACE

summary: Missing Authorization vulnerability in FRESHFACE Custom CSS custom-css-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom CSS: from n/a through <= 1.4.0.

title: Freshface Custom Css security vulnerability


product: WSAnalytics

vendor: Shiva

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shiva WSAnalytics wsanalytics-google-analytics-and-dashboards allows Reflected XSS.This issue affects WSAnalytics: from n/a through <= 1.1.2.

title: Shiva Wsanalytics security vulnerability


product: Search & Filter

vendor: Code Amp

summary: Cross-Site Request Forgery (CSRF) vulnerability in Code Amp Search & Filter search-filter allows Cross Site Request Forgery.This issue affects Search & Filter: from n/a through <= 1.2.17.

title: Code Amp Search & Filter security vulnerability


product: bidorbuy Store Integrator

vendor: extremeidea

summary: Improper Control of Generation of Code ('Code Injection') vulnerability in extremeidea bidorbuy Store Integrator bidorbuystoreintegrator allows Remote Code Inclusion.This issue affects bidorbuy Store Integrator: from n/a through <= 2.12.0.

title: Extremeidea Bidorbuy Store Integrator security vulnerability


product: Constant Contact for WordPress

vendor: webdevstudios

summary: Deserialization of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress allows Object Injection. This issue affects Constant Contact for WordPress: from n/a through 4.1.1.


vendor: gourl

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gourl GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership gourl-bitcoin-payment-gateway-paid-downloads-membership allows Stored XSS.This issue affects GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership: from n/a through <= 1.6.6.

title: Gourl Gourl Bitcoin Payment Gateway & Paid Downloads & Membership security vulnerability


product: Today's Date Inserter

vendor: mulscully

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mulscully Today's Date Inserter todays-date-inserter allows Stored XSS.This issue affects Today's Date Inserter: from n/a through <= 1.2.1.

title: Mulscully Today'S Date Inserter security vulnerability


product: Floating Window Music Player

vendor: ericzane

summary: Cross-Site Request Forgery (CSRF) vulnerability in ericzane Floating Window Music Player floating-window-music-player allows Stored XSS.This issue affects Floating Window Music Player: from n/a through <= 3.4.2.

title: Ericzane Floating Window Music Player security vulnerability


product: Easy Flash Embed

vendor: Vincent Boiardt

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Boiardt Easy Flash Embed easy-flash-embed allows Stored XSS.This issue affects Easy Flash Embed: from n/a through <= 1.0.

title: Vincent Boiardt Easy Flash Embed security vulnerability


product: Clanora

vendor: CMSSuperHeroes

summary: Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Clanora clanora allows Using Malicious Files.This issue affects Clanora: from n/a through < 1.3.1.

title: Cmssuperheroes Clanora security vulnerability


product: Uncode

vendor: undsgn

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in undsgn Uncode uncode allows Reflected XSS.This issue affects Uncode: from n/a through < 2.9.4.4.

title: Undsgn Uncode security vulnerability


product: School Management

vendor: Mojoomla

summary: Missing Authorization vulnerability in Mojoomla School Management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects School Management: from n/a through 93.2.0.

title: Mojoomla School Management security vulnerability


product: XM-Backup

vendor: Xavier Media

summary: Cross-Site Request Forgery (CSRF) vulnerability in Xavier Media XM-Backup xm-backup allows Stored XSS.This issue affects XM-Backup: from n/a through <= 0.9.1.

title: Xavier Media Xm-Backup security vulnerability


product: Link View

vendor: mibuthu

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mibuthu Link View link-view allows Stored XSS.This issue affects Link View: from n/a through <= 0.8.0.

title: Mibuthu Link View security vulnerability


vendor: YITHEMES

summary: Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.49.0.


product: Dot html,php,xml etc pages

vendor: karimmughal

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in karimmughal Dot html,php,xml etc pages dot-htmlphpxml-etc-pages allows Reflected XSS.This issue affects Dot html,php,xml etc pages: from n/a through <= 1.0.

title: Karimmughal Dot Html,Php,Xml Etc Pages security vulnerability


product: Broadstreet Ads

vendor: Broadstreet

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Broadstreet Broadstreet Ads broadstreet allows Stored XSS.This issue affects Broadstreet Ads: from n/a through <= 1.51.2.

title: Broadstreet Broadstreet Ads security vulnerability


product: ShayanWeb Admin FontChanger

vendor: Shayan Farhang Pazhooh

summary: Cross-Site Request Forgery (CSRF) vulnerability in Shayan Farhang Pazhooh ShayanWeb Admin FontChanger shayanweb-admin-fontchanger allows Stored XSS.This issue affects ShayanWeb Admin FontChanger: from n/a through <= 1.9.1.

title: Shayan Farhang Pazhooh Shayanweb Admin Fontchanger security vulnerability


product: ValidateCertify

vendor: Javier Revilla

summary: Cross-Site Request Forgery (CSRF) vulnerability in Javier Revilla ValidateCertify validar-certificados-de-cursos allows Cross Site Request Forgery.This issue affects ValidateCertify: from n/a through <= 1.6.4.

title: Javier Revilla Validatecertify security vulnerability


product: EventON

vendor: Ashan Perera

summary: Missing Authorization vulnerability in Ashan Perera EventON eventon-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects EventON: from n/a through <= 2.4.4.

title: Ashan Perera Eventon security vulnerability


product: WooCommerce POS

vendor: kilbot

summary: Missing Authorization vulnerability in kilbot WooCommerce POS woocommerce-pos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce POS: from n/a through <= 1.7.8.

title: Kilbot Woocommerce Pos security vulnerability


product: Woocommerce Partial Shipment

vendor: WpExperts Hub

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpExperts Hub Woocommerce Partial Shipment wc-partial-shipment allows SQL Injection.This issue affects Woocommerce Partial Shipment: from n/a through <= 3.2.

title: Wpexperts Hub Woocommerce Partial Shipment security vulnerability


product: RS WP Book Showcase

vendor: RS WP THEMES

summary: Improper Control of Generation of Code ('Code Injection') vulnerability in RS WP THEMES RS WP Book Showcase rs-wp-books-showcase allows Code Injection.This issue affects RS WP Book Showcase: from n/a through <= 6.7.59.

title: Rs Wp Themes Rs Wp Book Showcase security vulnerability


product: MapSVG

vendor: RomanCode

summary: Improper Control of Generation of Code ('Code Injection') vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Code Injection.This issue affects MapSVG: from n/a through <= 8.6.9.

title: Romancode Mapsvg security vulnerability


product: WP Notes Widget

vendor: Steve Puddick

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Puddick WP Notes Widget wp-notes-widget allows DOM-Based XSS.This issue affects WP Notes Widget: from n/a through <= 1.0.6.

title: Steve Puddick Wp Notes Widget security vulnerability


vendor: Holest Engineering

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows SQL Injection.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.

title: Holest Engineering Spreadsheet Price Changer For Woocommerce And Wp E-C… security vulnerability


summary: Improper Control of Generation of Code ('Code Injection') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Code Injection.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.


summary: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Path Traversal.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.


product: WP Event Manager

vendor: WP Event Manager

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Event Manager WP Event Manager wp-event-manager allows PHP Local File Inclusion.This issue affects WP Event Manager: from n/a through <= 3.1.51.

title: Wp Event Manager security vulnerability


product: Essential Real Estate

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Essential Real Estate essential-real-estate allows PHP Local File Inclusion.This issue affects Essential Real Estate: from n/a through <= 5.2.9.

title: G5Plus Essential Real Estate security vulnerability


vendor: App Cheap

summary: Missing Authorization vulnerability in App Cheap Push notification for Mobile and Web app push-notification-mobile-and-web-app allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push notification for Mobile and Web app: from n/a through <= 2.0.3.

title: App Cheap Push Notification For Mobile And Web App security vulnerability


product: Sharespine Woocommerce Connector

vendor: Sharespine

summary: Missing Authorization vulnerability in Sharespine Sharespine Woocommerce Connector sharespine-woocommerce-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharespine Woocommerce Connector: from n/a through <= 4.7.55.

title: Sharespine Sharespine Woocommerce Connector security vulnerability


summary: Incorrect Privilege Assignment vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Privilege Escalation.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.


product: Spice Blocks

vendor: spicethemes

summary: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spicethemes Spice Blocks spice-blocks allows Path Traversal.This issue affects Spice Blocks: from n/a through <= 2.0.7.4.

title: Spicethemes Spice Blocks security vulnerability


product: UltraAddons Elementor Lite

vendor: Saiful Islam

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam UltraAddons Elementor Lite ultraaddons-elementor-lite allows Stored XSS.This issue affects UltraAddons Elementor Lite: from n/a through <= 2.0.2.

title: Saiful Islam Ultraaddons Elementor Lite security vulnerability


product: X Addons for Elementor

vendor: pencilwp

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows Stored XSS.This issue affects X Addons for Elementor: from n/a through <= 1.0.16.

title: Pencilwp X Addons For Elementor security vulnerability


product: Uncanny Automator

vendor: Uncanny Owl

vendor: uncannyowl

summary: Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator: from n/a through <= 6.4.0.2.

title: Uncannyowl Uncanny Automator security vulnerability


product: WP Tabs

vendor: ShapedPlugin LLC

vendor: shapedplugin

summary: Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC WP Tabs wp-expand-tabs-free allows Object Injection.This issue affects WP Tabs: from n/a through <= 2.2.12.

title: Shapedplugin Wp Tabs security vulnerability


product: Aptivada for WP

vendor: aptivadadev

vendor: aptivada

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aptivadadev Aptivada for WP aptivada-for-wp allows DOM-Based XSS.This issue affects Aptivada for WP: from n/a through <= 2.0.0.

title: Aptivada Aptivada For Wp security vulnerability


product: Mortgage Calculator Estatik

vendor: Estatik

vendor: estatik

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Estatik Mortgage Calculator Estatik estatik-mortgage-calculator allows PHP Local File Inclusion.This issue affects Mortgage Calculator Estatik: from n/a through <= 2.0.12.

title: Estatik Mortgage Calculator security vulnerability


product: Interview

vendor: proxymis

product: interview

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in proxymis Interview interview allows SQL Injection.This issue affects Interview: from n/a through <= 1.01.

title: Proxymis Interview security vulnerability


product: BERTHA AI

vendor: Bertha AI – Andrew Palmer

vendor: bertha

summary: Missing Authorization vulnerability in Bertha AI – Andrew Palmer BERTHA AI bertha-ai-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BERTHA AI: from n/a through <= 1.13.

title: Bertha Bertha Ai security vulnerability


product: StyleAI

vendor: relentlo

summary: Missing Authorization vulnerability in relentlo StyleAI relentlosoftware allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects StyleAI: from n/a through <= 1.0.4.

title: Relentlo Styleai security vulnerability


product: MetalpriceAPI

vendor: metalpriceapi

summary: Improper Control of Generation of Code ('Code Injection') vulnerability in metalpriceapi MetalpriceAPI metalpriceapi allows Code Injection.This issue affects MetalpriceAPI: from n/a through <= 1.1.4.

title: Metalpriceapi security vulnerability


product: Multi CryptoCurrency Payments

vendor: Alex Zaytseff

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alex Zaytseff Multi CryptoCurrency Payments multi-crypto-currency-payment allows SQL Injection.This issue affects Multi CryptoCurrency Payments: from n/a through <= 2.0.7.

title: Alex Zaytseff Multi Cryptocurrency Payments security vulnerability


product: Bookify

vendor: Saad Iqbal

summary: Incorrect Privilege Assignment vulnerability in Saad Iqbal Bookify bookify allows Privilege Escalation.This issue affects Bookify: from n/a through <= 1.0.9.

title: Saad Iqbal Bookify security vulnerability


product: Formulario de contacto SalesUp!

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in salesup2019 Formulario de contacto SalesUp! formularios-de-contacto-salesup allows Reflected XSS.This issue affects Formulario de contacto SalesUp!: from n/a through <= 1.0.14.

title: Salesup2019 Formulario De Contacto Salesup! security vulnerability


product: Import Export For WooCommerce

vendor: sidngr

summary: Cross-Site Request Forgery (CSRF) vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Stored XSS.This issue affects Import Export For WooCommerce: from n/a through <= 1.6.2.

title: Sidngr Import Export For Woocommerce security vulnerability


product: Track, Analyze & Optimize by WP Tao

vendor: Michal Jaworski

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michal Jaworski Track, Analyze & Optimize by WP Tao wp-tao allows Reflected XSS.This issue affects Track, Analyze & Optimize by WP Tao: from n/a through <= 1.3.

title: Michal Jaworski Track, Analyze & Optimize By Wp Tao security vulnerability


product: SEO Flow by LupsOnline

vendor: Michael Lups

vendor: lupsonline

summary: Cross-Site Request Forgery (CSRF) vulnerability in Michael Lups SEO Flow by LupsOnline lupsonline-link-netwerk allows Stored XSS.This issue affects SEO Flow by LupsOnline: from n/a through <= 2.2.1.

title: Lupsonline Seo Flow security vulnerability


product: CryptoCloud - Crypto Payment Gateway

vendor: Crypto Cloud

summary: Missing Authorization vulnerability in Crypto Cloud CryptoCloud - Crypto Payment Gateway cryptocloud-crypto-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CryptoCloud - Crypto Payment Gateway: from n/a through <= 2.1.2.

title: Crypto Cloud Cryptocloud - Crypto Payment Gateway security vulnerability


product: StoreKeeper for WooCommerce

vendor: StoreKeeper B.V.

summary: Unrestricted Upload of File with Dangerous Type vulnerability in StoreKeeper B.V. StoreKeeper for WooCommerce storekeeper-for-woocommerce allows Using Malicious Files.This issue affects StoreKeeper for WooCommerce: from n/a through <= 14.4.4.


product: Cook&Meal

vendor: dedalx

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in dedalx Cook&Meal cookandmeal allows PHP Local File Inclusion.This issue affects Cook&Meal: from n/a through <= 1.2.3.

title: Dedalx Cook&Meal security vulnerability


vendor: sminozzi

summary: Missing Authorization vulnerability in sminozzi Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin real-estate-right-now allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin: from n/a through <= 4.48.

title: Sminozzi Real Estate Property 2024 Create Your Own Fields And Search Ba… security vulnerability


product: CM Map Locations

vendor: CreativeMindsSolutions

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Map Locations cm-map-locations allows Reflected XSS.This issue affects CM Map Locations: from n/a through <= 2.1.6.

title: Creativemindssolutions Cm Map Locations security vulnerability


product: Rentsyst

vendor: dimafreund

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dimafreund Rentsyst rentsyst allows Reflected XSS.This issue affects Rentsyst: from n/a through <= 2.0.100.

title: Dimafreund Rentsyst security vulnerability


product: Import CDN-Remote Images

vendor: Atakan Au

summary: Cross-Site Request Forgery (CSRF) vulnerability in Atakan Au Import CDN-Remote Images import-cdn-remote-images allows Stored XSS.This issue affects Import CDN-Remote Images: from n/a through <= 2.1.2.

title: Atakan Au Import Cdn-Remote Images security vulnerability


vendor: LambertGroup

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Multimedia Playlist Slider Addon for WPBakery Page Builder lbg_vp_youtube_vimeo_addon_visual_composer allows Reflected XSS.This issue affects Multimedia Playlist Slider Addon for WPBakery Page Builder: from n/a through <= 2.1.

title: Lambertgroup Multimedia Playlist Slider Addon For Wpbakery Page Builder security vulnerability


product: Residential Address Detection

vendor: enituretechnology

summary: Missing Authorization vulnerability in enituretechnology Residential Address Detection residential-address-detection allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Residential Address Detection: from n/a through <= 2.5.9.

title: Enituretechnology Residential Address Detection security vulnerability


product: Image Wall

vendor: Parakoos

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Parakoos Image Wall image-wall allows Stored XSS.This issue affects Image Wall: from n/a through <= 3.1.

title: Parakoos Image Wall security vulnerability


product: Formality

vendor: Michele Giorgi

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Michele Giorgi Formality formality allows PHP Local File Inclusion.This issue affects Formality: from n/a through <= 1.5.9.

title: Michele Giorgi Formality security vulnerability


product: BuddyPress XProfile Custom Image Field

vendor: Alex Githatu

summary: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Alex Githatu BuddyPress XProfile Custom Image Field buddypress-xprofile-image-field allows Path Traversal.This issue affects BuddyPress XProfile Custom Image Field: from n/a through <= 3.0.1.

title: Alex Githatu Buddypress Xprofile Custom Image Field security vulnerability


summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Youtube Vimeo Video Player and Slider WP Plugin video-player-youtube-vimeo allows Reflected XSS.This issue affects Youtube Vimeo Video Player and Slider WP Plugin: from n/a through <= 3.8.

title: Lambertgroup Youtube Vimeo Video Player And Slider Wp Plugin security vulnerability


product: Caliris

vendor: CocoBasic

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CocoBasic Caliris caliris-wp allows PHP Local File Inclusion.This issue affects Caliris: from n/a through <= 1.5.

title: Cocobasic Caliris security vulnerability


product: YaySMTP

vendor: YayCommerce

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YaySMTP smtp-sendinblue allows SQL Injection.This issue affects YaySMTP: from n/a through <= 1.3.

title: Yaycommerce Yaysmtp security vulnerability


product: Simple Business Directory Pro

vendor: quantumcloud

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Reflected XSS.This issue affects Simple Business Directory Pro: from n/a through <= 15.5.1.

title: Quantumcloud Simple Business Directory Pro security vulnerability


summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support lbg-audio8-html5-radio-ads allows Reflected XSS.This issue affects SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support: from n/a through <= 3.5.4.

title: Lambertgroup Shout - Html5 Radio Player With Ads - Shoutcast And Icecas… security vulnerability


product: SureDash

vendor: Brainstorm Force

summary: Incorrect Privilege Assignment vulnerability in Brainstorm Force SureDash suredash allows Privilege Escalation.This issue affects SureDash: from n/a through <= 1.0.3.

title: Brainstorm Force Suredash security vulnerability


product: DELUCKS SEO

vendor: DELUCKS

summary: Incorrect Privilege Assignment vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Privilege Escalation.This issue affects DELUCKS SEO: from n/a through <= 2.6.0.

title: Delucks Delucks Seo security vulnerability


product: Stop and Block bots plugin Anti bots

summary: Missing Authorization vulnerability in sminozzi Stop and Block bots plugin Anti bots antibots allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Stop and Block bots plugin Anti bots: from n/a through <= 1.48.

title: Sminozzi Stop And Block Bots Plugin Anti Bots security vulnerability


product: Chatbox Manager

vendor: alexvtn

summary: Missing Authorization vulnerability in alexvtn Chatbox Manager wa-chatbox-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chatbox Manager: from n/a through <= 1.2.5.

title: Alexvtn Chatbox Manager security vulnerability


summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Apollo - Sticky Full Width HTML5 Audio Player lbg-audio5-html5-shoutcast-sticky allows Reflected XSS.This issue affects Apollo - Sticky Full Width HTML5 Audio Player: from n/a through <= 3.4.

title: Lambertgroup Apollo - Sticky Full Width Html5 Audio Player security vulnerability


product: Code Engine

vendor: Jordy Meow

summary: Improper Control of Generation of Code ('Code Injection') vulnerability in Jordy Meow Code Engine code-engine allows Remote Code Inclusion.This issue affects Code Engine: from n/a through <= 0.3.3.

title: Jordy Meow Code Engine security vulnerability


summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player - Addon for WPBakery Page Builder lbg-universal-video-player-addon-visual-composer allows Reflected XSS.This issue affects Universal Video Player - Addon for WPBakery Page Builder: from n/a through <= 3.2.1.

title: Lambertgroup Universal Video Player - Addon For Wpbakery Page Builder security vulnerability


product: Cena Store

vendor: thembay

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Cena Store cena allows PHP Local File Inclusion.This issue affects Cena Store: from n/a through <= 2.11.26.

title: Thembay Cena Store security vulnerability


product: CHMLib

vendor: CHMLib

summary: CHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm_lib.c _chm_decompress_block integer overflow. There is a resultant heap-based buffer overflow in _chm_fetch_bytes.


product: libavif

vendor: aomedia

summary: In libavif before 1.3.0, makeRoom in stream.c has an integer overflow and resultant buffer overflow in stream->offset+size.


summary: In libavif before 1.3.0, avifImageRGBToYUV in reformat.c has integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes.

title: Aomedia Libavif security vulnerability


product: RAGFlow

vendor: infiniflow

product: ragflow

summary: RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset. Codes are six digits and there is no rate limiting.

title: Infiniflow Ragflow security vulnerability


product: PSPP

vendor: GNU

product: pspp

vendor: gnu

summary: libpspp-core.a in GNU PSPP through 2.0.1 has an incorrect call from fill_buffer (in data/encrypted-file.c) to the Gnulib rijndaelDecrypt function, leading to a heap-based buffer over-read.

title: Gnu Pspp security vulnerability


product: sr feuser register extension

summary: The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution.


product: ns backup extension

summary: The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location.


product: femanager extension

summary: The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference.


product: cs seo extension

summary: The cs_seo extension through 9.2.0 for TYPO3 allows XSS.


summary: The ns_backup extension through 13.0.0 for TYPO3 allows command injection.


summary: The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference.


product: ns-backup

vendor: nitsantech

summary: The ns_backup extension through 13.0.0 for TYPO3 allows XSS.


product: reint downloadmanager extension

summary: The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference.


product: Apache HertzBeat (incubating)

vendor: Apache Software Foundation

product: hertzbeat

vendor: apache

summary: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache HertzBeat . The attacker needs to have an authenticated account with access, and the attack can only be triggered by crafting custom commands. A successful attack would result in arbitrary script execution. This issue affects Apache HertzBeat: through 1.7.2. Users are recommended to upgrade to version [1.7.3], which fixes the issue.


product: Booking Calendar Contact Form

vendor: codepeople

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form booking-calendar-contact-form allows Stored XSS.This issue affects Booking Calendar Contact Form: from n/a through <= 1.2.58.

title: Codepeople Booking Calendar Contact Form security vulnerability


product: Xpro Addons For Beaver Builder – Lite

vendor: Xpro

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Addons For Beaver Builder – Lite xpro-addons-beaver-builder-elementor allows Stored XSS.This issue affects Xpro Addons For Beaver Builder – Lite: from n/a through <= 1.5.5.

title: Xpro Xpro Addons For Beaver Builder – Lite security vulnerability


vendor: affmngr

summary: Cross-Site Request Forgery (CSRF) vulnerability in affmngr Affiliates Manager Google reCAPTCHA Integration affiliates-manager-google-recaptcha-integration allows Stored XSS.This issue affects Affiliates Manager Google reCAPTCHA Integration: from n/a through <= 1.0.6.

title: Affmngr Affiliates Manager Google Recaptcha Integration security vulnerability


product: Ultimate Blocks

vendor: Ultimate Blocks

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Blocks Ultimate Blocks ultimate-blocks allows DOM-Based XSS.This issue affects Ultimate Blocks: from n/a through <= 3.3.0.

title: Ultimate Blocks security vulnerability


product: WP Image Mask

vendor: Bogdan Bendziukov

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bogdan Bendziukov WP Image Mask wp-image-mask allows DOM-Based XSS.This issue affects WP Image Mask: from n/a through <= 3.1.2.

title: Bogdan Bendziukov Wp Image Mask security vulnerability


summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bunny.net bunny.net bunnycdn allows Stored XSS.This issue affects bunny.net: from n/a through <= 2.3.0.

title: Bunny.Net security vulnerability


product: Wishlist for WooCommerce

vendor: WPFactory

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce allows Stored XSS.This issue affects Wishlist for WooCommerce: from n/a through <= 3.2.2.

title: Wpfactory Wishlist For Woocommerce security vulnerability


product: AWcode Toolkit

vendor: awcode

summary: Cross-Site Request Forgery (CSRF) vulnerability in awcode AWcode Toolkit awcode-toolkit allows Stored XSS.This issue affects AWcode Toolkit: from n/a through <= 1.0.18.

title: Awcode Awcode Toolkit security vulnerability


summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Product Notes Tab & Private Admin Notes for WooCommerce product-notes-for-woocommerce allows Stored XSS.This issue affects Product Notes Tab & Private Admin Notes for WooCommerce: from n/a through <= 3.1.0.

title: Wpfactory Product Notes Tab & Private Admin Notes For Woocommerce security vulnerability


product: Cost of Goods for WooCommerce

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Cost of Goods for WooCommerce cost-of-goods-for-woocommerce allows Stored XSS.This issue affects Cost of Goods for WooCommerce: from n/a through <= 3.7.0.

title: Wpfactory Cost Of Goods For Woocommerce security vulnerability


vendor: Soft8Soft LLC

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soft8Soft LLC Verge3D verge3d allows Reflected XSS.This issue affects Verge3D: from n/a through <= 4.9.3.

title: Soft8Soft Llc Verge3D security vulnerability


product: Legal Pages

vendor: wpWax

summary: Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Legal Pages: from n/a through <= 1.4.5.

title: Wpwax Legal Pages security vulnerability


product: reCAPTCHA for all

vendor: sminozzi

summary: Cross-Site Request Forgery (CSRF) vulnerability in sminozzi reCAPTCHA for all recaptcha-for-all allows Cross Site Request Forgery.This issue affects reCAPTCHA for all: from n/a through <= 2.26.

title: Sminozzi Recaptcha For All security vulnerability


product: Exclusive Addons Elementor

vendor: Tim Strifler

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor exclusive-addons-for-elementor allows Stored XSS.This issue affects Exclusive Addons Elementor: from n/a through <= 2.7.9.

title: Tim Strifler Exclusive Addons Elementor security vulnerability


product: Quick Contact Form

vendor: Saad Iqbal

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal Quick Contact Form quick-contact-form allows Reflected XSS.This issue affects Quick Contact Form: from n/a through <= 8.2.1.

title: Saad Iqbal Quick Contact Form security vulnerability


product: The Events Calendar

vendor: StellarWP

summary: Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through <= 6.11.2.1.

title: Stellarwp The Events Calendar security vulnerability


product: Shortlinks by Pretty Links

vendor: Blair Williams

summary: Missing Authorization vulnerability in Blair Williams Shortlinks by Pretty Links pretty-link allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortlinks by Pretty Links: from n/a through <= 3.6.15.

title: Blair Williams Shortlinks By Pretty Links security vulnerability


summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Sitewide Discount for WooCommerce: Apply Discount to All Products global-shop-discount-for-woocommerce allows Stored XSS.This issue affects Sitewide Discount for WooCommerce: Apply Discount to All Products: from n/a through <= 2.2.1.

title: Wpfactory Sitewide Discount For Woocommerce: Apply Discount To All Prod… security vulnerability


product: EAN for WooCommerce

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory EAN for WooCommerce ean-for-woocommerce allows Stored XSS.This issue affects EAN for WooCommerce: from n/a through <= 5.4.6.

title: Wpfactory Ean For Woocommerce security vulnerability


summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Coupons & Add to Cart by URL Links for WooCommerce url-coupons-for-woocommerce-by-algoritmika allows Stored XSS.This issue affects Coupons & Add to Cart by URL Links for WooCommerce: from n/a through <= 1.7.7.

title: Wpfactory Coupons & Add To Cart By Url Links For Woocommerce security vulnerability


summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Emails & Recipients for WooCommerce custom-emails-for-woocommerce allows Stored XSS.This issue affects Additional Custom Emails & Recipients for WooCommerce: from n/a through <= 3.5.1.

title: Wpfactory Additional Custom Emails & Recipients For Woocommerce security vulnerability


product: Back Button Widget

vendor: wpfactory

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Back Button Widget back-button-widget allows Stored XSS.This issue affects Back Button Widget: from n/a through <= 1.6.8.

title: Wpfactory Back Button Widget security vulnerability


summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Free Shipping Bar: Amount Left for Free Shipping for WooCommerce amount-left-free-shipping-woocommerce allows Stored XSS.This issue affects Free Shipping Bar: Amount Left for Free Shipping for WooCommerce: from n/a through <= 2.4.6.

title: Wpfactory Free Shipping Bar security vulnerability


summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Change Add to Cart Button Text for WooCommerce add-to-cart-button-labels-for-woocommerce allows Stored XSS.This issue affects Change Add to Cart Button Text for WooCommerce: from n/a through <= 2.2.2.

title: Wpfactory Change Add To Cart Button Text For Woocommerce security vulnerability


product: Broadcast Live Video

vendor: videowhisper

summary: Cross-Site Request Forgery (CSRF) vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-integration allows Cross Site Request Forgery.This issue affects Broadcast Live Video: from n/a through <= 6.2.4.

title: Videowhisper Videowhisper Live Streaming Integration security vulnerability


product: Import Social Events

vendor: Xylus Themes

vendor: xylusthemes

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes Import Social Events import-facebook-events allows Stored XSS.This issue affects Import Social Events: from n/a through <= 1.8.5.

title: Xylusthemes Import Social Events security vulnerability


product: Projectopia

vendor: Projectopia

summary: Missing Authorization vulnerability in Projectopia Projectopia projectopia-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Projectopia: from n/a through <= 5.1.17.

title: Projectopia security vulnerability


product: Mega Menu Block

vendor: jetmonsters

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jetmonsters Mega Menu Block getwid-megamenu allows Stored XSS.This issue affects Mega Menu Block: from n/a through <= 1.0.6.

title: Jetmonsters Mega Menu Block security vulnerability


product: WP Mapa Politico España

vendor: Juan Carlos

summary: Cross-Site Request Forgery (CSRF) vulnerability in Juan Carlos WP Mapa Politico España wp-mapa-politico-spain allows Cross Site Request Forgery.This issue affects WP Mapa Politico España: from n/a through <= 3.8.0.

title: Juan Carlos Wp Mapa Politico España security vulnerability


product: GDPR CCPA Compliance Support

vendor: Ninja Team

summary: Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.3.

title: Ninja Team Gdpr Ccpa Compliance Support security vulnerability


product: MultiVendorX

vendor: MultiVendorX

product: multivendorx

vendor: multivendorx

summary: Insertion of Sensitive Information Into Sent Data vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Retrieve Embedded Sensitive Data.This issue affects MultiVendorX: from n/a through <= 4.2.22.

title: Multivendorx security vulnerability


product: Url Rewrite Analyzer

summary: Missing Authorization vulnerability in M.Code Url Rewrite Analyzer url-rewrite-analyzer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Url Rewrite Analyzer: from n/a through <= 1.3.3.

title: M.Code Url Rewrite Analyzer security vulnerability


summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Stored XSS.This issue affects MultiVendorX: from n/a through <= 4.2.22.

title: Multivendorx security vulnerability


product: Product Code for WooCommerce

vendor: artiosmedia

summary: Cross-Site Request Forgery (CSRF) vulnerability in artiosmedia Product Code for WooCommerce product-code-for-woocommerce allows Cross Site Request Forgery.This issue affects Product Code for WooCommerce: from n/a through <= 1.5.0.

title: Artiosmedia Product Code For Woocommerce security vulnerability


product: Year Make Model Search for WooCommerce

vendor: Pektsekye

summary: Cross-Site Request Forgery (CSRF) vulnerability in Pektsekye Year Make Model Search for WooCommerce ymm-search allows Cross Site Request Forgery.This issue affects Year Make Model Search for WooCommerce: from n/a through <= 1.0.11.

title: Pektsekye Year Make Model Search For Woocommerce security vulnerability


product: Active Products Tables for WooCommerce

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Stored XSS.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.0.6.8.

title: Realmag777 Active Products Tables For Woocommerce security vulnerability


product: WP Pipes

vendor: ThimPress

vendor: thimpress

summary: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes allows Path Traversal. This issue affects WP Pipes: from n/a through 1.4.2.


product: Bot for Telegram on WooCommerce

vendor: Guru Team

summary: Missing Authorization vulnerability in Guru Team Bot for Telegram on WooCommerce bot-for-telegram-on-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bot for Telegram on WooCommerce: from n/a through <= 1.2.6.

title: Guru Team Bot For Telegram On Woocommerce security vulnerability


product: WPAdverts

vendor: Greg Winiarski

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows DOM-Based XSS.This issue affects WPAdverts: from n/a through <= 2.2.3.

title: Greg Winiarski Wpadverts security vulnerability


product: SKT Blocks

vendor: sktthemes

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks allows DOM-Based XSS.This issue affects SKT Blocks: from n/a through <= 2.2.

title: Sktthemes Skt Blocks security vulnerability


product: Leadinfo

vendor: Leadinfo

summary: Missing Authorization vulnerability in Leadinfo Leadinfo leadinfo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadinfo: from n/a through <= 1.1.

title: Leadinfo security vulnerability


product: WP Job Portal

vendor: wpjobportal

summary: Missing Authorization vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through <= 2.3.2.

title: Wpjobportal Wp Job Portal security vulnerability


summary: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpjobportal WP Job Portal wp-job-portal allows Path Traversal.This issue affects WP Job Portal: from n/a through <= 2.3.2.


summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpjobportal WP Job Portal wp-job-portal allows Blind SQL Injection.This issue affects WP Job Portal: from n/a through <= 2.3.2.


product: Visual Header

summary: Missing Authorization vulnerability in dastan800 Visual Header visual-header allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visual Header: from n/a through <= 1.3.

title: Dastan800 Visual Header security vulnerability


product: Visual Composer Website Builder

vendor: Visual Composer

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Stored XSS.This issue affects Visual Composer Website Builder: from n/a through <= 45.11.0.

title: Visual Composer Visual Composer Website Builder security vulnerability


product: Cost Calculator Builder

vendor: Stylemix

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder allows Stored XSS.This issue affects Cost Calculator Builder: from n/a through <= 3.2.74.

title: Stylemix Cost Calculator Builder security vulnerability


product: RSVPMarker

vendor: davidfcarr

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in davidfcarr RSVPMarker rsvpmaker allows SQL Injection.This issue affects RSVPMarker : from n/a through <= 11.5.6.

title: Davidfcarr Rsvpmarker security vulnerability


product: WC MyParcel Belgium

vendor: Richard Perdaan

less_than_or_equal: beta

version_end_including: beta

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Perdaan WC MyParcel Belgium allows Reflected XSS. This issue affects WC MyParcel Belgium: from 4.5.5 through beta.

title: Richard Perdaan Wc Myparcel Belgium security vulnerability


product: AutomatorWP

vendor: Ruben Garcia

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia AutomatorWP automatorwp allows Blind SQL Injection.This issue affects AutomatorWP: from n/a through <= 5.2.1.3.

title: Ruben Garcia Automatorwp security vulnerability


product: MyStyle Custom Product Designer

vendor: mystyleplatform

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mystyleplatform MyStyle Custom Product Designer mystyle-custom-product-designer allows Blind SQL Injection.This issue affects MyStyle Custom Product Designer: from n/a through <= 3.21.1.

title: Mystyleplatform Mystyle Custom Product Designer security vulnerability


product: Majestic Support

vendor: Majestic Support

summary: Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through <= 1.1.0.

title: Majestic Support security vulnerability


summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Majestic Support Majestic Support majestic-support allows SQL Injection.This issue affects Majestic Support: from n/a through <= 1.1.0.

title: Majestic Support security vulnerability


product: Japanized For WooCommerce

summary: Cross-Site Request Forgery (CSRF) vulnerability in shohei.tanaka Japanized For WooCommerce woocommerce-for-japan allows Cross Site Request Forgery.This issue affects Japanized For WooCommerce: from n/a through <= 2.6.40.

title: Shohei.Tanaka Japanized For Woocommerce security vulnerability


product: Falang multilanguage

vendor: sbouey

summary: Cross-Site Request Forgery (CSRF) vulnerability in sbouey Falang multilanguage falang allows Cross Site Request Forgery.This issue affects Falang multilanguage: from n/a through <= 1.3.61.

title: Sbouey Falang Multilanguage security vulnerability


product: ReDi Restaurant Reservation

vendor: catkin

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catkin ReDi Restaurant Reservation redi-restaurant-reservation allows Reflected XSS.This issue affects ReDi Restaurant Reservation: from n/a through <= 24.1209.

title: Catkin Redi Restaurant Reservation security vulnerability


product: Pix 4x sem juros - Pagaleve

vendor: Pagaleve

summary: Deserialization of Untrusted Data vulnerability in Pagaleve Pix 4x sem juros - Pagaleve wc-pagaleve allows Object Injection.This issue affects Pix 4x sem juros - Pagaleve: from n/a through <= 1.6.9.

title: Pagaleve Pix 4X Sem Juros - Pagaleve security vulnerability


product: ElementInvader Addons for Elementor

vendor: Element Invader

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Stored XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.3.5.

title: Element Invader Elementinvader Addons For Elementor security vulnerability


product: Kids Planet

vendor: AncoraThemes

summary: Deserialization of Untrusted Data vulnerability in AncoraThemes Kids Planet kidsplanet allows Object Injection.This issue affects Kids Planet: from n/a through <= 2.2.14.

title: Ancorathemes Kids Planet security vulnerability


product: Kinsley

vendor: bslthemes

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in bslthemes Kinsley kinsley allows PHP Local File Inclusion.This issue affects Kinsley: from n/a through <= 3.4.4.

title: Bslthemes Kinsley security vulnerability


product: Contest Gallery

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through <= 26.0.6.

title: Wasiliy Strecker / Contestgallery Developer Contest Gallery security vulnerability


product: Tourmaster

vendor: GoodLayers

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in GoodLayers Tourmaster tourmaster allows PHP Local File Inclusion.This issue affects Tourmaster: from n/a through <= 5.3.8.

title: Goodlayers Tourmaster security vulnerability


product: Geo Mashup

vendor: Dylan Kuhn

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows PHP Local File Inclusion.This issue affects Geo Mashup: from n/a through <= 1.13.16.

title: Dylan Kuhn Geo Mashup security vulnerability


product: FG Drupal to WordPress

vendor: Kerfred

archetype: ssrf

summary: Server-Side Request Forgery (SSRF) vulnerability in Kerfred FG Drupal to WordPress fg-drupal-to-wp allows Server Side Request Forgery.This issue affects FG Drupal to WordPress: from n/a through <= 3.90.0.

title: Kerfred Fg Drupal To Wordpress security vulnerability


product: Easy Elementor Addons

vendor: hashthemes

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Stored XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.2.5.

title: Hashthemes Easy Elementor Addons security vulnerability


product: UpStore

vendor: skygroup

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup UpStore upstore allows Reflected XSS.This issue affects UpStore: from n/a through <= 1.7.0.

title: Skygroup Upstore security vulnerability


product: Simple Link Directory

vendor: quantumcloud

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Reflected XSS.This issue affects Simple Link Directory: from n/a through < 14.8.1.

title: Quantumcloud Simple Link Directory security vulnerability


product: SEOPress for MainWP

vendor: Benjamin Denis

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Benjamin Denis SEOPress for MainWP seopress-for-mainwp allows PHP Local File Inclusion.This issue affects SEOPress for MainWP: from n/a through <= 1.4.

title: Benjamin Denis Seopress For Mainwp security vulnerability


product: YayExtra

vendor: YayCommerce

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YayExtra yayextra allows SQL Injection.This issue affects YayExtra: from n/a through <= 1.5.5.

title: Yaycommerce Yayextra security vulnerability


product: Groundhogg

vendor: Adrian Tobey

summary: Unrestricted Upload of File with Dangerous Type vulnerability in Adrian Tobey Groundhogg groundhogg allows Upload a Web Shell to a Web Server.This issue affects Groundhogg: from n/a through <= 4.2.1.

title: Adrian Tobey Groundhogg security vulnerability


product: SMTP for SendGrid – YaySMTP

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce SMTP for SendGrid – YaySMTP smtp-sendgrid allows SQL Injection.This issue affects SMTP for SendGrid – YaySMTP: from n/a through <= 1.5.

title: Yaycommerce Smtp For Sendgrid – Yaysmtp security vulnerability


product: FundEngine

vendor: Roxnor

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Roxnor FundEngine wp-fundraising-donation allows PHP Local File Inclusion.This issue affects FundEngine: from n/a through <= 1.7.4.

title: Roxnor Fundengine security vulnerability


product: Post Type Converter

vendor: Kevin Langley Jr.

summary: Cross-Site Request Forgery (CSRF) vulnerability in Kevin Langley Jr. Post Type Converter post-type-converter allows Cross Site Request Forgery.This issue affects Post Type Converter: from n/a through <= 0.6.


product: Google XML News Sitemap plugin

vendor: Gary Illyes

summary: Cross-Site Request Forgery (CSRF) vulnerability in Gary Illyes Google XML News Sitemap plugin gn-xml-sitemap allows Stored XSS.This issue affects Google XML News Sitemap plugin: from n/a through <= 0.02.

title: Gary Illyes Google Xml News Sitemap Plugin security vulnerability


product: Goal Tracker for Patreon

vendor: vikingjs

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vikingjs Goal Tracker for Patreon goal-tracker-for-patreon allows Stored XSS.This issue affects Goal Tracker for Patreon: from n/a through <= 0.4.6.

title: Vikingjs Goal Tracker For Patreon security vulnerability


product: Savyour Affiliate Partner

vendor: developers savyour

summary: Cross-Site Request Forgery (CSRF) vulnerability in developers savyour Savyour Affiliate Partner savyour-affiliate-partner allows Stored XSS.This issue affects Savyour Affiliate Partner: from n/a through <= 2.1.4.

title: Developers Savyour Savyour Affiliate Partner security vulnerability


product: SEO For Images

vendor: kasonzhao

summary: Cross-Site Request Forgery (CSRF) vulnerability in kasonzhao SEO For Images seo-for-images allows Stored XSS.This issue affects SEO For Images: from n/a through <= 1.0.0.

title: Kasonzhao Seo For Images security vulnerability


product: Newsletter subscription optin module

vendor: nonletter

summary: Cross-Site Request Forgery (CSRF) vulnerability in nonletter Newsletter subscription optin module newsletter-subscription-widget-for-sendblaster allows Stored XSS.This issue affects Newsletter subscription optin module: from n/a through <= 1.2.9.

title: Nonletter Newsletter Subscription Optin Module security vulnerability


product: BetPress

vendor: web-able

summary: Cross-Site Request Forgery (CSRF) vulnerability in web-able BetPress betpress allows Stored XSS.This issue affects BetPress: from n/a through <= 1.0.1 Lite.

title: Web-Able Betpress security vulnerability


product: Table Editor

vendor: wptableeditor

summary: Cross-Site Request Forgery (CSRF) vulnerability in wptableeditor Table Editor wp-table-editor allows Cross Site Request Forgery.This issue affects Table Editor: from n/a through <= 1.6.4.

title: Wptableeditor Table Editor security vulnerability


product: Invisible Optin

vendor: OffClicks

summary: Cross-Site Request Forgery (CSRF) vulnerability in OffClicks Invisible Optin invisible-optin allows Stored XSS.This issue affects Invisible Optin: from n/a through <= 1.0.

title: Offclicks Invisible Optin security vulnerability


product: WPAvatar

vendor: WP Chinese Translation

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chinese Translation WPAvatar wpavatar allows Stored XSS.This issue affects WPAvatar: from n/a through <= 1.9.4.

title: Wp Chinese Translation Wpavatar security vulnerability


product: Tripadvisor Shortcode

vendor: kevin heath

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kevin heath Tripadvisor Shortcode tripadvisor-shortcode allows Stored XSS.This issue affects Tripadvisor Shortcode: from n/a through <= 2.2.

title: Kevin Heath Tripadvisor Shortcode security vulnerability


product: Add Code To Head

vendor: salubrio

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in salubrio Add Code To Head add-code-to-head allows Stored XSS.This issue affects Add Code To Head: from n/a through <= 1.17.

title: Salubrio Add Code To Head security vulnerability


product: WordPress HTML

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stanton119 WordPress HTML custom-html-bodyhead allows Stored XSS.This issue affects WordPress HTML: from n/a through <= 0.51.

title: Stanton119 Wordpress Html security vulnerability


product: Responsive Mobile-Friendly Tooltip

vendor: ItayXD

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ItayXD Responsive Mobile-Friendly Tooltip responsive-mobile-friendly-tooltip allows Stored XSS.This issue affects Responsive Mobile-Friendly Tooltip: from n/a through <= 1.6.6.

title: Itayxd Responsive Mobile-Friendly Tooltip security vulnerability


vendor: Stefan Keller

summary: Path Traversal: '.../...//' vulnerability in Stefan Keller WooCommerce Payment Gateway for Saferpay woocommerce-payment-gateway-for-saferpay allows Path Traversal.This issue affects WooCommerce Payment Gateway for Saferpay: from n/a through <= 0.4.9.

title: Stefan Keller Woocommerce Payment Gateway For Saferpay security vulnerability


summary: Cross-Site Request Forgery (CSRF) vulnerability in shen2 duoshuo allows Cross Site Request Forgery.This issue affects : from n/a through <= 1.2.

title: Shen2 security vulnerability


product: Mesa Mesa Reservation Widget

vendor: gslauraspeck

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gslauraspeck Mesa Mesa Reservation Widget mesa-mesa-reservation-widget allows Stored XSS.This issue affects Mesa Mesa Reservation Widget: from n/a through <= 1.0.0.

title: Gslauraspeck Mesa Mesa Reservation Widget security vulnerability


vendor: cuckoohello

summary: Cross-Site Request Forgery (CSRF) vulnerability in cuckoohello baidushare-wp allows Stored XSS.This issue affects : from n/a through <= 1.0.6.

title: Cuckoohello security vulnerability


product: Ultimate twitter profile widget

vendor: dyiosah

summary: Cross-Site Request Forgery (CSRF) vulnerability in dyiosah Ultimate twitter profile widget ultimate-twitter-profile-widget allows Stored XSS.This issue affects Ultimate twitter profile widget: from n/a through <= 1.0.

title: Dyiosah Ultimate Twitter Profile Widget security vulnerability


product: Statify Widget

vendor: Finn Dohrn

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Finn Dohrn Statify Widget statify-widget allows Stored XSS.This issue affects Statify Widget: from n/a through <= 1.4.6.

title: Finn Dohrn Statify Widget security vulnerability


product: Advance Food Menu

vendor: Md Abunaser Khan

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md Abunaser Khan Advance Food Menu advance-food-menu allows Stored XSS.This issue affects Advance Food Menu: from n/a through <= 1.0.

title: Md Abunaser Khan Advance Food Menu security vulnerability


product: tli.tl auto Twitter poster

vendor: khashabawy

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in khashabawy tli.tl auto Twitter poster tlitl-auto-twitter-poster allows Stored XSS.This issue affects tli.tl auto Twitter poster: from n/a through <= 3.4.

title: Khashabawy Tli.Tl Auto Twitter Poster security vulnerability


product: WP Admin Theme

summary: Cross-Site Request Forgery (CSRF) vulnerability in shmish111 WP Admin Theme wp-admin-theme allows Stored XSS.This issue affects WP Admin Theme: from n/a through <= 1.0.

title: Shmish111 Wp Admin Theme security vulnerability


product: Acclectic Media Organizer

vendor: Acclectic Media

summary: Missing Authorization vulnerability in Acclectic Media Acclectic Media Organizer acclectic-media-organizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acclectic Media Organizer: from n/a through <= 1.4.

title: Acclectic Media Acclectic Media Organizer security vulnerability


product: WP Mailgun SMTP

vendor: inkthemes

summary: Missing Authorization vulnerability in inkthemes WP Mailgun SMTP wp-mailgun-smtp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Mailgun SMTP: from n/a through <= 1.0.7.

title: Inkthemes Wp Mailgun Smtp security vulnerability


product: Real Time Validation for Gravity Forms

vendor: Daman Jeet

summary: Cross-Site Request Forgery (CSRF) vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-time-validation-for-gravity-forms allows Cross Site Request Forgery.This issue affects Real Time Validation for Gravity Forms: from n/a through <= 1.7.0.

title: Daman Jeet Real Time Validation For Gravity Forms security vulnerability


summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-time-validation-for-gravity-forms allows Reflected XSS.This issue affects Real Time Validation for Gravity Forms: from n/a through <= 1.7.0.


summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-time-validation-for-gravity-forms allows PHP Local File Inclusion.This issue affects Real Time Validation for Gravity Forms: from n/a through <= 1.7.0.


product: WooCommerce Orders & Customers Exporter

vendor: vanquish

summary: Insertion of Sensitive Information Into Sent Data vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-customers-exporter allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce Orders & Customers Exporter: from n/a through <= 5.0.

title: Vanquish Woocommerce Orders & Customers Exporter security vulnerability


product: Gutenberg Blocks

vendor: PublishPress

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows PHP Local File Inclusion.This issue affects Gutenberg Blocks: from n/a through <= 3.3.1.

title: Publishpress Gutenberg Blocks security vulnerability


product: eForm - WordPress Form Builder

vendor: WPQuark

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPQuark eForm - WordPress Form Builder wp-fsqm-pro allows Reflected XSS.This issue affects eForm - WordPress Form Builder: from n/a through < 4.19.1.

title: Wpquark Eform - Wordpress Form Builder security vulnerability


product: Woo Slider Pro

vendor: BinaryCarpenter

vendor: binarycarpenter

summary: Missing Authorization vulnerability in BinaryCarpenter Woo Slider Pro woo-slider-pro-drag-drop-slider-builder-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Slider Pro: from n/a through <= 1.12.

title: Binarycarpenter Woo Slider Pro security vulnerability


product: Responsive Plus

vendor: CyberChimps

summary: Missing Authorization vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Plus: from n/a through <= 3.2.0.

title: Cyberchimps Responsive Plus security vulnerability


product: Course Builder

vendor: ThimPress

summary: Deserialization of Untrusted Data vulnerability in ThimPress Course Builder course-builder allows Object Injection.This issue affects Course Builder: from n/a through < 3.6.6.

title: Thimpress Course Builder security vulnerability


product: QuickCab

vendor: QuickcabWP

summary: Missing Authorization vulnerability in QuickcabWP QuickCab.This issue affects QuickCab: from n/a through 1.3.3.


product: WP Abstracts

vendor: Kevon Adonis

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows PHP Local File Inclusion.This issue affects WP Abstracts: from n/a through <= 2.7.4.

title: Kevon Adonis Wp Abstracts security vulnerability


product: Profiler - What Slowing Down Your WP

summary: Missing Authorization vulnerability in activity-log.com Profiler - What Slowing Down Your WP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Profiler - What Slowing Down Your WP: from n/a through 1.0.0.

title: Activity-Log.Com Profiler - What Slowing Down Your Wp security vulnerability


product: User Profile Meta Manager

vendor: Danny Vink

summary: Cross-Site Request Forgery (CSRF) vulnerability in Danny Vink User Profile Meta Manager user-profile-meta allows Privilege Escalation.This issue affects User Profile Meta Manager: from n/a through <= 1.02.

title: Danny Vink User Profile Meta Manager security vulnerability


product: Form Maker by 10Web

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through <= 1.15.33.

title: 10Web Form Maker By 10Web security vulnerability


vendor: RedefiningTheWeb

summary: Cross-Site Request Forgery (CSRF) vulnerability in RedefiningTheWeb Dynamic Pricing & Discounts Lite for WooCommerce woo-dynamic-pricing-discounts-lite allows Cross Site Request Forgery.This issue affects Dynamic Pricing & Discounts Lite for WooCommerce: from n/a through <= 2.0.4.

title: Redefiningtheweb Dynamic Pricing & Discounts Lite For Woocommerce security vulnerability


product: WPMU Ldap Authentication

vendor: Aaron Axelsen

summary: Cross-Site Request Forgery (CSRF) vulnerability in Aaron Axelsen WPMU Ldap Authentication wpmuldap allows Stored XSS.This issue affects WPMU Ldap Authentication: from n/a through <= 5.0.1.

title: Aaron Axelsen Wpmu Ldap Authentication security vulnerability


product: Rootspersona

summary: Cross-Site Request Forgery (CSRF) vulnerability in ed4becky Rootspersona rootspersona allows Cross Site Request Forgery.This issue affects Rootspersona: from n/a through <= 3.7.5.

title: Ed4Becky Rootspersona security vulnerability


product: Contact Form 7 Editor Button

vendor: arisoft

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arisoft Contact Form 7 Editor Button cf7-editor-button allows Reflected XSS.This issue affects Contact Form 7 Editor Button: from n/a through <= 1.0.0.

title: Arisoft Contact Form 7 Editor Button security vulnerability


product: Embed and Integrate Etsy Shop

summary: Missing Authorization vulnerability in Embed360 Embed and Integrate Etsy Shop embed-and-integrate-etsy-shop allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Embed and Integrate Etsy Shop: from n/a through <= 1.0.8.

title: Embed360 Embed And Integrate Etsy Shop security vulnerability