| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the listing description (post_content) in versions up to, and including, 2.8.199 This is due to insufficient input sanitization on save (the bundled geodir_kses_safe_embed_attributes() helper only neutralises data-embed-url, data-src and data-embed, while WordPress core wp_kses_post permits data-* attributes on standard HTML tags) combined with the AyeCode UI library initializing every [data-bs-toggle="popover-html"] element with { html: true, sanitize: false }, which inserts the attacker-controlled data-bs-content value into the popover body as HTML at render time. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0. |
| Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. |
| Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions. |
| Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions. |
| Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions. |
| Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions. |
| Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions. |
| Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. |
| Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions. |
| Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions. |
| Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions. |
| Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions. |
| Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. |
| Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions. |
| Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. |
| datamodel-code-generator before 0.84.0 contains a code injection vulnerability that allows attackers to achieve arbitrary code execution by supplying a malicious JSON Schema with a crafted x-python-type annotation containing a string ast.Constant node in a subscript slice position, which bypasses validation in parse_python_type_annotation and _python_type_expr_from_ast. Attackers can embed malicious Python expressions such as __import__ calls within quoted string literals in the generated source code, which Pydantic v2 evaluates as a ForwardRef via eval() during model_rebuild(), resulting in arbitrary code execution on developer workstations, CI/CD pipelines, or applications that generate and import the produced models at runtime. |
| Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions. |
| The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5.6.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the administrator to have enabled Output Buffering, the HtmlDomParser engine, and Aggressive Resolve, as well as a stored-HTML submission surface (such as bbPress anonymous replies) whose kses allow-list preserves img attributes; given these preconditions, a one-shot unauthenticated submission can execute arbitrary JavaScript in the context of any user who views the affected page. |
| The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls and disclose protected files. |
