| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated usernames, and activity timestamps. |
| Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the `ninja-forms/submissions-table` Gutenberg block that allows authenticated attackers with Author-level privileges to expose stored form submissions to unauthenticated visitors by embedding the block with an arbitrary formID on a published post. Attackers can retrieve the signed bearer token injected into every page visitor's browser via `wp_localize_script` and use it against the REST API submissions endpoint to access all saved form submission field values, including sensitive personally identifiable information such as names, email addresses, and phone numbers. |
| Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions. |
| Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions. |
| The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The required waic-nonce is emitted on the front-end whenever the [waic_form] or [aiwu-form] shortcode is rendered, enabling contributor-level users who can publish shortcodes to obtain a valid nonce and reach the vulnerable AJAX handler, which performs no capability check beyond nonce verification when the shortcodes are not already embedded in a page. |
| The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_order_status_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with staff-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. |
| Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions. |
| Subscriber Arbitrary Content Deletion in WP EasyPay <= 4.5.0 versions. |
| Subscriber Broken Access Control in WP ERP <= 1.17.5 versions. |
| Unauthenticated SQL Injection in Bookly <= 27.7 versions. |
| Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions. |
| Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor <= 1.6.2 versions. |
| Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions. |
| Unauthenticated Broken Access Control in Graphina <= 3.1.12 versions. |
| Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions. |
| Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions. |
| Contributor Broken Access Control in Style Kits <= 2.6.5 versions. |
| Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Exploiting this flaw can lead to unauthorized database access and data leakage. |
| Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated arbitrary file deletion. |
| Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions. |
