Stored cross-site scripting in the WPMobile.App - Android and iOS App Builder plugin for WordPress (all versions up to and including 11.84) allows unauthenticated attackers to inject arbitrary JavaScript that is persisted and later executed in the browser of any user who opens the affected page. Exploitation is gated by configuration: the site's content mode must be set to 'webview' (i.e., the 'speed' option is not '1'), a still-supported but no longer default mode, and a victim must subsequently load the poisoned page, which is why the assessed vector carries High attack complexity and Scope Change (CVSS 5.4). At time of analysis no public exploit code has been identified and there is no indication of confirmed active exploitation (CISA KEV); the plugin's public source, however, makes the injection path independently reviewable.
Local privilege escalation in OpenLiteSpeed before 1.9.3 lets an attacker who already controls the low-privileged 'nobody' web-server process escalate to root by exploiting a time-of-check/time-of-use race in the admin/misc/lsup.sh auto-update script, which fetches, extracts and executes update packages as root from the nobody-writable /usr/local/lsws/autoupdate/ directory with no integrity verification. Realistic exploitation requires three preconditions together - existing code execution as 'nobody', an administrator-triggered update, and winning the race to replace the package before root runs its install.sh - so the flaw is genuine but conditional rather than remotely weaponizable; no public exploit code has been identified at time of analysis (no CISA KEV entry). The vendor fix in 1.9.3 adds SHA-256 checksum verification of downloaded packages, a mode-0700 update directory that refuses symlinks, HTTPS-only downloads with redirects refused, and a proper lock file.
Unauthenticated attackers can read, create, update, clone, and delete the email notification flows of the WPCafe - Restaurant Menu, Online Food Ordering & Table Booking System WordPress plugin in all versions up to and including 3.0.19, because the plugin fails to verify that a caller is authorized before processing flow-management requests (CWE-862). The exposed endpoints require no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), no user interaction, and no special configuration, since Email_Automation_Service_Provider::is_enable() unconditionally returns true and five pre-configured email flows ship with the plugin on activation; the practical result is attacker-controlled reservation confirmation, cancellation, and admin alert emails sent from the site's legitimate address, plus outright destruction of those flows. No public exploit code identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV); the supplied assessment rates impact as low across confidentiality, integrity, and availability and constrains the damage to the plugin's email notification subsystem rather than the wider WordPress site.
Sensitive customer data disclosure in WPZOOM Connect through 4.7.3 allows an authenticated low-privilege WooCommerce customer/subscriber to retrieve full customer card data for any arbitrary victim email, including names, WordPress user IDs, order histories, totals, purchased products, payment method labels, and EDD Software Licensing license keys with status and activation counts. The issue is caused by the 'x-yamidoo-signature' printed by inline_js() being forgeable: an attacker registers a crafted email whose local part encodes the target timestamp and victim email, making verify_request() accept the signature; share_customer_data and identify_logged_in are enabled by default, so no non-default configuration is required. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact but no integrity/availability impact, and no public exploit code or CISA KEV active exploitation was identified at time of analysis.
Denial of service in Bouncy Castle for Java (bc-java before 1.86 and bc-lts-java before 2.73.13) arises because the legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families derive keys using an iteration count read from untrusted input without upper or lower bounds, so a tiny amount of attacker-controlled data can force an unbounded amount of CPU work before any validation occurs. Unauthenticated remote attackers can trigger the condition by supplying crafted PKCS12PBEParams/PBEParameter encodings or a PKCS#12 PBE-protected private key that the application processes through the raw JCA provider, including the common javax.crypto.EncryptedPrivateKeyInfo.getKeySpec() path; impact is availability-only (CPU/time exhaustion) with no confidentiality or integrity effect, and the assessed severity is moderate (CVSS 3.1 5.3, A:L). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) information for this issue.
Open redirect in LaraDashboard before 1.4.8 allows remote attackers to steer an authenticated user who holds email-template permissions to an attacker-controlled phishing site after that user saves an email template. The flaw lives in the EmailTemplateController builder and builderEdit endpoints, which accepted a redirect_url query parameter and used it verbatim as the post-save navigation target, with the same raw value also flowing into the React LaraBuilder front end via the mount element's data-redirect-url attribute. Exploitation requires passive user interaction (UI:P); the attacker needs no authentication of their own against the endpoint (PR:N), but the victim must be a logged-in user with email-template rights who opens a crafted builder link and then triggers a save. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the impact is bounded to redirection-based phishing rather than direct compromise of the application, consistent with a medium-severity (CVSS 4.0 base 5.3; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) rating.
Server-side request forgery in Open Identity Platform OpenAM before 16.1.3 allows an authenticated attacker holding the privilege to register or modify OAuth 2.0 / OpenID Connect clients to make the OpenAM server fetch arbitrary internal resources through an unvalidated client jwks_uri. The vulnerable dereference occurs on the OIDC client-authentication and ID-token validation paths, so the resulting fetches are made by OpenAM itself and can be aimed at internal hosts, cloud metadata endpoints or local files, or abused to consume request threads for a low-impact denial of service. Exploitation requires PR:L per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L (CVSS 4.0 base 5.3); no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Stored cross-site scripting in W (wcms) through 3.18.0 lets unauthenticated attackers plant persistent JavaScript that executes in the browser session of an administrator or editor. Two injection paths are present: the username submitted with a failed login is stored and later rendered unescaped in the adminlog.php log viewer, and a visitor-supplied comment website URL is echoed unescaped into an href attribute in editrightbar.php. The payload only fires when a privileged user opens the affected admin page (CVSS 4.0 UI:P; our independent assessment agrees with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis.
An insecure direct object reference (IDOR) in the UVdesk support-center-bundle before version 1.1.3.3 lets any authenticated customer submit or overwrite the satisfaction rating on tickets owned by other customers by supplying arbitrary ticket IDs to the rateTicket action. The flaw is limited to rating tampering: it grants no read access to other customers' ticket content, no account takeover, and no code execution, which is why it is assessed as medium severity (CVSS 3.1 base 5.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Exploitation requires a valid, low-privileged customer account and knowledge or enumeration of target ticket IDs; no public exploit code was identified at time of analysis, and the issue is fixed upstream in 1.1.3.3.
Cross-site scripting in Showdown through 2.1.0 allows an attacker to break out of the href and src attributes of rendered markdown links and images by placing a double quote in the destination URL followed by an event handler such as onerror or onmouseover. The makehtml.link and makehtml.image subparsers concatenate the unescaped URL directly into quoted attributes, so the injected handler executes in the victim's browser when the rendered HTML is displayed. The flaw is unauthenticated from the attacker's side (CVSS 4.0 vector PR:N) but requires the victim to view the rendered output (UI:P); it is only exploitable when the host application renders attacker-influenced markdown without a secondary output sanitizer, and per the upstream patch comments the CommonMark-spec (cmSpec) flavors percent-encode URLs and are not affected. No KEV, EPSS, or active-exploitation telemetry was supplied with this report, and no public exploit identified at time of analysis, although the upstream fix commit includes regression test cases containing the exact injection payloads.
Reflected cross-site scripting in OpenIdentityPlatform OpenAM before 16.1.3 allows unauthenticated attackers to run JavaScript in the OpenAM origin by luring a victim to a crafted /oauth2/authorize link whose repeated query parameters are echoed without encoding on the OAuth2 authorization error page. Exploitation requires user interaction (UI:P) and is most damaging when the victim already holds an active OpenAM session, because the injected script can then ride that session or redirect the user to a phishing page; deployments exposing the OAuth2 endpoint with default settings are in scope. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, making this a moderate-severity (CVSS 5.3) issue rather than an emergency patch-and-pray event.
OpenAM versions before 16.1.3 allow unauthenticated attackers to inject arbitrary content into notification emails sent by the forgotPassword and register self-service endpoints (/json/{realm}/users). By supplying subject and message fields, an attacker can craft phishing messages that appear to originate from the organization's configured From address, or misuse the register action to relay email to arbitrary recipients. No public exploit code has been identified at the time of analysis, and the vendor has released version 16.1.3 to address the improper input validation (CWE-20).
Stored cross-site scripting in Formbricks allows an authenticated workspace member holding only the lower-privileged readWrite role to inject arbitrary JavaScript into a survey through the survey-level Custom Head Scripts feature, which failed to enforce the documented Manage permission boundary. Because the injected scripts run inside the authenticated browser session of any user who opens the affected survey, a low-privileged member can execute code in the session of higher-privileged users such as Manage-role holders or administrators. Exploitation requires a valid in-workspace account (CVSS PR:L) and a separate victim who actually opens the survey (UI:P), and the issue is remediated in Formbricks 5.4.4 and 6.0.1, which re-enforce the Manage requirement for modifying survey Custom Head Scripts; no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in IDURAR ERP CRM through version 4.1.1 lets any authenticated user with upload privileges plant JavaScript-bearing SVG files through the profile-update or settings upload endpoints; the scripts then execute in a victim's browser when the file is loaded from the application's /public route. Because the upload middleware (backend/src/middlewares/uploadMiddleware/utils/fileFilterMiddleware.js) does not sanitize SVG content, the injected script inherits the application's origin and can read or alter data the victim is authorized to see. The attack requires a valid account (PR:L) and a victim who views the malicious file (UI:P), so it is an interaction-dependent, client-side issue rather than a direct server compromise; no public exploit code was identified at time of analysis, and the vendor has not published a fixed release.
Stored cross-site scripting in Shopclass versions before 6.2.0 lets a self-registered, non-administrative user with listing-posting rights embed persistent JavaScript in an item description, which then executes in the site origin for every visitor who views that listing - including the listing author. The flaw only exists on sites where an administrator has explicitly enabled the non-default "use TinyMCE on the frontend" option, because the rich-editor path in ItemActions.php::prepareData() disables Params' tag-stripping XSS check and, prior to the fix, stored the description verbatim with no replacement sanitization. Authentication is required (low-privileged account) and a victim must view the crafted listing, and no public exploit code has been identified at time of analysis; the vendor shipped an HTMLPurifier-based allow-list fix in 6.2.0 (commit c196f709) and the advisory is credited to VulnCheck.
Reflected cross-site scripting in the SAML load-balancer cookie bounce auto-submit page of OpenIdentityPlatform OpenAM allows crafted SAML message, RelayState, or target URL values to execute attacker-controlled script in the OpenAM origin for any user who loads the resulting page (CVSS 4.0 base 5.1; independently assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N). Two prerequisites sharply limit real-world exposure: the page is only reachable when the non-default cookieHashRedirectEnabled load-balancer setting is enabled, and in all released versions of OpenAM before 16.1.3 an unrelated HTTP 500 failure aborts the request before the injected payload can run, making the defect latent in shipped builds. No public exploit identified at time of analysis, and the issue requires unauthenticated remote delivery of crafted input plus a victim actively loading the page. Fixed in OpenAM 16.1.3.
Decoding an attacker-crafted APV bitstream with the Academy Software Foundation's OpenAPV reference implementation before version 1.1.1.0 can overflow a heap buffer in the read_bitstream/decoder path, because integer wraparound in the frame buffer-size calculation lets a too-small allocation pass the internal size check. The affected component is the oapvd decoder and the oapv_app_dec sample application; no authentication or non-default configuration is required, but the attack vector is local (AV:L), so exploitation requires the victim to open or process a malicious .apv-style file. Vendor-rated impact is limited (low confidentiality, integrity, and availability per the assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L vector), consistent with a crash or constrained memory corruption rather than reliable code execution, and no public exploit code or CISA KEV active-exploitation record was identified at time of analysis.
Stored cross-site scripting in the SEOPress - AI SEO Plugin & On-site SEO for WordPress (all versions up to and including 10.2) lets authenticated attackers with subscriber-level access inject arbitrary web scripts through the 'seopress_google_analytics_matomo_id' setting, which then execute in the browser of any user who views a page rendering the stored Matomo ID. Exploitation is gated by a non-default prerequisite: an administrator must have explicitly delegated Analytics management capability to the Subscriber role via the plugin's Advanced > Security settings, without which subscribers cannot reach the vulnerable setting, and the injected payload only fires when a victim subsequently visits an affected page. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS base score of 4.9 (Medium) reflects the opt-in configuration and user-visit dependency that limit real-world exploitation.
Improper authentication in the Burst Statistics - Simple WordPress Analytics (Google Analytics Alternative) plugin, in all versions up to and including 3.7.1, lets anyone holding a valid `burst_share_token` receive a genuine WordPress session cookie for the `burst_statistics_viewer` account because the `maybe_load_shared_dashboard()` handler calls `wp_set_auth_cookie()` for token-bearing visitors. Once authenticated as that account, an attacker can drive core's self-service `/wp-json/wp/v2/users/me` password-update endpoint - the plugin blocks Application Passwords for the `burst_viewer` role but never filters the endpoint or the `edit_user` capability - and set an attacker-chosen password, giving a permanent takeover of the limited-privilege (`view_burst_statistics`) account that survives share-token revocation, token expiration, and the plugin's daily `cleanup_viewer_sessions()` routine. Exposure is bounded: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3) is scored low-privilege specifically because a valid share token is a prerequisite, so sites that never generate or circulate share tokens are not reachable, and there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Authorization bypass in the Alt Text AI WordPress plugin (≤1.10.41) allows any authenticated user with subscriber-level access to overwrite the content of arbitrary posts and pages with LLM-generated text, enabling SEO poisoning and unauthorized consumption of the site owner's AltText.ai API credits. The vulnerability is a low-severity (CVSS 4.3) missing authorization check (CWE-862) that is exploitable because the required nonce is trivially obtainable on the subscriber-accessible profile page. No public exploit has been identified at time of analysis, and the vendor has published a code changeset that appears to remediate the issue.
Authenticated users with subscriber-level access or above on WordPress sites running the Helpdesk Support Ticket System for WooCommerce plugin version 2.1.6 or earlier can delete support ticket responses belonging to other users by supplying any stsw_responses row ID to the plugin's deletion handler. The root cause is an insecure direct object reference (CWE-639) in the 'id' parameter, where the plugin performs no ownership or capability validation on the user-controlled key; the only extra step needed is harvesting the deletion nonce that the plugin exposes in the admin footer. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; CVSS 3.1 rates it 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), consistent with a low-integrity impact limited to unauthorized deletion rather than data disclosure or site compromise.
Open redirect in OpenIdentityPlatform OpenAM deployments prior to 16.1.3 lets unauthenticated attackers bounce victims from a trusted OpenAM host to a post-logout URI registered to a named realm client. The /oauth2/connect/endSession endpoint consumes the id_token_hint JWT without verifying its cryptographic signature (CWE-347), so an attacker can forge a hint that names any existing OAuth2/OIDC client in a realm and steer the logout response toward that client's registered post_logout_redirect_uri, producing phishing links that inherit the OpenAM server's trust. Exploitation requires victim user interaction (a clicked crafted link), carries high attack complexity with a present attack requirement, and is constrained because the destination must already be registered to the abused client; no public exploit code has been identified at time of analysis, and no KEV entry exists. Independent assessment rates this as a genuinely low-priority, internally consistent issue, consistent with the low CVSS 4.0 base score of 2.3.
ImageMagick 7.x before 7.1.2-32 and 6.x before 6.9.13-57 silently discard the entire contents of a deployment's security policy when policy.xml carries a DOCTYPE declaration whose syntax does not end in ']>', so every restriction the administrator intended (e.g. blocking coders, delegates, or resource-heavy formats) is ignored and the previously forbidden operations succeed. Exploitation is local and privileged: the CVSS 4.0 vector scores it 1.8 (AV:L/AC:H/AT:P/PR:H/UI:N), meaning an actor with high privileges who can write or influence the privileged policy.xml file - or an administrator who authors a non-conforming DOCTYPE by accident - is the trigger, and the bug has no effect on default installations that ship no restrictive policy. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; vendor patches are available in 7.1.2-32 and 6.9.13-57, so this is assessed as a genuinely low-priority hardening issue rather than an urgent remote threat.