Denial of service in GCC libstdc++ occurs when an affected application extracts data into a std::bitset from a wide-character (wchar_t) stream and the library's internal stack buffer is sized without accounting for character size and alignment, producing a stack-based buffer overflow. The vendor vector is network-reachable and unauthenticated (AV:N/PR:N/UI:N) but high complexity (AC:H), and the independent assessment limits impact to a crash (A:H, no confidentiality or integrity impact); real exposure requires an application that exposes this specific wide-character bitset extraction path to untrusted input, which is uncommon. No public exploit was identified at time of analysis and the CVE is not in CISA KEV.
Authenticated HotCRP users can unmask the authors of anonymous reviews and comments by probing the `cmt:USER` search term, which matches papers where a visible comment was written by USER without checking whether the commenter's identity is supposed to be disclosed. The flaw was introduced with the `cmt:` search term in v2.101 (2017) and affects installations through the 3.3 fix line; exploitation requires a logged-in account with search access plus a paper whose comment is visible while the commenter's identity is hidden - the classic anonymous or double-blind review configuration - and candidate usernames must be enumerated or guessed. Impact is confidentiality-only (reviewer anonymity), no public exploit code was identified at time of analysis, and the vendor's fix commit c4b008e756650db3063e8dd8300127936aae9ec1 adds an explicit comment-identity visibility check.
Cloud Foundry's Cloud Controller (CAPI) writes sensitive material into audit log records, so custom buildpack credentials, syslog drain URL credentials and service-binding parameters become readable by anyone with access to those audit events. Exploitation requires an authenticated principal (CVSS PR:L) who can read CAPI audit events and the occurrence of ordinary operations such as applying, creating or updating an app manifest, creating a user-provided service instance with a syslog drain URL, or binding a service. The exposure is passive - secrets are recorded whether or not an attacker does anything - so impact is bounded by how widely audit-event read access is granted in a given deployment; no public exploit code has been identified at time of analysis and the issue is a moderate-priority disclosure rather than an emergency.
Unauthenticated deletion of arbitrary non-PHP files inside wp-content/uploads/ affects every version of the Forminator Forms WordPress plugin up to and including 1.55.0.2. The plugin trusts upload field metadata supplied in POST requests for draft submissions, and when a later draft is linked to the poisoned one through the previous_draft_id parameter, that attacker-controlled metadata is used as the file path for a delete operation. No KEV entry, no EPSS signal and no public exploit code were identified at time of analysis; exploitation is limited to media and attachments rather than code execution, since PHP files and paths outside the uploads directory are out of scope, keeping this a moderate-priority issue slated for this-month handling rather than emergency response.
Heap-based memory corruption in GStreamer's gst-plugins-bad H.265 parser allows unauthenticated remote attackers to crash applications that decode attacker-supplied HEVC media, giving a denial-of-service impact only with no confidentiality or integrity effect. The victim must actively open or play the crafted bitstream (CVSS UI:R), and the flaw is limited to a fixed-size array overrun triggered when the parser mishandles Screen Content Coding palette predictor initializer values. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is rated moderate for routine patching rather than emergency response.
Unbounded DAG pinning in the Filecoin Pin pinning daemon through 1.1.0 lets a caller holding a valid access token - or any caller when the server runs with ALLOW_NO_AUTH=true - exhaust disk, network, CPU, memory and libp2p resources by submitting a CID that resolves to a very large DAG, degrading or crashing the process or host and leaving oversized partial CAR files that require manual recovery. The issue is availability-only (CVSS 6.5, C:N/I:N/A:H) and authentication is required per the vector (PR:L); the advisory ships a public PoC request referencing a caller-supplied origins peer, but it is a reference that is not verified as working exploit code, and the CVE is not in CISA KEV. Exploitation is conditional: each per-pin Helia node has no bootstrap or mDNS configuration so a bare CID may not be fetchable, the daemon binds to localhost by default and refuses to start without a token, so realistic exposure is limited to daemons reachable beyond localhost, shared tokens among untrusted users, or deliberately enabled no-auth mode.
Shopper versions prior to 2.10.1 expose administrator and staff profile records to low-privileged admin-panel users through an insecure direct object reference in the customer detail route `/cpanel/customers/{user}/show`. Any account holding `access_dashboard` and `read_customers` can substitute an arbitrary user ID and receive profile data for accounts that the separate team-management interface protects behind the stronger `view_users` permission; differing 200/403/404 responses also permit user-ID enumeration, and if the same role holds `delete_customers` the `anonymizeAction()` may operate on the unrestricted loaded user model. Exploitation requires a valid authenticated staff session (PR:L) and same-table staff/customer accounts, and the vendor advisory ships a step-by-step proof-of-concept reproduction; the trigger is an ordinary authenticated request with a modified URL path segment rather than any special product configuration.
Request smuggling in Undertow's ChunkReader lets a remote attacker bypass the chunk-size limit using a crafted 15-digit chunk length, overflow internal state flags, and force the server to end a request body early so the trailing bytes are reinterpreted as a second, smuggled request. Red Hat ships the affected Undertow code in JBoss Enterprise Application Platform 7 and 8, Fuse 7, Red Hat Single Sign-On 7, the Red Hat build of Apache Camel for Spring Boot 4, and Red Hat Enterprise Linux 8 and 9, scored CVSS 3.1 6.5 with low integrity and availability impact and no confidentiality impact. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; real-world consequence is concentrated in deployments where Undertow shares connections with, or sits behind, a front-end proxy or load balancer whose parser disagrees on message boundaries, while standalone deployments without connection reuse are largely limited to premature termination of the attacker's own request.
Privilege escalation in Cloud Foundry's Cloud Controller API (CAPI) lets an account that holds only the SpaceSupporter role perform start-command and buildpack-action modifications that are supposed to require SpaceDeveloper privileges, and then abuse that capability to read the credentials of services bound to applications in the space. Deployments running the Cloud Foundry Controller (CAPI) and CF-Deployment are in scope per the published CPE data, and exploitation requires a valid account already granted SpaceSupporter on a space containing apps with bound services, plus an app staging or restart so the malicious start command or buildpack executes. No public exploit code has been identified at time of analysis and there is no KEV listing; the reported priority is remediation this month, and the separate assessment classifies this as a genuine but contained privilege-escalation issue rather than a top-tier emergency.
Missing authorization checks in the Drupal Commerce Core contrib module (2.x releases up to 2.41 and 3.0.0 through 3.3.13) allow forceful browsing, so a remote request can reach an endpoint or operation that the module should have gated behind an access check, yielding limited reads and modifications (CVSS 6.5, C:L/I:L, no availability impact). Drupal contributed-module installs are the exposure surface; sites on other CMS platforms or without Commerce enabled are unaffected. There is no KEV listing and no public exploit identified at time of analysis, and EPSS is low at 0.22% (13th percentile), so the consistent read is a real-but-not-urgent access-control defect; a vendor patch is available, which places this in normal monthly maintenance rather than emergency response.
Out-of-bounds memory corruption in Chrome's MediaStream component (versions prior to 156.0.8078.79) allows a remote attacker to read memory inside the renderer sandbox by convincing a victim to load a crafted HTML page. Per the CVSS vector the attack is network-reachable and needs no authentication (PR:N), but requires user interaction (UI:R) - the victim must open the malicious page - and the assessed impact is confidentiality-only (C:H, I:N, A:N), with no sandbox escape or code execution claimed. No public exploit or exploit code has been identified at time of analysis (SSVC exploitation: none; EPSS 0.18%, 7th percentile), and the vendor has released a fixed build, so this is a this-month, patch-on-normal-cadence item rather than an emergency.
Drupal's Entity Reference Manager contrib module (Merge entities submodule) versions 0.0.0 through 1.0.3 fail to enforce proper authorization on its merge-entity functionality, allowing forceful browsing to reach routes a user should not be permitted to access. Sites are affected only where this optional contrib module is installed and enabled; impact is limited to partial confidentiality and integrity with no availability effect, and the trigger conditions are not fully described in the available sources. No KEV listing or confirmed public exploit code exists, EPSS is low at 0.15% (5th percentile), and a vendor patch is available.
Incorrect authorization in the Drupal Actstream contributed module lets remote unauthenticated visitors reach protected activity-stream resources through forceful browsing, yielding limited reads and modifications of data they should not be able to touch (CVSS 6.5, C:L/I:L/A:N). Sites running Actstream in the affected ranges - 0.0.0 up to but not including 2.0.1, and 2.1.0 up to but not including 2.1.1 - are exposed only if this contributed module is installed and unpatched; Drupal core is not implicated. No public exploit code has been identified at the time of analysis, EPSS is 0.14% (4th percentile), and the issue is not in CISA KEV, so this is a moderate-severity, lower-priority item rather than an emergency.
Missing authorization in the Drupal Xray Audit contrib module allows unauthenticated remote visitors to reach protected routes directly, a forceful-browsing condition affecting the 1.x branch through 1.6.3, the 2.x branch through 2.0.4, and the 3.x branch through 3.1.1. Only Drupal sites that have installed and enabled this optional auditing module are exposed, so deployment scope is narrow; the advisory rates the issue CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), with limited confidentiality and integrity impact and no availability impact. No public exploit code has been identified at the time of analysis (EPSS 0.13%, 3rd percentile), CISA SSVC records exploitation as none, and a vendor patch is available, so this is prioritised for patching this month rather than as an emergency.
A NULL-pointer dereference in the picotls TLS 1.3 library crashes any process that uses picotls as its client-side TLS stack when a malicious or man-in-the-middle peer answers a handshake with a HelloRetryRequest followed by a spoofed Hello message. Only builds up to and including revision 44bc503 are affected; the flaw is fixed in commit a06ca41. Impact is availability-only (process termination, no code execution or data disclosure), and the client must be induced to connect to the hostile peer, which is why the assessed vector carries a user-interaction requirement. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated filesystem path injection in Immich's machine-learning service (vulnerable through 3.0.3, fixed in 3.3.0) lets any client that can reach port 3003 supply an arbitrary cache_dir through the /predict options object, turning model download into an arbitrary-directory write and, on a provoked model-load failure, into a recursive delete of an attacker-chosen path. The endpoint has no authentication on any route and the release docker-compose publishes 3003:3003, so the flaw is reachable pre-auth wherever the ML port is exposed; an attacker-shaped request that sets cache_dir to a mounted media or data volume can corrupt or destroy stored files, bounded by the ML process's filesystem permissions. The model-name allowlist prevents escalation to arbitrary-model deserialization or code execution despite the RCE/deserialization tags attached to this record; a validated proof-of-concept request is documented in the vendor advisory and was executed against the real shutil.rmtree code path, and no CISA KEV listing or confirmed in-the-wild exploitation is present in the available data. The CVE record carries CVSS 6.5 while the upstream advisory and our independent assessment score it 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), reflecting full pre-auth integrity and availability impact when the ML port is reachable.
Cross-site scripting in WP Customer Area through version 8.4.0 allows a Subscriber-level authenticated user to inject script that executes when another user views affected plugin content. The CVSS 3.1 score is 6.5 with PR:L and UI:R, so exploitation requires a valid low-privilege account and victim interaction; the exact vulnerable field is not disclosed in the available sources. No public exploit was identified at time of analysis, and the provided intelligence does not indicate confirmed active exploitation (CISA KEV).
Unauthenticated broken access control in the GiveWP WordPress donation plugin through version 4.19.0.1 lets remote attackers reach plugin operations that should require authorization, yielding limited confidentiality and integrity impact with no availability effect (CVSS 6.5). The assessed vector is AV:N/AC:L/PR:N/UI:N, so no credentials and no user interaction are needed, although the specific endpoint or parameter that lacks its capability check is not disclosed in the available sources. No CISA KEV entry and no public exploit code were identified at time of analysis, and the issue is scoped in the this_month (routine monthly patching) priority band rather than as an emergency.
Unauthenticated arbitrary content deletion in Masteriyo LMS 3.4.3 and earlier lets remote attackers remove content from WordPress sites without authentication or user interaction. The issue is a missing authorization check (CWE-862) in the LMS plugin, and the supplied sources do not identify the exact endpoint or feature that triggers deletion. It is a genuine but mid-tier priority for this-month remediation; no public exploit has been identified at time of analysis and no CISA KEV confirmation is present in the supplied data.
The HUSKY plugin (Products Filter Professional for WooCommerce, vendor realmag777) at version 1.4.6 and earlier exposes sensitive data to unauthenticated remote visitors: per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required to reach the exposure. The impact is rated moderate (CVSS 6.5) with limited confidentiality effect (C:L) and no availability impact, and the available sources do not specify which plugin feature, endpoint, or configuration actually triggers the disclosure or which data is revealed. Neither CISA KEV listing nor public exploit code is present in the supplied intelligence, and no EPSS score was provided, so this is tracked as a this-month remediation item rather than an emergency; exposure is limited to WordPress sites that have this specific plugin installed and active.
Stored/subscriber cross-site scripting in the MultiVendorX WordPress plugin affects sites running versions through 5.0.20 and lets an authenticated subscriber-level account place script content that executes when a victim views it, potentially in a higher-privileged browser context because the assessed vector includes a scope change. The issue is moderate severity (CVSS 6.5), reported by Patchstack, and requires user interaction for exploitation. No public exploit code or CISA KEV entry was identified in the available intelligence.
Missing authorization checks in the WordPress plugin Booking and Rental Manager (vendor magepeopleteam) through version 2.8.2 let an authenticated subscriber-level account reach functionality or data that should require higher privileges, resulting in disclosure of confidential information. The flaw is network-reachable with low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5), and impact is limited to confidentiality - no integrity or availability effect is indicated. No public exploit code and no confirmed active exploitation were identified in the supplied data, and the priority label is this_month rather than act_now; the practical exposure hinges on whether the target site permits self-registration, since any visitor can then obtain the required subscriber account.
Cross-site scripting (CWE-79) in the WPEverest 'User Registration' plugin for WordPress, affecting versions up to and including 5.3.0, allows an attacker holding a subscriber-level account to inject script that executes in a victim's browser session, scoring CVSS 6.5. Exploitation is constrained: the attacker must be an authenticated subscriber (PR:L, which presupposes that user registration is enabled on the target site), a victim must view the injected content (UI:R), and the resulting impact lands in the victim's browser context rather than the server (S:C). No public exploit code has been identified at time of analysis, and the flaw is not in CISA KEV; the vuln.today decision label is 'this_month', indicating scheduled rather than emergency remediation.
Stored cross-site scripting (CWE-79) in the Ultimate Addons for Elementor - Lite plugin (slug header-footer-elementor) affects every release through 2.9.5. An authenticated WordPress user who holds enough privilege to save content into the affected plugin fields can persist a script payload that later executes in the browser of another user who loads the page or screen rendering it, giving a scope-changed (S:C) impact rated 6.5 under CVSS 3.1. The flaw requires an account (PR:L) and victim interaction (UI:R); it is not listed in CISA KEV and no public exploit was identified at time of analysis, so it should be handled as a routine, prioritized patch within the current monthly cycle rather than an emergency.
PHP local file inclusion in the Unlimited Elements For Elementor plugin (versions through 2.0.26) lets an authenticated low-privileged user on a WordPress site cause the plugin to include a filename they influence, disclosing the contents of local files. The CVSS vector (AV:N/AC:L/PR:L/UI:N, C:H/I:N/A:N) confirms the main barrier is that a valid low-privilege account is needed; there is no integrity or availability impact, only confidentiality loss. This is a moderate-priority issue rather than an emergency - no CISA KEV entry, no public exploit reference, and the trigger details (the specific endpoint or parameter that controls the include path) are not described in the available sources, with no vendor patch version yet identified in the provided data.
SQL injection in the Majestic Support help desk plugin for WordPress (all versions up to and including 1.2.2) lets any authenticated user at Subscriber level or above append additional SQL into existing help-desk queries and read sensitive data from the site database, with confidentiality fully impacted but no integrity or availability effect. The login requirement is a weak barrier: the 'saveusereraserequest' task is whitelisted for front-end customer use, the plugin auto-provisions a help-desk record for every WordPress account, and the only guard is a nonce the attacker legitimately retrieves from their own 'Add erase request' page, so any site with open registration is effectively exposed to any self-registered user. No public exploit code has been identified at time of analysis, the issue is rated moderate priority (CVSS 6.5, PR:L, UI:N) rather than an emergency, and the vendor has published a fixed release, 1.2.3.
Unauthenticated visitors to WordPress sites running Ad Inserter through version 2.8.19 can trigger execution of arbitrary registered shortcodes when an administrator has placed an ad block containing a dynamic tag such as {title}, {tag}, {category}, or {smart-tag} and enabled that block on search pages, because the plugin passes an unvalidated value into do_shortcode(). The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), limiting impact to low confidentiality and integrity with no availability effect, and no public exploit was identified at time of analysis; CISA SSVC records exploitation as none, with automatable exploitation and partial technical impact, and the vulnerability is rated for this-month remediation rather than emergency action.
Unauthenticated arbitrary shortcode execution affects the GeoDirectory - WP Business Directory Plugin and Classified Listings Directory for WordPress in all versions up to and including 2.8.198. A plugin action (per the references, an AJAX handler in class-geodir-ajax.php and the listings widget) passes an attacker-supplied value into do_shortcode() without proper validation, letting remote attackers with no privileges and no user interaction run any shortcode registered on the target site. The practical impact is bounded by which shortcodes the site has available; the available sources do not describe a shortcode path that yields full code execution, and no public exploit code or active exploitation is confirmed at time of analysis.
Authorization bypass in the Meow Gallery plugin for WordPress, in all versions up to and including 5.5.4, lets any authenticated user holding author-level access or higher enumerate and read metadata - post ID, title, date, author and status - for every private and draft post on the site, including unpublished content belonging to other users. The root cause is a missing capability check on the plugin's REST handlers and core class (CWE-862), reachable remotely with PR:L and no user interaction against default configurations. Wordfence rates the issue 6.5, while our assessment narrows the confidentiality impact to metadata disclosure rather than post body content; no public exploit code has been identified at time of analysis, and the vulnerability is not in CISA KEV.
Dimpact ZAC prior to 5.2.0 exposes decision, audit-history, BPMN process-diagram, and afzender mailbox metadata for zaken outside a user's authorized zaaktypes to any authenticated low-privileged municipal user who knows a valid zaak or besluit UUID. The flaw is a cross-zaaktype IDOR (CWE-285/CWE-639) caused by missing assertPolicy checks on by-id read endpoints while the platform filter only requires an application role on any zaaktype; the advisory includes a local proof-of-concept reproduction (a public PoC reference exists; it is not verified as working exploit code). No CISA KEV active-exploitation confirmation is available, the impact is read-only confidentiality, and upgrading to 5.2.0 remediates; overall priority is moderate.
Wekan deployments before 11.11 construct case-insensitive regular expressions from user-controlled search input without escaping metacharacters, so any logged-in user can submit a balanced catastrophic-backtracking pattern that makes MongoDB's PCRE2 engine spend roughly 400-700 ms of CPU per query; several concurrent requests hold mongod busy for seconds to minutes and degrade or deny service to everyone else on the instance. Availability is the only impacted property (CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) - authenticated low-privilege access is required, with the user-search publication needing only a DDP session while the searchUsers method also requires board membership or site-admin status, and exploitation is further conditional on an external MongoDB backend (FerretDB v1/RE2 deployments are not practically affected). A detailed proof-of-concept with measured timings and a reproduction script accompanies the upstream GitHub advisory; no CISA KEV listing or confirmed active exploitation is reported, and the upstream priority for this issue is 'this_month'.
Stored cross-site scripting in the bPlugins 'Media Player Addons for Elementor - Media Player widget for WP' WordPress plugin, affecting every version through 1.1.10, allows an authenticated user with low privileges to persist script payloads that execute in another user's browser session. Exploitation requires a valid WordPress account able to edit content that uses the Media Player widget (PR:L), and the payload only fires when a victim, typically a higher-privileged administrator or editor, renders the affected page (UI:R); the scope change reflects the payload running in the victim's security context. No CISA KEV entry or working exploit code is associated with this CVE in the available data, and the sole reference is the Patchstack vulnerability database entry; the trigger specifics are not described in the available sources.
Stored cross-site scripting in the WordPress plugin The Events Calendar (Liquid Web / StellarWP) allows an authenticated user with low-level privileges to persist a script payload that executes in the browser of any visitor who later loads the affected page. Every version up to and including 6.18.2 is in scope, and exploitation requires a second user to view the injected content, which is why the scored impact is limited to Low confidentiality, integrity and availability under a changed scope (CVSS 6.5). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the trigger field or plugin feature that fails to neutralize the input is not described in the available sources.
Stored cross-site scripting in The Events Calendar WordPress plugin (Liquid Web / StellarWP), affecting versions through 6.18.2, allows an authenticated low-privilege user to persist a script payload that executes in another user's browser when the affected page is rendered. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting that the attacker must hold a posting-capable account and must wait for a victim - typically a higher-privileged user such as an administrator - to view the injected content, with impact crossing into that victim's browser context. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority signal places this in managed, this-month remediation rather than emergency response.
Stored cross-site scripting in the Blocksy Companion WordPress plugin (versions through 2.1.60) allows an authenticated low-privilege user to persist script that runs when another user views the affected page. The CVSS 3.1 score is 6.5 with PR:L and UI:R, so the attacker needs a WordPress account able to store content and the victim must load it; no public exploit was identified at time of analysis.
Cross-site request forgery in Chamilo LMS 2.0.0 (CVSS 6.5) lets an attacker induce a logged-in administrator or DRH to create, modify, or delete skill records and profiles, or remove skill-gradebook associations. The affected actions in public/main/inc/ajax/skill.ajax.php perform database mutations without Security::check_token() validation, and the attacker needs no account of their own but must get a privileged victim with an active session to visit a malicious page. The vendor fixed the missing token checks in 2.0.1; no public exploit identified at time of analysis.
Prefix-matching defects in the Kroxylicious ACL authorizer can let an authenticated Kafka client read topics that configured ACL rules are intended to deny when overlapping prefix rules or mixed principal types are present. The issue affects Red Hat Streams for Apache Kafka 2 and 3 deployments that use the Kroxylicious ACL authorizer and carries a CVSS score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires valid Kafka client authentication plus an ACL configuration with overlapping or cross-type prefixes, so deployments without that layout are not exposed; no public exploit was identified at time of analysis.
Stored DOM-based cross-site scripting in the Cool FormKit Lite form builder for Elementor (WordPress plugin, slug extensions-for-elementor-form) through version 2.7.9 lets an authenticated attacker with contributor-level access or above plant arbitrary script in a page by setting the '_elementor_data.form_fields[].custom_id' value on an Elementor form widget. The payload fires client-side for any visitor - including anonymous ones - who later loads a page rendering that form, because the plugin's frontend script re-serializes the server-emitted escaped JSON into HTML and the custom_id escapes its attribute context. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the contributor authentication barrier keeps it moderate-priority rather than emergency-tier.
Stored cross-site scripting in the Events Made Easy WordPress plugin through version 3.3.1 lets an authenticated user with contributor-level access or higher inject script through the map shortcode's width attribute, which is placed unescaped into an inline style attribute. The issue is rated CVSS 6.4 and no public exploit was identified at time of analysis. Affected sites are those running the plugin at versions up to and including 3.3.1 and allowing contributor-or-higher users to publish content containing the plugin's map shortcode.
Stored cross-site scripting in the GeoDirectory WordPress plugin through version 2.8.199 lets authenticated users with Subscriber-level access or above plant arbitrary HTML and script in a listing description (post_content), which executes in the browser of any visitor or administrator who later views that listing. The payload survives filtering because the plugin's geodir_kses_safe_embed_attributes() helper only strips data-embed-url, data-src and data-embed, while the bundled AyeCode UI library renders every [data-bs-toggle="popover-html"] element with { html: true, sanitize: false }. CVSS 3.1 scores this 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), an authenticated, low-complexity, scope-changing stored XSS that is reachable only where the site lets untrusted users register and submit listings; no public exploit was identified at time of analysis. Wordfence reported the issue and vuln.today assigns it this_month priority.
Stored cross-site scripting in the Themify Builder WordPress plugin affects all versions up to and including 7.8.4: authenticated users holding contributor-level access or higher can write arbitrary markup into the 'variations' repeater sub-fields (style, or the woff/woff2/ttf/svg/eot URL values) of a Custom Font (tb_cf) post, because Themify_Metabox::_save_meta() only applies wp_kses_data() when the field type is 'textbox' or 'textarea' and stores repeater values through update_post_meta() unfiltered. The injected content is later echoed without escaping by Themify_Custom_Fonts::render_columns() inside a <style> block on the Custom Fonts admin listing, so the script runs when a privileged user (typically an administrator) opens that page. The CVSS 3.1 score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and no public exploit was identified at time of analysis; real-world priority is bounded by the mandatory contributor-level account, the need for the plugin to be active, and the requirement that a second, higher-privileged user visit the specific admin listing.
Stored cross-site scripting in the Redux Framework WordPress plugin, affecting all versions up to and including 4.5.15, lets a Subscriber-level account plant script payloads that execute in an administrator's browser when that admin opens the attacker's profile in wp-admin. Two defects combine: the multi_media field renderer prints stored values unescaped into an href attribute, a hidden input value and an HTML element, and Redux_Extension_Users::user_meta_save() evaluates a field's 'permissions' requirement against a request-body 'checkuser_id' rather than the current user, so a low-privileged user can write a field declared for 'manage_options'. Exploitation is conditional - the site must have a theme or plugin that registers a multi_media field through the Redux Users API - and no public exploit code has been identified at time of analysis; the vendor-released patch is version 4.5.16.
Stored cross-site scripting in the WordPress plugin FV Flowplayer Video Player affects all versions up to and including 7.5.55.7212. An authenticated attacker holding a subscriber-level account or above can submit a profile video whose attribute value is rendered as raw HTML, so script executes in the browser of any user who later views the injected page. Exploitation requires an administrator to have first enabled the non-default 'Allow visitors to upload videos to their profile' (profile_videos_enable_bio) setting; a fixed commit exists upstream, and SSVC records no known exploitation and no public exploit identified at time of analysis.
Stored cross-site scripting in the Meow Gallery WordPress plugin (all versions up to and including 5.5.1) lets an authenticated author-level user inject script through attachment alt text that is emitted into an aria-label attribute. Because WordPress's sanitize_text_field() strips angle-bracketed tags but leaves double quotes intact, an attacker can break out of the aria-label context and add event-handler attributes such as onclick that fire when a visitor views the injected gallery page. The vulnerable sink is only reached when gallery items are rendered as links (a non-empty link_href), and a patch appears in the 5.5.1-to-5.5.2 changeset; no public exploit code or active exploitation was identified at time of analysis, and the priority label is this_month rather than immediate action.
Stored cross-site scripting in CP Multi View Events Calendar 1.4.43 and earlier allows any authenticated WordPress user with Subscriber-level access to inject arbitrary script through the calendar 'Subject' parameter, which is stored and executes when a victim views the affected calendar page. The adddetails endpoint is reachable by low-privileged users because the required nonce is localized on published pages carrying the calendar shortcode, and no public exploit was identified at time of analysis. This is a moderate-severity issue (CVSS 6.4) with limited confidentiality and integrity impact under a changed-scope vector.
Denial of service in the Elixir standard library's URI module lets a remote client submit a URL whose port component contains hundreds of thousands of digits, causing URI.parse/1 to construct an oversized bignum whose later conversion to text costs seconds of CPU. Exposure requires that the application parse attacker-supplied URLs with URI.parse/1 (not URI.new/1, which uses :uri_string and is capped at five digits on patched Erlang/OTP releases) and then render or echo the resulting %URI{} through URI.to_string/1, inspect/1, logging or error formatting, with the multi-second cost confined to Erlang/OTP 27, 28 and 29.0 while OTP 29.1 and later are largely immune. Authentication is not required (PR:N), but the effect is limited to availability (A:L) and sustained CPU pressure, the advisory documents a proof-of-concept reproduction rather than released exploit tooling, and no confirmed active exploitation is reported; vendor-fixed releases 1.18.6, 1.19.7 and 1.20.5 are available, placing this at moderate, this-month priority rather than an emergency.
Server-side request forgery in phpMyAdmin through 5.2.3 lets unauthenticated remote attackers drive the application into outbound MySQL-protocol connections to attacker-chosen hosts and ports via setup/validate.php, which never enforces the setup-disabled guard, so the probe path stays live even on installations where administrators believe setup mode is off. Impact is limited to semi-blind internal reconnaissance: the attacker learns whether a host/port answers the MySQL handshake by reading the differing error messages returned by Validator::testDBConnection(), with low confidentiality impact and no integrity or availability effect. Exploitation is not accidental-territory: it requires the setup directory to be network-reachable, and the high attack complexity and present attack requirements (AC:H/AT:P) mean probing is not trivially reliable; there is no CISA KEV listing and no confirmed active exploitation, though a public research writeup describing the issue exists and is not verified as working exploit code. Severity is medium and the issue is real but not urgent - the vendor has published upstream fixes in commits and a pull request, with a released patched version not independently confirmed in the supplied data.
Missing authorization checks in the LORIS imaging_browser API allow any authenticated API caller to modify imaging data without holding the edit permission that the imaging_browser frontend enforces. The flaw affects LORIS from 22.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, and only matters on deployments where the API is enabled and the caller already has a valid account - the independent assessment scores it PR:L with integrity-only impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) rather than the broader CNA vector. No public exploit code or active exploitation has been identified at time of analysis; the vendor has released fixes in 27.0.4 and 28.0.2, and sites that no longer use the API can disable it to eliminate the endpoint.
Kubewarden's trusted-repos-policy before 2.1.2 is a moderate-severity admission-control bypass: an authenticated user with permission to create or update admission-controlled workloads can use an uppercase or mixed-case registry hostname to evade a lowercase reject-list entry, causing the policy to admit an image that the container runtime then pulls. Allow-list configurations are not affected because they fail closed by over-denying differently cased hostnames. No public exploit identified at time of analysis.
Contributor-level users of the Cozmoslabs Profile Builder plugin for WordPress (versions up to and including 4.0.5) can escalate beyond their assigned role because the plugin mishandles privilege assignment (CWE-266). An attacker who already holds a Contributor account - plausible on sites with open registration or multi-author workflows - can leverage the flawed role-handling logic over the network without any user interaction, with low confidentiality, integrity and availability impact (CVSS 6.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the exact trigger path and the specific elevated capability obtained are not described in the available sources.