CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Monthly
Shortcode injection in the Brave WordPress plugin before 0.8.8 allows unauthenticated remote attackers to execute arbitrary WordPress shortcodes server-side by passing crafted values through URL parameters designed for pre-filling form fields. The exploitable shortcodes and their consequences depend entirely on which shortcodes are registered on the target installation - ranging from information disclosure to, in worst-case scenarios involving code-execution shortcodes, elevated impact. A publicly available proof-of-concept exists per WPScan; no active exploitation (KEV) has been confirmed. The CVSS score of 4.8 with AC:H reflects that real-world impact is highly site-dependent.
CSS injection in GutenKit WordPress plugin (versions before 2.5.1) allows any authenticated user holding the Contributor role or above to embed arbitrary stylesheets into posts served to all site visitors and anonymous users. The plugin fails to validate or escape style settings before interpolating them into CSS output on the front end, enabling defacement, interface redressing, and forced loading of external resources. JavaScript execution is explicitly ruled out at the Contributor privilege tier, capping the attack surface below full cross-site scripting. A publicly available exploit has been disclosed by WPScan.
Control-character (newline) injection in Yoast SEO Premium before 27.6.1 allows an authenticated WordPress Author to write arbitrary Apache directives into the site's root .htaccess file via unsanitized redirect origins in file-based redirect mode. On Apache servers that process PHP directives, the injected auto_prepend_file directive can be chained with a polyglot image upload (available to Author-role users) to achieve full Remote Code Execution as the web server process. A public exploit is available via WPScan, making real-world exploitation feasible wherever the three required conditions align.
Shortcode injection in MW WP Form WordPress plugin (versions before 5.1.5) allows unauthenticated remote attackers to execute any WordPress shortcode registered on the target site. The plugin fails to neutralize shortcode syntax in user-submitted form values before passing those values through WordPress's shortcode processing engine. A publicly available proof-of-concept exists (via WPScan), though exploitation is gated by a non-default site configuration requirement, which suppresses real-world risk despite the network-accessible attack vector.
iCalendar injection in Wallos prior to v5.0.0 allows authenticated users to break out of VEVENT blocks in exported .ics feeds by embedding raw CRLF sequences in subscription names or notes, enabling insertion of fully attacker-controlled calendar events - including spoofed organizers and arbitrary ATTENDEE email addresses - into any calendar application subscribed to the feed. The root cause is a validation/export mismatch: input sanitization encodes HTML metacharacters but never strips newlines, while the iCal export layer decodes those entities back before writing output, letting CRLF pass through unmodified. No public exploit code or active exploitation (CISA KEV) has been identified; the vendor-released patch is v5.0.0.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the `ID` parameter in `/pages/inv_searchfrm.php`. Publicly available proof-of-concept exploit code exists (CVSS 4.0 supplemental metric E:P), though the product's tutorial and educational origins on itsourcecode.com severely limit any real-world production exposure. The CVSS 4.0 score of 2.1 reflects the authenticated prerequisite and low impact across confidentiality, integrity, and availability.
Command injection in the D-Link DIR-825M router (firmware 1.1.8) allows network-adjacent authenticated attackers to execute arbitrary OS-level commands by manipulating the `sysCmd` argument submitted to the `/boafrm/formSysCmd` endpoint, processed by function `sub_456CF4` without sanitization. A public proof-of-concept exploit exists and was published alongside the VulDB disclosure. The provided CVSS 4.0 score of 2.1 appears to severely understate the real impact - command injection in a router's System Command Execution interface typically yields full OS compromise, not low-severity system impact.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the supplier edit endpoint `/pages/sup_edit.php` to authenticated remote attackers who can manipulate the `ID` parameter to interact with the underlying database. The vulnerability allows low-privileged authenticated users to read, modify, or potentially delete database records via crafted SQL payloads. A public exploit has been released (reflected in CVSS 4.0 E:P), though no active exploitation or CISA KEV listing has been identified; the realistic risk is bounded by the product's narrow deployment footprint as a student/demo PHP codebase.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote low-privileged attackers to manipulate database queries via the `ID` parameter in `/pages/emp_edit.php`. The vulnerability requires a valid (low-privilege) application account but no further conditions, and a public proof-of-concept exploit is available per the VulDB report. Real-world risk is dampened by the product's narrow deployment footprint - itsourcecode distributes educational/tutorial-grade PHP source code primarily consumed by students, not production deployments.
Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5) allows any internet-accessible attacker to call arbitrary zero-argument PHP functions server-side via a missing-authorization AJAX handler combined with extract()-based variable injection into a template scope. The most critical demonstrated impact is persistent subscriber-level account creation through WordPress core's edit_user() function, which reads POST parameters directly, enabling unauthenticated user registration on any affected site. No CISA KEV listing has been identified at time of analysis, but Wordfence's detailed technical disclosure with specific file paths and line numbers substantially lowers the barrier for independent exploit development against the 6.5 CVSS-rated but trivially accessible unauthenticated attack surface.
Shortcode injection in the Brave WordPress plugin before 0.8.8 allows unauthenticated remote attackers to execute arbitrary WordPress shortcodes server-side by passing crafted values through URL parameters designed for pre-filling form fields. The exploitable shortcodes and their consequences depend entirely on which shortcodes are registered on the target installation - ranging from information disclosure to, in worst-case scenarios involving code-execution shortcodes, elevated impact. A publicly available proof-of-concept exists per WPScan; no active exploitation (KEV) has been confirmed. The CVSS score of 4.8 with AC:H reflects that real-world impact is highly site-dependent.
CSS injection in GutenKit WordPress plugin (versions before 2.5.1) allows any authenticated user holding the Contributor role or above to embed arbitrary stylesheets into posts served to all site visitors and anonymous users. The plugin fails to validate or escape style settings before interpolating them into CSS output on the front end, enabling defacement, interface redressing, and forced loading of external resources. JavaScript execution is explicitly ruled out at the Contributor privilege tier, capping the attack surface below full cross-site scripting. A publicly available exploit has been disclosed by WPScan.
Control-character (newline) injection in Yoast SEO Premium before 27.6.1 allows an authenticated WordPress Author to write arbitrary Apache directives into the site's root .htaccess file via unsanitized redirect origins in file-based redirect mode. On Apache servers that process PHP directives, the injected auto_prepend_file directive can be chained with a polyglot image upload (available to Author-role users) to achieve full Remote Code Execution as the web server process. A public exploit is available via WPScan, making real-world exploitation feasible wherever the three required conditions align.
Shortcode injection in MW WP Form WordPress plugin (versions before 5.1.5) allows unauthenticated remote attackers to execute any WordPress shortcode registered on the target site. The plugin fails to neutralize shortcode syntax in user-submitted form values before passing those values through WordPress's shortcode processing engine. A publicly available proof-of-concept exists (via WPScan), though exploitation is gated by a non-default site configuration requirement, which suppresses real-world risk despite the network-accessible attack vector.
iCalendar injection in Wallos prior to v5.0.0 allows authenticated users to break out of VEVENT blocks in exported .ics feeds by embedding raw CRLF sequences in subscription names or notes, enabling insertion of fully attacker-controlled calendar events - including spoofed organizers and arbitrary ATTENDEE email addresses - into any calendar application subscribed to the feed. The root cause is a validation/export mismatch: input sanitization encodes HTML metacharacters but never strips newlines, while the iCal export layer decodes those entities back before writing output, letting CRLF pass through unmodified. No public exploit code or active exploitation (CISA KEV) has been identified; the vendor-released patch is v5.0.0.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the `ID` parameter in `/pages/inv_searchfrm.php`. Publicly available proof-of-concept exploit code exists (CVSS 4.0 supplemental metric E:P), though the product's tutorial and educational origins on itsourcecode.com severely limit any real-world production exposure. The CVSS 4.0 score of 2.1 reflects the authenticated prerequisite and low impact across confidentiality, integrity, and availability.
Command injection in the D-Link DIR-825M router (firmware 1.1.8) allows network-adjacent authenticated attackers to execute arbitrary OS-level commands by manipulating the `sysCmd` argument submitted to the `/boafrm/formSysCmd` endpoint, processed by function `sub_456CF4` without sanitization. A public proof-of-concept exploit exists and was published alongside the VulDB disclosure. The provided CVSS 4.0 score of 2.1 appears to severely understate the real impact - command injection in a router's System Command Execution interface typically yields full OS compromise, not low-severity system impact.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the supplier edit endpoint `/pages/sup_edit.php` to authenticated remote attackers who can manipulate the `ID` parameter to interact with the underlying database. The vulnerability allows low-privileged authenticated users to read, modify, or potentially delete database records via crafted SQL payloads. A public exploit has been released (reflected in CVSS 4.0 E:P), though no active exploitation or CISA KEV listing has been identified; the realistic risk is bounded by the product's narrow deployment footprint as a student/demo PHP codebase.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote low-privileged attackers to manipulate database queries via the `ID` parameter in `/pages/emp_edit.php`. The vulnerability requires a valid (low-privilege) application account but no further conditions, and a public proof-of-concept exploit is available per the VulDB report. Real-world risk is dampened by the product's narrow deployment footprint - itsourcecode distributes educational/tutorial-grade PHP source code primarily consumed by students, not production deployments.
Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5) allows any internet-accessible attacker to call arbitrary zero-argument PHP functions server-side via a missing-authorization AJAX handler combined with extract()-based variable injection into a template scope. The most critical demonstrated impact is persistent subscriber-level account creation through WordPress core's edit_user() function, which reads POST parameters directly, enabling unauthenticated user registration on any affected site. No CISA KEV listing has been identified at time of analysis, but Wordfence's detailed technical disclosure with specific file paths and line numbers substantially lowers the barrier for independent exploit development against the 6.5 CVSS-rated but trivially accessible unauthenticated attack surface.