CVE Vulnerability Advisory Database

[Affected Scope] Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before version 2.4.30

[Impact] Low-privileged authenticated users (such as Subscribers) can bypass capability checks to send arbitrary emails with spoofed sender addresses

[Mitigation] Immediately update the Kali Forms plugin to version 2.4.30 or later

[Affected Scope] Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before version 2.4.30

[Impact] Authenticated users with minimal privileges (Subscriber and above) can disclose the email address of any registered user, including administrators

[Mitigation] Immediately update the Kali Forms plugin to version 2.4.30 or later

[Affected Scope] Presenton versions up to and including 0.9.11-beta

[Impact] Missing authentication in the API component allows remote attackers to access critical functions and manipulate data without authorization

[Mitigation] Immediately upgrade the affected component to version 0.9.12-beta or later

[Affected Scope] YznCMS versions up to and including 2.2.0 (Auth Group Handler component)

[Impact] Remote attackers can manipulate authorization group settings to escalate privileges and gain unauthorized administrative control

[Mitigation] Immediately upgrade to YznCMS version 2.2.1 or apply the official patch

[Affected Scope] Jpom versions 2.10.0 through 2.11.12

[Impact] Unauthenticated remote attackers can bypass authentication to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header, leading to arbitrary command execution via script features

[Mitigation] Immediately upgrade Jpom to the patched version (2.11.13 or later) and restrict external access to the management console

[Affected Scope] All deployments running Nexterm through version 1.2.2-BETA

[Impact] Authenticated attackers can disrupt, hibernate, resume, or terminate active SSH, RDP, VNC, or SFTP sessions of other users by exploiting missing authorization checks on session lifecycle routes

[Mitigation] Immediately upgrade to the patched version of Nexterm and restrict access to session management API endpoints

[Affected Scope] LearnHouse versions prior to 1.1.1

[Impact] Authenticated users can exploit missing authorization checks to read other users' grades, submissions, and instructor feedback

[Mitigation] Immediately upgrade LearnHouse to version 1.1.1 or higher and enforce strict API access control policies

[Affected Scope] WebDyne versions from 2.022 before 3.022 for Perl

[Impact] Unauthenticated remote attackers can read application source code (.psp, .pm, .pl) and extract hardcoded credentials via the default index page viewer

[Mitigation] Immediately upgrade WebDyne to version 3.022 or later

[Affected Scope] Perl-based web applications utilizing WebDyne versions 2.031 through 3.021

[Impact] Remote attackers can bypass file upload restrictions using double extensions (e.g., .psp.pdf) to execute arbitrary Perl code on the server, leading to full system compromise

[Mitigation] Immediately upgrade the WebDyne framework to the patched version 3.022 or higher

[Affected Scope] Perl web applications utilizing WebDyne versions 3.007 through 3.021

[Impact] Unauthenticated remote attackers can execute arbitrary Perl code via path traversal, leading to full system compromise

[Mitigation] Immediately upgrade WebDyne to version 3.022 or higher, and restrict script execution in upload directories

[Affected Scope] All versions up to, and including, 2.10.12 of the Web 2.0 Directory plugin for WordPress

[Impact] Unauthenticated attackers can execute arbitrary SQL queries to extract sensitive database information

[Mitigation] Update the plugin to the latest secure version immediately and apply WAF rules to block SQL injection payloads

[Affected Scope] Systems running unpatched versions impacted by CVE-2026-120114

[Impact] The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'm...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] WordPress GeoDirectory – WP Business Directory Plugin versions up to, and including, 2.8.197

[Impact] Authenticated attackers with subscriber-level access can execute arbitrary web scripts in the browser of an Administrator or Editor, leading to full site takeover

[Mitigation] Immediately update the GeoDirectory plugin to the latest secure version (2.8.198 or higher)

[Affected Scope] Germanized for WooCommerce WordPress plugin up to, and including, 4.1.4

[Impact] Authenticated attackers with Subscriber-level access can change their account email to a victim's billing email and reuse their original activation token to hijack past guest orders, exposing sensitive billing details.

[Mitigation] Update the plugin to the latest secure version (4.1.5 or higher), or explicitly set 'Disable login for unactivated customers' to Yes.

[Affected Scope] All versions of WP Directory Kit plugin for WordPress up to, and including, 1.6.0

[Impact] Unauthenticated remote attackers can inject malicious SQL queries to extract sensitive database information

[Mitigation] Immediately upgrade the WP Directory Kit plugin to the latest secure version (1.6.1 or higher)

[Affected Scope] All versions up to, and including, 3.17.2 of the FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for WordPress

[Impact] Authenticated attackers with subscriber-level access can leak REST bearer tokens, bypass authorization, and inject malicious scripts to hijack administrator sessions

[Mitigation] Immediately upgrade the FlexStock plugin to the latest secure version (3.17.3 or higher) and restrict unauthorized REST API access

[Affected Scope] WooCommerce Extra Product Options Pro plugin up to and including version 3.3.2

[Impact] Unauthenticated attackers can execute arbitrary web scripts in the victim's browser session via crafted links, potentially leading to session hijacking

[Mitigation] Immediately update the plugin to the latest secure version (3.3.3 or higher) and apply WAF rules

[Affected Scope] Ninja Forms WordPress plugin up to, and including, version 3.15.5

[Impact] Unauthenticated attackers can execute arbitrary JavaScript in the user's browser session, potentially leading to session hijacking

[Mitigation] Immediately update the Ninja Forms plugin to the latest secure version (3.15.6 or higher)

[Affected Scope] PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin versions up to, and including, 7.1.1

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the server and fully compromise the system via malicious payload injection

[Mitigation] Immediately upgrade the plugin to the patched version (7.2.0 or higher) and apply input validation filters on checkout API requests

[Affected Scope] WooCommerce PDF Invoices & Packing Slips WordPress plugin up to and including version 5.16.5

[Impact] Unauthenticated attackers can extract complete PDF invoices of other customers, including billing/shipping addresses, order notes, and pricing, delivered directly to the attacker's email

[Mitigation] Immediately upgrade the plugin to version 5.16.6 or higher, and disable the yearly invoice number reset option as a temporary workaround