CVE Vulnerability Advisory Database

[Affected Scope] WordPress Ninja Forms plugin versions up to, and including, 3.15.5

[Impact] Unauthenticated attackers can inject malicious scripts via a single request, potentially leading to administrator session hijacking and site takeover

[Mitigation] Immediately update the Ninja Forms plugin to the latest secure version (3.15.6 or higher)

[Affected Scope] All versions of Meow Lightbox plugin for WordPress up to, and including, 5.6.4

[Impact] Unauthenticated attackers can inject arbitrary web scripts via the 'post_content' parameter, executing malicious JavaScript in the context of any user viewing the affected page under specific configurations

[Mitigation] Immediately update the Meow Lightbox plugin to the latest secure version (5.6.5 or higher) and apply temporary configuration workarounds if patching is delayed

[Affected Scope] Ad Inserter WordPress plugin versions 2.8.19 and below

[Impact] Unauthenticated remote attackers can inject malicious scripts to hijack admin sessions, deface websites, or conduct phishing attacks

[Mitigation] Immediately update the plugin to version 2.8.20 or later

[Affected Scope] All supported on-premises Microsoft Exchange Server environments.

[Impact] Unauthenticated remote attackers can execute malicious scripts within the victim's browser session, leading to session hijacking, spoofing, and privilege escalation.

[Mitigation] Apply the official Microsoft security updates immediately, and deploy WAF rules to block anomalous web requests prior to patching.

[Affected Scope] Zimbra Collaboration (ZCS) versions before 10.0.18 and 10.1 versions before 10.1.13

[Impact] Attackers can execute arbitrary JavaScript code and steal session tokens in the context of the Classic UI when a user views a malicious HTML email.

[Mitigation] Immediately upgrade Zimbra Collaboration Suite to the patched versions (10.0.18, 10.1.13, or later).

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 8.8.15, 9.0, 10.0, and 10.1 utilizing the Classic UI

[Impact] Attackers can execute arbitrary JavaScript within the victim's session by sending a crafted email, potentially leading to session hijacking and unauthorized access to sensitive data without requiring user interaction beyond viewing the email

[Mitigation] Immediately apply the latest security patches provided by Zimbra, or temporarily restrict the use of the Classic UI and deploy WAF rules