Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential brute-forcing attacks and reconfigure CORS policies to include attacker-controlled origins with credentials enabled.
Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only that the target is callable (is_callable()) without restricting dangerous functions such as exec, system, passthru, or shell_exec. Because FlexDirectory registers this handler for every Flex directory, it bypasses the validation added to Blueprint::dynamicData
Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.
Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.
Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.
Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions.
Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.
Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions.
Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions.
Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions.
Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.
Unauthenticated Broken Access Control in Graphina <= 3.1.12 versions.
Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.
Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.
Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.
Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.
Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.