Skip to content

Commit d7348b8

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2vv2-mqg3-3j3p GHSA-2w66-j4vc-q66r GHSA-39hw-jm9g-6r53 GHSA-58qr-v987-vh6w GHSA-59w9-v569-xqc3 GHSA-5rfm-3pqq-3xm3 GHSA-6963-573w-vxvf GHSA-6m7m-cxf3-4phv GHSA-8gh3-66fr-4rwm GHSA-96gq-6mq2-hjpw GHSA-98q5-g3r5-8vrg GHSA-cc45-j295-8r3r GHSA-cfxx-jfwh-m66r GHSA-cpmh-vq2q-hhp7 GHSA-g85c-6q3h-m8pv GHSA-g8cg-xh22-8v5v GHSA-hxcx-9gwg-xxw5 GHSA-m75r-w8f2-6h95 GHSA-p529-4vj7-h7jm GHSA-qv7p-c5xp-q3hh GHSA-x2p4-4cw9-m5ch
1 parent b45c372 commit d7348b8

21 files changed

Lines changed: 1137 additions & 1 deletion

File tree

‎advisories/unreviewed/2026/03/GHSA-2vv2-mqg3-3j3p/GHSA-2vv2-mqg3-3j3p.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2vv2-mqg3-3j3p",
4+
"modified": "2026-03-26T06:30:20Z",
5+
"published": "2026-03-26T06:30:20Z",
6+
"aliases": [
7+
"CVE-2026-4075"
8+
],
9+
"details": "The BWL Advanced FAQ Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'baf_sbox' shortcode in all versions up to and including 1.1.1. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'sbox_id', 'sbox_class', 'placeholder', 'highlight_color', 'highlight_bg', and 'cont_ext_class'. These attributes are directly interpolated into HTML element attributes without any esc_attr() escaping in the baf_sbox() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4075"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/bwl-advanced-faq-manager-lite/tags/1.1.1/includes/shortcodes/baf_faq_list.php#L46"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/bwl-advanced-faq-manager-lite/tags/1.1.1/includes/shortcodes/baf_faq_list.php#L73"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/bwl-advanced-faq-manager-lite/tags/1.1.1/includes/shortcodes/baf_faq_list.php#L75"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/browser/bwl-advanced-faq-manager-lite/trunk/includes/shortcodes/baf_faq_list.php#L46"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://plugins.trac.wordpress.org/browser/bwl-advanced-faq-manager-lite/trunk/includes/shortcodes/baf_faq_list.php#L73"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://plugins.trac.wordpress.org/browser/bwl-advanced-faq-manager-lite/trunk/includes/shortcodes/baf_faq_list.php#L75"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3487104%40bwl-advanced-faq-manager-lite&new=3487104%40bwl-advanced-faq-manager-lite&sfp_email=&sfph_mail="
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ef01f05a-ed5a-4278-acab-029c58242cf2?source=cve"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-79"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": false,
61+
"github_reviewed_at": null,
62+
"nvd_published_at": "2026-03-26T04:17:12Z"
63+
}
64+
}

‎advisories/unreviewed/2026/03/GHSA-2w66-j4vc-q66r/GHSA-2w66-j4vc-q66r.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2w66-j4vc-q66r",
4+
"modified": "2026-03-26T06:30:21Z",
5+
"published": "2026-03-26T06:30:21Z",
6+
"aliases": [
7+
"CVE-2026-4839"
8+
],
9+
"details": "A vulnerability has been found in SourceCodester Food Ordering System 1.0. This affects an unknown function of the file /purchase.php of the component Parameter Handler. The manipulation of the argument custom leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4839"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/WHOAMI-xiaoyu/CVE/blob/main/CVE_9.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.353142"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.353142"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.776082"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sourcecodester.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-26T04:17:15Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-39hw-jm9g-6r53/GHSA-39hw-jm9g-6r53.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-39hw-jm9g-6r53",
4+
"modified": "2026-03-26T06:30:21Z",
5+
"published": "2026-03-26T06:30:21Z",
6+
"aliases": [
7+
"CVE-2026-4845"
8+
],
9+
"details": "A flaw has been found in dameng100 muucmf 1.9.5.20260309. Impacted is an unknown function of the file /admin/Member/index.html. This manipulation of the argument Search causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4845"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://thinhneee.github.io/posts/muucmf-xss"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.353150"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.353150"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.776174"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-26T06:16:09Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-58qr-v987-vh6w/GHSA-58qr-v987-vh6w.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-58qr-v987-vh6w",
4-
"modified": "2026-03-26T03:30:28Z",
4+
"modified": "2026-03-26T06:30:19Z",
55
"published": "2026-03-26T03:30:28Z",
66
"aliases": [
77
"CVE-2014-125112"
@@ -21,6 +21,10 @@
2121
{
2222
"type": "WEB",
2323
"url": "https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.23-TRIAL/changes"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "http://www.openwall.com/lists/oss-security/2026/03/26/2"
2428
}
2529
],
2630
"database_specific": {

‎advisories/unreviewed/2026/03/GHSA-59w9-v569-xqc3/GHSA-59w9-v569-xqc3.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-59w9-v569-xqc3",
4+
"modified": "2026-03-26T06:30:21Z",
5+
"published": "2026-03-26T06:30:21Z",
6+
"aliases": [
7+
"CVE-2026-4841"
8+
],
9+
"details": "A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file form/cart.php of the component Shopping Cart Module. Executing a manipulation of the argument del can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4841"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://code-projects.org"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://gist.github.com/HxH404/ed090db972001ba535202fd4f5b6a0b5"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.353147"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.353147"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.776130"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-26T05:16:41Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-5rfm-3pqq-3xm3/GHSA-5rfm-3pqq-3xm3.json‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5rfm-3pqq-3xm3",
4+
"modified": "2026-03-26T06:30:21Z",
5+
"published": "2026-03-26T06:30:21Z",
6+
"aliases": [
7+
"CVE-2026-4281"
8+
],
9+
"details": "The FormLift for Infusionsoft Web Forms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 7.5.21. This is due to missing capability checks on the connect() and listen_for_tokens() methods of the FormLift_Infusionsoft_Manager class, both of which are hooked to 'plugins_loaded' and execute on every page load. The connect() function generates an OAuth connection password and leaks it in the redirect Location header without verifying the requesting user is authenticated or authorized. The listen_for_tokens() function only validates the temporary password but performs no user authentication before calling update_option() to save attacker-controlled OAuth tokens and app domain. This makes it possible for unauthenticated attackers to hijack the site's Infusionsoft connection by first triggering the OAuth flow to obtain the temporary password, then using that password to set arbitrary OAuth tokens and app domain via update_option(), effectively redirecting the plugin's API communication to an attacker-controlled server.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4281"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/formlift/tags/7.5.21/modules/api/infusionsoft-manager.php#L21"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/formlift/tags/7.5.21/modules/api/infusionsoft-manager.php#L46"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/formlift/tags/7.5.21/modules/api/infusionsoft-manager.php#L62"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/browser/formlift/tags/7.5.21/modules/api/infusionsoft-manager.php#L64"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://plugins.trac.wordpress.org/browser/formlift/trunk/modules/api/infusionsoft-manager.php#L21"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://plugins.trac.wordpress.org/browser/formlift/trunk/modules/api/infusionsoft-manager.php#L46"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://plugins.trac.wordpress.org/browser/formlift/trunk/modules/api/infusionsoft-manager.php#L62"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://plugins.trac.wordpress.org/browser/formlift/trunk/modules/api/infusionsoft-manager.php#L64"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3490212%40formlift&new=3490212%40formlift&sfp_email=&sfph_mail="
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a65cc674-a0ea-46b9-b609-b184e1f7ca8e?source=cve"
61+
}
62+
],
63+
"database_specific": {
64+
"cwe_ids": [
65+
"CWE-862"
66+
],
67+
"severity": "MODERATE",
68+
"github_reviewed": false,
69+
"github_reviewed_at": null,
70+
"nvd_published_at": "2026-03-26T05:16:40Z"
71+
}
72+
}

‎advisories/unreviewed/2026/03/GHSA-6963-573w-vxvf/GHSA-6963-573w-vxvf.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6963-573w-vxvf",
4+
"modified": "2026-03-26T06:30:21Z",
5+
"published": "2026-03-26T06:30:21Z",
6+
"aliases": [
7+
"CVE-2026-1206"
8+
],
9+
"details": "The Elementor Website Builder plugin for WordPress is vulnerable to Incorrect Authorization to Sensitive Information Exposure in all versions up to, and including, 3.35.7. This is due to a logic error in the is_allowed_to_read_template() function permission check that treats non-published templates as readable without verifying edit capabilities. This makes it possible for authenticated attackers, with contributor-level access and above, to read private or draft Elementor template content via the 'template_id' supplied to the 'get_template_data' action of the 'elementor_ajax' endpoint.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1206"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3489160/elementor/trunk/includes/template-library/sources/local.php?old=3473768&old_path=elementor%2Ftrunk%2Fincludes%2Ftemplate-library%2Fsources%2Flocal.php"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a4420935-4952-4460-afc2-1c6df6965b3d?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-639"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-03-26T06:16:09Z"
39+
}
40+
}

0 commit comments

Comments
 (0)