Type5Afe

**Name of the Vulnerable Software and Affected Versions** WP Data Access versions prior to 5.5.69 **Description** The plugin contains an Insecure Direct Object Reference (IDOR) flaw, which occurs when an application provides direct access to objects based on user-supplied input. The issue exists in the `check app access()` function due to missing validation on a user-controlled key. Unauthenticated attackers can access data from protected app containers by exploiting a mismatch where the authorization check is performed against the `app id` variable, but data retrieval is performed using the `cnt id` variable without verifying container ownership. **Recommendations** Update the plugin to a version newer than 5.5.68. As a temporary mitigation, restrict access to the `check app access()` function.

**Name of the Vulnerable Software and Affected Versions** Weblate versions prior to 2026.8 **Description** A user with permissions to manage component repository URLs can execute server-side request forgery (SSRF) against internal services via DNS rebinding during Version Control System (VCS) operations. This occurs because the software validates the hostname during the first DNS resolution, but subsequent connections by external VCS clients trigger a separate lookup. An attacker can use a hostname that initially resolves to a public address and then re-point it to an internal or private address. By initiating operations such as clone, fetch, or push, the attacker can force the system to access internal VCS-compatible services, potentially exposing private repository contents. This issue affects installations that allow untrusted repository hostnames while the `VCS RESTRICT PRIVATE` variable is set to `True`. **Recommendations** Update to version 2026.8. Restrict the use of untrusted repository hostnames when `VCS RESTRICT PRIVATE` is enabled.

**Name of the Vulnerable Software and Affected Versions** Weblate versions prior to 2026.7 **Description** A user with the "Edit source" role can cause a denial of service by storing a malicious regular expression in a source string's flags. Regular expressions provided via the regex quality check and regex placeholders are compiled during validation but executed within `RegexCheck` and `PlaceholderCheck` without a timeout. This allows a catastrophic-backtracking pattern—a regular expression that takes an exponential amount of time to process certain strings—to consume CPU resources indefinitely. Since these checks are re-run for every linked target unit when source unit flags change, a single edit can lead to a sustained CPU-bound denial of service. **Recommendations** Update to version 2026.7.

**Name of the Vulnerable Software and Affected Versions** Customer Reviews for WooCommerce versions up to and including 5.97.0 **Description** The Customer Reviews for WooCommerce plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping related to the `media[].href` parameter. An unauthenticated attacker, if 'Enable for Guests' is enabled, can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. **Recommendations** Update Customer Reviews for WooCommerce to a version newer than 5.97.0.

**Name of the Vulnerable Software and Affected Versions** Code Snippets plugin for WordPress versions up to and including 3.9.4 **Description** The Code Snippets plugin for WordPress is susceptible to Cross-Site Request Forgery. This is a result of a lack of nonce validation on the cloud snippet download and update actions within the `Cloud Search List Table` class. This allows unauthenticated attackers to compel logged-in administrators to download or update cloud snippets without their knowledge, provided they can lure an administrator to a malicious webpage. **Recommendations** Update the Code Snippets plugin to a version later than 3.9.4.

**Name of the Vulnerable Software and Affected Versions** The AI Engine – The Chatbot and AI Framework for WordPress plugin versions prior to 3.3.3 **Description** The AI Engine – The Chatbot and AI Framework for WordPress plugin is susceptible to arbitrary file uploads because of a lack of file type validation. This flaw exists in the `rest helpers update media metadata` function. Authenticated attackers with Editor-level access or higher can upload arbitrary files to the server, potentially leading to remote code execution. An attacker can upload an image file and then use the `update media metadata` API endpoint to rename it to a PHP file, effectively creating an executable PHP file within the uploads directory. The vulnerable API endpoint is `/wp-json/aiengine/v1/rest helpers update media metadata`. The vulnerable variable is `file`. **Recommendations** Update The AI Engine – The Chatbot and AI Framework for WordPress plugin to version 3.3.3 or later. As a temporary workaround, restrict access to the `update media metadata` API endpoint for users with Editor-level access and above. Disable the `rest helpers update media metadata` function if possible.

**Name of the Vulnerable Software and Affected Versions** AI Engine plugin for WordPress versions up to and including 3.3.2 **Description** The AI Engine plugin for WordPress is susceptible to Server-Side Request Forgery via the `get audio` function. An authenticated attacker with Subscriber-level access or higher can make web requests to arbitrary locations originating from the web application. This can be used to query and modify information from internal services if the "Public API" is enabled in the plugin settings and `allow url fopen` is set to 'On' on the server. **Recommendations** Update the AI Engine plugin to a version later than 3.3.2.

**Name of the Vulnerable Software and Affected Versions** MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress versions up to and including 4.1.0 **Description** The software contains a flaw due to the use of a forgeable cookie value derived from the entry ID and current user ID without a server-side secret. This allows unauthenticated attackers to access form submission entry data via MetForm shortcodes for entries created within the transient TTL, which defaults to 15 minutes. **Recommendations** Update to a version beyond 4.1.0.