Search

Find a vulnerability

Search criteria

    2 vulnerabilities by barn2media

    CVE-2026-118189 (GCVE-0-2026-118189)

    Vulnerability from cvelistv5 – Published: 2026-11-06 08:38 – Updated: 2026-11-06 15:03
    VLAI
    Title
    Posts Table with Search & Sort <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute
    Summary
    The Posts Table with Search & Sort plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses wp_kses_post at save time because it contains no literal angle bracket characters; the malicious HTML tags are only reconstructed at render time, making this exploitable by Contributors who would ordinarily lack the unfiltered_html capability.
    Severity
    6.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-06 14:59 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation
    Assigner
    Wordfence CNA
    References
    Impacted products
    Vendor Product Version
    barn2media Posts Table with Search & Sort Affected: 0 , ≤ 1.4.14 (semver)
    		Create a notification for this product.
    Credits
    Wordfence PRISM
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118189",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T14:59:37.359499Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T15:03:16.142Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Posts Table with Search \u0026 Sort",
          "vendor": "barn2media",
          "versions": [
            {
              "lessThanOrEqual": "1.4.14",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Posts Table with Search \u0026 Sort plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027date_format\u0027 parameter in all versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses wp_kses_post at save time because it contains no literal angle bracket characters; the malicious HTML tags are only reconstructed at render time, making this exploitable by Contributors who would ordinarily lack the unfiltered_html capability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T08:38:07.686Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ac45e56-606a-445f-84ec-349b68109065?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/posts-data-table/tags/1.4.14/src/Simple_Posts_Table.php#L338"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/posts-data-table/tags/1.4.14/src/Simple_Posts_Table.php#L345"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/posts-data-table/tags/1.4.14/src/Table_Shortcode.php#L33"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3780094/posts-data-table/trunk/src/Simple_Posts_Table.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-29T02:42:39.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-05T20:29:25.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Posts Table with Search \u0026 Sort \u003c= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027date_format\u0027 Shortcode Attribute"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-118189",
    "datePublished": "2026-11-06T08:38:07.686Z",
    "dateReserved": "2026-10-27T18:53:00.764Z",
    "dateUpdated": "2026-11-06T15:03:16.142Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-11174 (GCVE-0-2025-11174)

    Vulnerability from cvelistv5 – Published: 2025-11-01 01:47 – Updated: 2026-04-08 16:43
    VLAI
    Title
    Document Library Lite <= 1.1.6 - Missing Authorization to Sensitive Information Exposure
    Summary
    The Document Library Lite plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 1.1.6. This is due to the plugin exposing an unauthenticated AJAX action dll_load_posts which returns a JSON table of document data without performing nonce or capability checks. The handler accepts an attacker-controlled args array where the status option explicitly allows draft, pending, future, and any. This makes it possible for unauthenticated attackers to retrieve unpublished document titles and content via the AJAX endpoint.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-11-03 18:57 UTC
    CWE
    Assigner
    Wordfence CNA
    References
    Impacted products
    Vendor Product Version
    barn2media Document Library Lite Affected: 0 , ≤ 1.1.6 (semver)
    		Create a notification for this product.
    Credits
    Avraham Shemesh Kai Aizen
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-11174",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-03T18:57:02.582348Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-03T18:57:14.666Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Document Library Lite",
          "vendor": "barn2media",
          "versions": [
            {
              "lessThanOrEqual": "1.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Avraham Shemesh"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Kai Aizen"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Document Library Lite plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 1.1.6. This is due to the plugin exposing an unauthenticated AJAX action dll_load_posts which returns a JSON table of document data without performing nonce or capability checks. The handler accepts an attacker-controlled args array where the status option explicitly allows draft, pending, future, and any. This makes it possible for unauthenticated attackers to retrieve unpublished document titles and content via the AJAX endpoint."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:43:41.484Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b73d48a-1f10-4e47-a18f-82a3103b72bd?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/document-library-lite/tags/1.1.5/src/Table/Ajax_Handler.php#L23"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/document-library-lite/tags/1.1.5/src/Table/Ajax_Handler.php#L32"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/document-library-lite/tags/1.1.5/src/Simple_Document_Library.php#L492"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3385033/document-library-lite/trunk/src/Table/Ajax_Handler.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-10-08T17:25:11.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2025-10-31T13:31:48.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Document Library Lite \u003c= 1.1.6 - Missing Authorization to Sensitive Information Exposure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-11174",
    "datePublished": "2025-11-01T01:47:40.902Z",
    "dateReserved": "2025-09-29T18:05:00.817Z",
    "dateUpdated": "2026-04-08T16:43:41.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}