Panagiotis Vagenas

Contact Form by WD 1.13.1 contains a cross-site request forgery vulnerability combined with local file inclusion that allows unauthenticated attackers to include arbitrary files by exploiting unsanitized action parameters. Attackers can craft malicious forms targeting the admin-ajax.php endpoint with directory traversal sequences in the GET action parameter to load files via CSRF, bypassing authentication on vulnerable AJAX actions.

**Nome do software vulnerável e versões afetadas: Plugin WP Membership versão 1.2.3 Descrição: A vulnerabilidade permite que usuários remotos autenticados injetem scripts da Web ou HTML arbitrários por meio de campos de perfil não especificados ou do conteúdo de novas publicações, o que pode levar a ataques de cross-site scripting (XSS). Isso pode ser usado para contornar a etapa de confirmação do administrador para o conteúdo de novas publicações. Recomendações: Para o plugin WP Membership versão 1.2.3, atualize para uma versão que corrija as vulnerabilidades de XSS para impedir a injeção de scripts web ou HTML arbitrários. Como solução temporária, considere restringir o acesso aos campos de perfil e ao conteúdo de novas publicações para minimizar o risco de exploração.

**Name of the Vulnerable Software and Affected Versions** users-ultra plugin versions prior to 1.5.64 **Description** The issue is related to SQL Injection via an ajax action in the users-ultra plugin for WordPress. **Recommendations** For versions prior to 1.5.64, update to version 1.5.64 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** users-ultra plugin versions prior to 1.5.63 **Description** The issue concerns a cross-site scripting (XSS) flaw. It is exploited via the `p name` parameter. **Recommendations** For versions prior to 1.5.63, update to version 1.5.63 or later to resolve the issue. As a temporary workaround, consider restricting access to the `p name` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** users-ultra plugin versions prior to 1.5.59 for WordPress **Description** The issue concerns an arbitrary file upload in the users-ultra plugin for WordPress. This is due to the `uultra-form-cvs-form-conf` feature. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. **Recommendations** For versions prior to 1.5.59, update to version 1.5.59 or later to resolve the issue. As a temporary workaround, consider restricting access to the `uultra-form-cvs-form-conf` feature until the update is applied.

**Name of the Vulnerable Software and Affected Versions** acurax-social-media-widget plugin versions prior to 3.2.6 **Description** The issue concerns a CSRF vulnerability via the `recordsArray` parameter to the "/wp-admin/admin-ajax.php" API endpoint, potentially leading to social widget icon array order XSS. **Recommendations** For versions prior to 3.2.6, update to version 3.2.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** zM Ajax Login & Register plugin versions prior to 1.1.0 **Description** The issue allows remote attackers to include and execute arbitrary php files via a relative path in the `template` parameter in a "load template" action to "wp-admin/admin-ajax.php". **Recommendations** For versions prior to 1.1.0, update to version 1.1.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Free Counter plugin version 1.1 for WordPress **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `value ` parameter in a `check stat` action to "wp-admin/admin-ajax.php" API endpoint. **Recommendations** For Free Counter plugin version 1.1, avoid using the `value ` parameter in the "wp-admin/admin-ajax.php" API endpoint until a fix is available. As a temporary workaround, consider restricting access to the `check stat` action to minimize the risk of exploitation.