Tharadol Suksamran

**Nome do Software Vulnerável e Versões Afetadas** GLS Shipping for WooCommerce versões anteriores a 1.4.1 **Descrição** Ocorre Cross-Site Scripting Refletido devido à sanitização de entrada e escape de saída insuficientes. Isso permite que atacantes não autenticados injetem scripts web arbitrários em páginas, que são executados quando um usuário é enganado para realizar uma ação, como clicar em um link. O problema envolve o parâmetro `failed orders`. **Recomendações** Atualize para uma versão posterior a 1.4.0. Como medida paliativa temporária, restrinja o acesso ou evite usar o parâmetro `failed orders` até que a atualização seja aplicada.

**Name of the Vulnerable Software and Affected Versions** Youzify versões anteriores a 1.3.7 **Description** O plugin Youzify para WordPress contém um problema de Stored Cross-Site Scripting causado por sanitização de entrada e escape de saída insuficientes. Atacantes autenticados com nível de acesso Assinante ou superior podem injetar scripts web arbitrários através do parâmetro `checkin place id`. Esses scripts são executados sempre que um usuário visita a página afetada. **Recommendations** Atualize o plugin para uma versão posterior a 1.3.6. Como medida paliativa temporária, restrinja o uso do parâmetro `checkin place id` para minimizar o risco de exploração.

**Name of the Vulnerable Software and Affected Versions** Categories Images plugin for WordPress versões anteriores a 3.3.2 **Description** O plugin está sujeito a Stored Cross-Site Scripting através do shortcode 'z taxonomy image'. O problema ocorre porque o caminho de renderização do shortcode passa a entrada de classe controlada pelo invasor para um construtor de imagem de fallback que concatena atributos HTML sem a devida filtragem. Isso permite que invasores autenticados com acesso de nível Contributor ou superior injetem scripts web arbitrários que são executados quando os usuários interagem com a página frontend injetada por meio do atributo de shortcode `class`. **Recommendations** Atualize o plugin para uma versão posterior a 3.3.1. Como medida paliativa temporária, restrinja o uso do atributo `class` dentro do shortcode 'z taxonomy image'.

Name of the Vulnerable Software and Affected Versions Beaver Builder Page Builder versões até e incluindo 2.10.1.1 Description O plugin Beaver Builder Page Builder para WordPress é suscetível a Cross-Site Scripting Armazenado através do parâmetro `settings[js]` devido à sanitização e escape de saída inadequados. Isso permite que atacantes autenticados com acesso de nível de autor ou superior injetem scripts web maliciosos em páginas, que serão então executados quando um usuário acessar a página comprometida. Recommendations Atualize o Beaver Builder Page Builder para uma versão posterior a 2.10.1.1.

**Name of the Vulnerable Software and Affected Versions** Contact List plugin for WordPress versions prior to 3.0.19 **Description** The Contact List plugin for WordPress is susceptible to Stored Cross-Site Scripting through the ` cl map iframe` parameter. Insufficient input sanitization and output escaping when handling the Google Maps iframe custom field allows for the injection of malicious scripts. The `saveCustomFields()` function in the class-contact-list-custom-fields.php file extracts iframe tags using a regular expression but fails to validate or sanitize the iframe's attributes, enabling the inclusion of event handlers like 'onload'. The extracted iframe HTML is stored using the `update post meta()` function and subsequently rendered on the front-end in class-cl-public-card.php without proper escaping or filtering. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which will execute when a user accesses the affected page. **Recommendations** Update the Contact List plugin to version 3.0.19 or later.

**Name of the Vulnerable Software and Affected Versions** Unlimited Elements for Elementor plugin for WordPress versions prior to 2.0.6 **Description** The Unlimited Elements for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting through the form entry fields. This is caused by inadequate input sanitization and output escaping of form submission data when displayed in the admin Form Entries Trash view. This allows unauthenticated attackers to inject arbitrary web scripts that will execute when an administrator views the trashed form entries. **Recommendations** Update the Unlimited Elements for Elementor plugin to version 2.0.6 or later.

**Name of the Vulnerable Software and Affected Versions** EventPrime versions prior to 4.2.8.5 **Description** The EventPrime plugin for WordPress is susceptible to unauthorized image file uploads. The plugin registers the `upload file media` API endpoint as publicly accessible without requiring authentication, authorization, or nonce verification, despite a nonce being created. This allows unauthenticated attackers to upload image files to the WordPress uploads directory and create Media Library attachments via the `ep upload file media` endpoint. **Recommendations** Update EventPrime to version 4.2.8.5 or later.

**Name of the Vulnerable Software and Affected Versions** MyRewards – Loyalty Points and Rewards for WooCommerce plugin versions prior to 5.6.1 **Description** The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress does not properly verify user authorization when performing actions within the `ajax` function. This allows authenticated attackers with subscriber-level access or higher to modify, add, or delete loyalty program earning rules. Specifically, attackers can manipulate point multipliers to arbitrary values. **Recommendations** Update the MyRewards – Loyalty Points and Rewards for WooCommerce plugin to version 5.6.1 or later.

**Name of the Vulnerable Software and Affected Versions** Tutor LMS versions prior to 3.9.5 **Description** The Tutor LMS plugin for WordPress is susceptible to Insecure Direct Object References (IDOR) due to insufficient object-level authorization checks. Specifically, the `course list bulk action()`, `bulk delete course()`, and `update course status()` functions lack proper validation. This allows authenticated attackers with Tutor Instructor-level access or higher to modify or delete courses they do not own by manipulating course IDs in bulk action requests. The vulnerable parameter is the course ID used in bulk action requests. **Recommendations** Update Tutor LMS to a version later than 3.9.5. As a temporary workaround, restrict access to the `course list bulk action()`, `bulk delete course()`, and `update course status()` functions for users with Tutor Instructor-level access or higher.

**Name of the Vulnerable Software and Affected Versions** IndieWeb plugin for WordPress versions through 4.0.5 **Description** The IndieWeb plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to inadequate input sanitization and output escaping related to the `Telephone` parameter. Authenticated attackers with author-level access or higher can inject malicious web scripts into pages. These scripts will then execute when a user views the compromised page. **Recommendations** Update the IndieWeb plugin to a version later than 4.0.5.