Alex Thomas

**Name of the Vulnerable Software and Affected Versions** Gravity Forms versions prior to 3.0.3 **Description** An arbitrary file upload issue exists affecting over 1 million WordPress installations. The flaw originates from insufficient validation of the multi-file upload chunk state within the `GFAsyncUpload::upload()` function. Specifically, a cryptographic domain-confusion flaw occurs because `wp hash()` is reused without context separation for both public form state and chunk-continuation authentication, allowing attackers to reuse a legitimate URL hash to authenticate malicious upload requests. Unauthenticated attackers can exploit this when a public form has a File Upload field with Multiple Files enabled by uploading a PNG or PDF polyglot—a file that is valid in two different formats—to a filename of their choice, such as `.php` or `.html`, in the temporary upload directory. This can lead to remote code execution on systems using NGINX or other web servers that do not respect `.htaccess` files. On servers where PHP execution is blocked, such as Apache, uploading an HTML file can result in stored same-origin cross-site scripting (XSS), which occurs when a malicious script is permanently stored on the server and executed in the victim's browser. **Recommendations** Update Gravity Forms to a version newer than 3.0.2. As a temporary mitigation, disable the Multiple Files option in File Upload fields on all public forms.

**Name of the Vulnerable Software and Affected Versions** WPMU DEV Dashboard versions prior to 5.0.2 **Description** An authentication bypass exists in the Hub Single Sign-On (SSO) flow, potentially affecting an estimated 350,000 WordPress sites. The issue stems from HMAC canonicalization confusion—a protocol design failure where the signer and verifier disagree on the message structure—between two unauthenticated AJAX endpoints: 'wdpsso step1' and 'wdpsso step2'. In 'wdpsso step1', the system signs a concatenation of `token`, `state`, `redirect`, and `domain` without delimiters. However, 'wdpsso step2' verifies a concatenation that omits the `domain` field. An attacker can use 'wdpsso step1' as a signing oracle by providing an empty `redirect` value to obtain a valid HMAC for the combined `token`, `state`, and `domain`. By replaying this HMAC to 'wdpsso step2' and moving the `domain` value into the `redirect` field, the resulting byte string remains identical, causing the verification to succeed. This allows an unauthenticated attacker to obtain an authenticated administrator session if Hub SSO is enabled and mapped to an administrator. If the WordPress theme or plugin editor is accessible, this can lead to full site takeover and remote code execution via PHP modification. **Recommendations** Update WPMU DEV Dashboard to version 5.0.2. As a temporary workaround, disable Hub SSO.

**Name of the Vulnerable Software and Affected Versions** Avada versions prior to 7.16.1 Fusion Builder versions prior to 3.16.1 **Description** An unauthenticated attacker can achieve remote code execution and complete site compromise by writing attacker-controlled PHP files to the server. This is possible through a six-stage chain of weaknesses involving authorization, input validation, trust boundaries, privileged behavior, and file handling across the theme and its required plugin. Successful exploitation requires both the theme and the plugin to be installed and active, as well as the presence of certain administrator-authored content. Over 1 million sites are potentially affected. **Recommendations** Update Avada to version 7.16.1 or later. Update Fusion Builder to version 3.16.1 or later.

Name of the Vulnerable Software and Affected Versions The AM LottiePlayer plugin for WordPress versions up to and including 3.6.0 Description The AM LottiePlayer plugin for WordPress is susceptible to Stored Cross-Site Scripting through uploaded SVG files. Insufficient input sanitization and output escaping allow authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. Recommendations Update the AM LottiePlayer plugin to a version newer than 3.6.0.

**Name of the Vulnerable Software and Affected Versions** Houzez versions prior to 4.1.7 **Description** The Houzez theme for WordPress is susceptible to PHP Object Injection due to deserialization of untrusted input within the `saved-search-item.php` file. This allows authenticated attackers with Subscriber-level access or higher to inject a PHP Object. Currently, no known PHP Object Injection (POP) chain exists within the vulnerable software itself. However, if another plugin or theme containing a POP chain is installed on the same site, an attacker may be able to perform actions such as deleting arbitrary files, retrieving sensitive data, or executing code, depending on the specific POP chain present. **Recommendations** Update Houzez to version 4.1.7 or later.

**Name of the Vulnerable Software and Affected Versions** Houzez theme for WordPress versions prior to 4.1.7 **Description** The Houzez theme for WordPress is susceptible to Stored Cross-Site Scripting through SVG file uploads. This is due to inadequate input sanitization and output escaping within the `houzez property img upload()` and `houzez property attachment upload()` functions. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which will execute when a user accesses the SVG file. **Recommendations** Update the Houzez theme to version 4.1.7 or later.

**Name of the Vulnerable Software and Affected Versions** Everest Forms (Pro) versions up to and including 1.9.7 **Description** The Everest Forms (Pro) plugin for WordPress is susceptible to PHP Object Injection due to deserialization of untrusted input within the `mime content type()` function. This allows unauthenticated attackers to inject a PHP Object when a form with a non-required signature field and an image upload field is present on the site. The impact of this issue is limited unless another plugin or theme containing a PHP Object Payload (POP) chain is installed. If a POP chain exists on the system, an attacker could potentially delete files, retrieve sensitive data, or execute code. This vulnerability is exploitable in PHP versions prior to 8. **Recommendations** Versions prior to 1.9.8 are affected. Update to a version greater than 1.9.7.

Name of the Vulnerable Software and Affected Versions: Easy Restaurant Menu Manager plugin for WordPress versions up to and including 2.0.1 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the `nsc eprm menu link` shortcode. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page. Recommendations: For versions up to and including 2.0.1, consider disabling the `nsc eprm menu link` shortcode until a patch is available to prevent exploitation. Restrict access to the shortcode's attributes to minimize the risk of arbitrary script injection.

**Name of the Vulnerable Software and Affected Versions** Radio Player plugin for WordPress versions up to, and including, 2.0.73 **Description** The issue is related to a missing capability check on the `update player` function, allowing unauthenticated attackers to update player instances. This enables unauthorized modification of data. **Recommendations** For versions up to, and including, 2.0.73, consider disabling the `update player` function until a patch is available to prevent unauthorized data modification. Restrict access to the update functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Radio Player plugin for WordPress versions up to, and including, 2.0.73 **Description** The issue allows unauthorized modification of data due to a missing capability check on the `update settings` function. This makes it possible for unauthenticated attackers to update plugin settings. **Recommendations** For versions up to, and including, 2.0.73, update to a version that includes a fix for the missing capability check in the `update settings` function. As a temporary workaround, consider restricting access to the `update settings` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Popup Builder plugin for WordPress (affected versions not specified) **Description** The issue allows authenticated attackers with subscriber-level access and above to perform unauthorized actions due to a missing capability check on all AJAX actions. This enables them to delete subscribers and import subscribers, potentially leading to stored cross-site scripting attacks. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Content Blocks (Custom Post Widget) plugin for WordPress versions up to, and including, 3.3.0 **Description** The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's `content block` shortcode. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 3.3.0, update to a version that addresses the insufficient input sanitization and output escaping issue in the `content block` shortcode. As a temporary workaround, consider restricting access to the `content block` shortcode for users with contributor-level access and above until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Shortcodes and extra features for Phlox theme plugin for WordPress versions up to, and including, 2.15.5 **Description** The issue is related to Stored Cross-Site Scripting via the `title tag` parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 2.15.5, update to a version higher than 2.15.5 to resolve the issue. As a temporary workaround, consider restricting access to the `title tag` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** HT Mega – Absolute Addons For Elementor plugin for WordPress versions up to, and including, 2.4.6 **Description** The issue is related to Stored Cross-Site Scripting via the plugin's blocks due to insufficient input sanitization and output escaping on the `titleTag` user-supplied attributes. This allows authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 2.4.6, consider disabling the blocks feature in the HT Mega – Absolute Addons For Elementor plugin until a patch is available, and restrict access to the `titleTag` attribute to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Export WP Page to Static HTML/CSS plugin for WordPress versions up to, and including, 2.1.9 **Description** The issue is related to a missing capability check on multiple AJAX actions, allowing authenticated attackers with subscriber-level access and above to access and modify sensitive data. This can lead to the disclosure of sensitive information or the performance of unauthorized actions, such as saving advanced plugin settings. **Recommendations** For Export WP Page to Static HTML/CSS plugin for WordPress versions up to, and including, 2.1.9, update to a version higher than 2.1.9 to resolve the issue. As a temporary workaround, consider restricting access to the AJAX actions until a patch is available. Restrict subscriber-level access and above to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Funnelforms Free plugin for WordPress versions up to, and including, 3.4 **Description** The issue allows authenticated attackers with subscriber-level permissions and above to create copies of arbitrary posts due to a missing capability check on the `fnsf copy posts` function. **Recommendations** For versions up to, and including, 3.4, update to a version that includes a fix for the missing capability check in the `fnsf copy posts` function.

**Name of the Vulnerable Software and Affected Versions** Funnelforms Free plugin for WordPress versions up to, and including, 3.4 **Description** The issue allows authenticated attackers with subscriber-level permissions and above to modify data without authorization due to a missing capability check on the `fnsf af2 trigger dark mode` function. This enables them to enable or disable the dark mode plugin setting. **Recommendations** For versions up to, and including, 3.4, update to a version that includes a fix for the missing capability check in the `fnsf af2 trigger dark mode` function to prevent unauthorized modification of data.

**Name of the Vulnerable Software and Affected Versions** Funnelforms Free plugin for WordPress versions up to, and including, 3.4 **Description** The issue allows authenticated attackers with subscriber-level permissions and above to modify data without authorization. This is due to a missing capability check on the `fnsf delete category` function, enabling them to delete categories. **Recommendations** For versions up to, and including, 3.4, update to a version that includes a fix for the missing capability check in the `fnsf delete category` function to prevent unauthorized data modification.

**Name of the Vulnerable Software and Affected Versions** Funnelforms Free plugin for WordPress versions up to, and including, 3.4 **Description** The issue allows authenticated attackers with subscriber-level permissions and above to modify the Funnelforms category for a given post ID due to a missing capability check on the `fnsf update category` function. **Recommendations** For versions up to, and including, 3.4, update to a version that includes a fix for the missing capability check in the `fnsf update category` function to prevent unauthorized modification of data.

**Name of the Vulnerable Software and Affected Versions** Funnelforms Free plugin for WordPress versions up to and including 3.4 **Description** The issue allows authenticated attackers with subscriber-level permissions and above to modify data without proper authorization. This is due to a missing capability check on the `fnsf delete posts` function, enabling them to delete arbitrary posts, including those of administrators and posts unrelated to the Funnelforms Free plugin. **Recommendations** For versions up to and including 3.4, consider disabling the `fnsf delete posts` function until a patch is available to prevent unauthorized post deletion. Restrict access to the Funnelforms Free plugin's functionality to minimize the risk of exploitation.