Austin Ginder

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template redirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handle request() function routing the mbfs delete action without any capability or ownership check, and the nonce verification in check ajax() being gated behind is ajax() which is false for template redirect requests, making it bypassable. This makes it possible for unauthenticated attackers to delete arbitrary posts and pages by supplying an attacker-controlled post ID via the rwmb frontend field object id GET parameter on any page that hosts a frontend submission form regardless of whether allow delete is enabled.

Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions.

Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions.

Subscriber Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.

Unauthenticated Insecure Direct Object References (IDOR) in GravityView <= 3.0.0 versions.

**Name of the Vulnerable Software and Affected Versions** JetSmartFilters versions prior to 3.8.2 **Description** An unauthenticated SQL Injection allows an attacker to interfere with the queries that an application makes to its database. This occurs in the JetSmartFilters WordPress plugin. **Recommendations** Update to version 3.8.2 or later.

Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.

Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions.