Azril Fathoni

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'file upload' parameter in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the 'Store Submissions' setting to be enabled, as this controls whether unsanitized field values are persisted to the database and subsequently rendered via dangerouslySetInnerHTML in the admin entry viewer.

**Name of the Vulnerable Software and Affected Versions** AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress versions prior to 10.8.3 **Description** The plugin fails to properly verify if a user is authorized to perform specific actions. This allows authenticated attackers with subscriber-level access or higher to modify privileged configuration settings and export subscriber secret keys. If a target administrator's email address is known, these actions can be chained to achieve a full administrator account takeover. The issue is associated with the `acymailing router` endpoint. **Recommendations** Update the plugin to a version later than 10.8.2.

Name of the Vulnerable Software and Affected Versions Contact Form by Supsystic plugin for WordPress versions up to and including 1.7.36 Description The Contact Form by Supsystic plugin for WordPress is susceptible to Server-Side Template Injection (SSTI), which can lead to Remote Code Execution (RCE). This occurs because the plugin utilizes the Twig `Twig Loader String` template engine without proper sandboxing. The `cfsPreFill` functionality allows unauthenticated users to inject arbitrary Twig expressions into form field values through GET parameters. Attackers can exploit the `registerUndefinedFilterCallback()` method within Twig to register arbitrary PHP callbacks, ultimately enabling the execution of PHP functions and operating system commands on the server. Recommendations Update the Contact Form by Supsystic plugin to a version newer than 1.7.36.