Bonds

Subscriber Broken Access Control in Flatsome <= 3.20.5 versions.

Contributor Broken Access Control in Flatsome <= 3.20.5 versions.

**Name of the Vulnerable Software and Affected Versions** BEAR versions prior to 1.1.9 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update BEAR to a version newer than 1.1.8.

Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versions.

**Name of the Vulnerable Software and Affected Versions** TablePress versions prior to 3.3.2 **Description** An unauthenticated cross-site scripting (XSS) flaw allows malicious script content to be injected via user-controlled input rendered by the plugin. The issue stems from improper input validation and output escaping, which enables stored or reflected script execution in plugin-generated pages. A remote attacker can submit crafted payloads that execute client-side code in the browser of site visitors or administrators, potentially leading to session hijacking, credential theft, admin action forgery, and full site takeover. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unauthenticated Local File Inclusion in EcoBlue <= 1.15 versions.

**Name of the Vulnerable Software and Affected Versions** Kastell versions prior to 2.1 **Description** An unauthenticated Local File Inclusion (LFI) issue exists in the Kastell WordPress theme. Local File Inclusion is a flaw that allows an attacker to include files on the server through the web application, potentially leading to the disclosure of sensitive information. **Recommendations** Update to a version later than 2.0.

Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions.

**Name of the Vulnerable Software and Affected Versions** Nifty versions 1.4.1 and earlier **Description** Unauthenticated PHP Object Injection allows an attacker to inject malicious objects into the application. PHP Object Injection occurs when user-supplied input is passed to the `unserialize()` function without proper validation, potentially leading to remote code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** wpDataTables versions prior to 7.3.7 **Description** An unauthenticated SQL Injection exists in the wpDataTables plugin. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database, potentially allowing them to view data they are not normally able to retrieve. **Recommendations** Update to a version newer than 7.3.6.

Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions.

**Name of the Vulnerable Software and Affected Versions** JetSearch versions prior to 3.5.18 **Description** An unauthenticated SQL Injection allows an attacker to interfere with the queries that an application makes to its database. This occurs in the JetSearch WordPress plugin. **Recommendations** Update to a version newer than 3.5.17.

**Name of the Vulnerable Software and Affected Versions** Elementor Website Builder versions prior to 4.1.0 **Description** A missing authorization issue allows for the exploitation of incorrectly configured access control security levels. **Recommendations** Update to a version later than 4.1.0.

**Name of the Vulnerable Software and Affected Versions** ElementsKit Elementor addons Lite versions prior to 3.9.7 **Description** A missing authorization issue in Wpmet ElementsKit Elementor addons Lite allows for the exploitation of incorrectly configured access control security levels. This is a broken access control flaw where the system fails to properly verify if a user has the necessary permissions to perform an action. **Recommendations** Update to a version newer than 3.9.6.

**Name of the Vulnerable Software and Affected Versions** ElementsKit Elementor addons Lite versions prior to 3.9.7 **Description** A missing authorization issue in Wpmet ElementsKit Elementor addons Lite allows for the exploitation of incorrectly configured access control security levels. This is a broken access control flaw where the system fails to properly verify if a user has the necessary permissions to perform an action. **Recommendations** Update to a version newer than 3.9.6.

Name of the Vulnerable Software and Affected Versions Brainstorm Force Ultimate Addons for WPBakery Page Builder versions prior to 3.21.4 Description Brainstorm Force Ultimate Addons for WPBakery Page Builder is susceptible to a DOM-Based Cross-Site Scripting (XSS) issue due to improper neutralization of input during web page generation. This allows for potential malicious code execution within the context of a user's browser. Recommendations Update Brainstorm Force Ultimate Addons for WPBakery Page Builder to version 3.21.4 or later.

**Name of the Vulnerable Software and Affected Versions** ThemeFusion Avada Core versions prior to 5.15.0 **Description** An issue exists in ThemeFusion Avada Core fusion-core that allows for DOM-Based Cross-site Scripting (XSS). This occurs due to improper neutralization of input during web page generation. The issue affects the way user-supplied data is handled, potentially allowing an attacker to inject malicious scripts into web pages viewed by other users. **Recommendations** Versions prior to 5.15.0 should be updated to version 5.15.0 or later.

**Name of the Vulnerable Software and Affected Versions** ThemeFusion Fusion Builder versions prior to 3.15.0 **Description** An authorization issue exists in ThemeFusion Fusion Builder’s `fusion-builder`. This allows exploitation of incorrectly configured access control security levels. **Recommendations** Update ThemeFusion Fusion Builder to version 3.15.0 or later.

**Name of the Vulnerable Software and Affected Versions** ThemeFusion Fusion Builder versions prior to 3.15.0 **Description** A missing authorization issue exists in ThemeFusion Fusion Builder, allowing exploitation of incorrectly configured access control security levels. The issue allows unauthorized access due to improper configuration of access controls. **Recommendations** Update ThemeFusion Fusion Builder to version 3.15.0 or later.

**Name of the Vulnerable Software and Affected Versions** ThemeFusion Avada Core versions prior to 5.15.0 **Description** A missing authorization check exists in ThemeFusion Avada Core `fusion-core`, allowing exploitation of incorrectly configured access control security levels. The issue allows unauthorized access due to improperly set security controls. **Recommendations** Update ThemeFusion Avada Core to version 5.15.0 or later.