Chiao-Lin Yu

The Persian Elementor (المنتور فارسی) plugin for WordPress is vulnerable to Price Manipulation in all versions up to, and including, 2.8.1. This is due to the plugin trusting a user-supplied payment amount without server-side validation against the configured ZarinPal widget price. This makes it possible for unauthenticated attackers to submit arbitrary payment amounts to the ZarinPal gateway via the 'amount' parameter.

The SpeedyCache plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.3.8. This is due to a mismatch between CSS URL validation (which allows query strings like `.css?...`) and path resolution (which strips query strings), combined with no validation that the resolved file is actually a CSS file. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files from the server (including `wp-config.php` and `/etc/passwd`) by injecting crafted `<link>` tags into page content, with the file contents written to publicly accessible cache files.

The Enable jQuery Migrate Helper plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `downgrade jquery version()` function in all versions up to, and including, 1.4.1. This is due to the function only verifying a nonce without checking user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to downgrade the site-wide jQuery version from 3.7.1 to the legacy 1.12.4-wp release, which has knowns security vulnerabilities.

**Name of the Vulnerable Software and Affected Versions** HTTP Headers plugin for WordPress versions prior to 1.19.3 **Description** Insufficient validation of the file path stored in the `hh htpasswd path` option and lack of sanitization on the `hh www authenticate user` option value allow authenticated attackers with Administrator-level access and above to achieve Remote Code Execution. The plugin permits setting an arbitrary file path for the htpasswd file without restricting it to safe extensions. The `apache auth credentials()` function constructs file content using an unsanitized username via `sprintf()`, and the `update auth credentials()` function writes this content to the attacker-controlled path using `file put contents()`, enabling the writing of arbitrary content, such as PHP code, to the server. **Recommendations** Update the plugin to a version newer than 1.19.2.

**Name of the Vulnerable Software and Affected Versions** WebStack versions prior to 1.2025 **Description** The WebStack theme for WordPress allows unauthenticated attackers to upload arbitrary files to the server. This is caused by a lack of file type validation within the `io img upload()` function, which could lead to remote code execution. **Recommendations** Update to a version later than 1.2024. As a temporary workaround, consider disabling the `io img upload()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** The Germanized for WooCommerce plugin for WordPress versions prior to 3.20.6 **Description** The software allows unauthenticated attackers to execute arbitrary shortcodes. This occurs because the application fails to properly validate a value before running the `do shortcode()` function via the `account holder` parameter. **Recommendations** Update the plugin to a version later than 3.20.5. As a temporary workaround, restrict access to the `account holder` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** HT Mega Addons for Elementor versions prior to 3.0.7 **Description** An unauthenticated AJAX action allows the exposure of personally identifiable information (PII), including full name, city, state, and country, of customers who have placed orders within the last 7 days. **Recommendations** Update to version 3.0.7 or later.

Name of the Vulnerable Software and Affected Versions YITH WooCommerce Wishlist WordPress plugin versions prior to 4.13.0 Description The YITH WooCommerce Wishlist WordPress plugin does not properly validate wishlist ownership in the `save title()` AJAX handler when renaming wishlists. The function only verifies a nonce, which is publicly available, allowing unauthenticated attackers to rename any user's wishlist. Recommendations Update to version 4.13.0 or later.

Name of the Vulnerable Software and Affected Versions Spam Protect for Contact Form 7 WordPress plugin versions prior to 1.2.10 Description The Spam Protect for Contact Form 7 WordPress plugin before version 1.2.10 allows logging to a PHP file. This could allow an attacker with editor access to achieve Remote Code Execution by using a crafted header. Recommendations Update the Spam Protect for Contact Form 7 WordPress plugin to version 1.2.10 or later.

**Name of the Vulnerable Software and Affected Versions** WP Maps – Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters plugin for WordPress versions up to and including 4.9.1 **Description** The WP Maps plugin for WordPress is susceptible to time-based SQL Injection. This is due to inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries, specifically through the `orderby` parameter. This allows unauthenticated attackers to inject additional SQL queries into existing database queries, potentially extracting sensitive information. **Recommendations** Update the WP Maps – Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters plugin to a version later than 4.9.1.

**Name of the Vulnerable Software and Affected Versions** EmailKit – Email Customizer for WooCommerce & WP versions prior to 1.6.4 **Description** The EmailKit plugin for WordPress is susceptible to unauthorized file access through a path traversal flaw. This occurs because the `action()` function within the TemplateData class directly uses user-provided input from the 'emailkit-editor-template' REST API parameter with the `file get contents()` function, lacking proper path validation, sanitization, or directory restrictions. Authenticated attackers possessing Administrator privileges can exploit this to read arbitrary files on the server, such as /etc/passwd or wp-config.php, by providing a crafted traversal path. The retrieved file contents are then stored as post meta and can be accessed through the `fetch-data` API endpoint. **Recommendations** Update EmailKit – Email Customizer for WooCommerce & WP to version 1.6.4 or later.

**Name of the Vulnerable Software and Affected Versions** The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress versions up to and including 1.4.7 **Description** The plugin is susceptible to PHP Object Injection due to deserialization of untrusted input within the `download csv` function. This allows unauthenticated attackers to inject a PHP Object. The impact of this issue is limited unless another plugin or theme containing a PHP Object Payload (POP) chain is installed on the same site. If a POP chain is present, an attacker may be able to perform actions such as deleting arbitrary files, retrieving sensitive data, or executing code. **Recommendations** Versions prior to 1.4.7 should be updated. As a temporary workaround, consider restricting access to the `download csv` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Email Subscribers by Icegram Express plugin for WordPress versions up to and including 5.9.16 **Description** The Email Subscribers by Icegram Express plugin for WordPress is susceptible to SQL Injection through the `workflow ids` parameter. Insufficient input validation and query preparation allow authenticated attackers with administrator-level access or higher to inject additional SQL queries into existing database queries. This could lead to the extraction of sensitive information from the database. The API endpoint involved is not explicitly mentioned. **Recommendations** Update the Email Subscribers by Icegram Express plugin to a version later than 5.9.16.

**Name of the Vulnerable Software and Affected Versions** LatePoint – Calendar Booking Plugin for Appointments and Events versions up to and including 5.2.7 **Description** The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is susceptible to SQL Injection through the JSON Import functionality. Insufficient validation of user-supplied JSON data allows authenticated attackers with Administrator-level access or higher to execute arbitrary SQL queries. This could lead to information extraction using time-based techniques, data modification, or table deletion. The vulnerability resides in how the plugin handles the JSON import process. The `JSON` data is not properly sanitized before being used in database queries. **Recommendations** Update LatePoint – Calendar Booking Plugin for Appointments and Events to a version later than 5.2.7.

**Name of the Vulnerable Software and Affected Versions** EmailKit – Email Customizer for WooCommerce & WP versions prior to 1.6.3 **Description** The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress has a flaw that allows unauthorized data modification. This is due to a missing capability check within the `update template data()` function. Authenticated attackers with Subscriber-level access or higher can modify the title of any post, page, or custom post type on the site. **Recommendations** Update EmailKit – Email Customizer for WooCommerce & WP to version 1.6.3 or later.

**Name of the Vulnerable Software and Affected Versions** Element Pack Addons for Elementor versions prior to 8.3.18 **Description** The Element Pack Addons for Elementor plugin for WordPress contains a flaw that allows authenticated attackers with contributor-level access or higher to read arbitrary files on the server. This is possible due to insufficient file validation within the `render svg` function when using the SVG widget. The issue could expose sensitive information contained in these files. **Recommendations** Update Element Pack Addons for Elementor to version 8.3.18 or later.

**Name of the Vulnerable Software and Affected Versions** LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.2.7 **Description** The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check within the `load step()` function. An unauthenticated attacker can view booking information, including customer names, email addresses, phone numbers, appointment times, and service details. **Recommendations** Update to version 5.2.7 or later.

Name of the Vulnerable Software and Affected Versions: DASAN GPON ONU H660WM versions H660WMR210825 Description: The DASAN GPON ONU H660WM device contains insecure default credentials in the modem’s control panel. Recommendations: Change the default credentials of the modem’s control panel.

Name of the Vulnerable Software and Affected Versions: D-Link DSL-7740C versions DSL7740C.V6.TR069.20211230 Description: An incorrect access control issue exists in the Maintenance module. Authenticated attackers with low-level privileges can arbitrarily change high-privileged account passwords and escalate privileges. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: D-Link DSL-7740C versions DSL7740C.V6.TR069.20211230 Description: The D-Link DSL-7740C device with firmware DSL7740C.V6.TR069.20211230 contains a command injection issue via the `ping6` function. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.