Daroo

**Name of the Vulnerable Software and Affected Versions** Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation versions prior to 2.9.1 **Description** This plugin contains a Directory Traversal flaw within the `processAttachment()` function. This allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information. Directory Traversal is a security gap that allows an attacker to access files and directories stored outside the web root folder. **Recommendations** Update the plugin to a version newer than 2.9.0. As a temporary workaround, consider restricting access to the `processAttachment()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Fluent Forms versions prior to 6.2.8 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). This occurs via the Name Field Nested `password` member, enabling the injection of arbitrary web scripts into pages that execute when accessed by a user. **Recommendations** Update to version 6.2.8 or later.

**Name of the Vulnerable Software and Affected Versions** Fluent Forms Pro Add On Pack versions prior to 6.2.7 **Description** An issue exists where the plugin is susceptible to PHP Object Injection through the deserialization of untrusted input. Authenticated users with Subscriber-level access or higher can inject a PHP Object. When combined with a POP chain (a sequence of gadgets used to execute arbitrary code during deserialization), this allows attackers to change user passwords and potentially seize administrator accounts. This is only possible if user update integration is enabled and a user meta field is mapped. **Recommendations** Update Fluent Forms Pro Add On Pack to version 6.2.7 or later. As a temporary mitigation, disable user update integration or unmap user meta fields.

**Name of the Vulnerable Software and Affected Versions** The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin versions prior to 7.3.1.5 **Description** Insufficient file path validation in the `fr token()` function allows unauthenticated attackers to delete arbitrary files on the server. This can lead to remote code execution if critical files, such as `wp-config.php`, are removed. Exploitation occurs when a Forminator form is linked to an Uncanny Automator recipe configured for Everyone, enabling the submission of a malicious serialized payload. The process utilizes a gadget chain—a sequence of existing code fragments that can be leveraged for unintended execution—located within the `Action Helpers Email` ` destruct()` method. **Recommendations** Update the plugin to version 7.3.1.5 or later.

The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.10.4 via the 'gform uploaded files' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the targeted form to not enforce login (so publicly accessible), which allows the unauthenticated attacker to reach the process send resume link endpoint and supply an arbitrary recipient email address to receive the traversal-retrieved file as a notification attachment.

**Name of the Vulnerable Software and Affected Versions** WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales versions prior to 2.2.3 **Description** Unauthenticated attackers can perform time-based blind SQL injection, a technique used to extract data from a database by observing the time it takes for the server to respond to specific queries. The issue occurs because the `ajaxCheck()` function fails to properly escape user-supplied column names and does not use prepared statements in the `$wpdb->update()` call. This flaw is accessible via the `fildname` parameter at an endpoint registered for unauthenticated users through `wp ajax nopriv `, allowing for the extraction of sensitive data, such as administrator password hashes. **Recommendations** Update the plugin to a version newer than 2.2.2. As a temporary mitigation, restrict access to the `ajaxCheck()` function or the `fildname` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel versions prior to 8.0.2 **Description** Authenticated attackers with subscriber-level access and above can achieve Remote Code Execution (RCE) due to missing capability checks on the AJAX handlers for `install addon`, `saveMappedFields`, and `StartImport`. The plugin nonce is exposed to any authenticated user capable of loading an admin page, allowing an attacker to install the Import WooCommerce add-on and persist malicious PHP expressions via the `MappedFields` parameter. These expressions are subsequently triggered through the `eval()` function within `ImportHelpers::get meta values()`. RCE is a security flaw that allows an attacker to execute arbitrary commands on the host server. **Recommendations** Update to version 8.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** UsersWP versions prior to 1.2.66 **Description** Authenticated attackers with Subscriber-level access and above can delete arbitrary files on the server, including the wp-config.php file. This occurs because the `validate fields()` function in `UsersWP Validation` fails to properly validate file-field values, allowing directory-traversal sequences to remain. Subsequently, the `upload file remove()` AJAX handler constructs the deletion target by concatenating the uploads base directory with attacker-controlled metadata without performing realpath canonicalization or boundary checks before calling the `unlink()` function. Directory traversal is a technique used to access files and directories that are stored outside the web root folder. **Recommendations** Update UsersWP to a version beyond 1.2.65.

**Name of the Vulnerable Software and Affected Versions** Tainacan versions prior to 1.0.4 **Description** The Tainacan plugin for WordPress contains a time-based blind SQL Injection flaw. This occurs because the software does not sufficiently escape user-supplied input or properly prepare the SQL query. Unauthenticated attackers can exploit this by appending malicious SQL queries to existing ones via the `geoquery` parameter in the REST API to extract sensitive information from the database. Time-based blind SQL Injection is a technique where an attacker asks the database true/false questions and determines the answer based on the time the server takes to respond. **Recommendations** Update Tainacan to version 1.0.4 or later. As a temporary mitigation, restrict access to the `geoquery` parameter in the REST API.

**Name of the Vulnerable Software and Affected Versions** Ultimate Member versions prior to 2.11.5 **Description** The Ultimate Member plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because of insufficient input sanitization and output escaping when handling the `about me` parameter. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages, which then execute when other users visit those pages. **Recommendations** Update the plugin to version 2.11.5 or later.

**Name of the Vulnerable Software and Affected Versions** Timetics versions prior to 1.0.59 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update to a version newer than 1.0.58.

Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions.

**Name of the Vulnerable Software and Affected Versions** Optimole versions prior to 4.2.8 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update to a version newer than 4.2.7.

Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions.

Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.4 versions.

**Name of the Vulnerable Software and Affected Versions** ThemePunch Slider Revolution versions 7.0.0 through 7.0.16 **Description** Improper neutralization of input during web page generation allows for Reflected Cross-site Scripting (XSS), a flaw where malicious scripts are reflected off a web application to the victim's browser. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Perfmatters versions prior to 2.6.5 **Description** The Perfmatters plugin for WordPress contains a Directory Traversal flaw, which occurs when an application fails to properly sanitize user-supplied input used to construct file paths. This allows unauthenticated attackers to read arbitrary files on the server that may contain sensitive information via the `s` parameter. Successful exploitation requires the Local Google Fonts feature to be enabled, pretty permalinks to be active, and RSS feed links to be enabled in the plugin settings. **Recommendations** Update the plugin to version 2.6.5 or later. As a temporary mitigation, disable the Local Google Fonts feature, deactivate pretty permalinks, or disable RSS feed links in the plugin settings.

Contributor SQL Injection in Custom Field Template <= 2.7.8 versions.

**Name of the Vulnerable Software and Affected Versions** Ninja Forms - File Uploads versions prior to 3.3.30 **Description** Unauthenticated attackers can read arbitrary files on the server. This occurs because the `attach files()` function utilizes the `get files for attachment()` function, which accepts a raw attacker-controlled `files` array. When the `process()` method returns early due to a client-supplied `saveProgress` flag, the system bypasses upload validation, path normalization, and database record creation. Consequently, an attacker-supplied `file path` value can be passed to `wp mail()` as an email attachment, subject only to a `file exists()` check. **Recommendations** Update Ninja Forms - File Uploads to version 3.3.30 or later. As a temporary mitigation, restrict access to the `attach files()` function.

Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions.