Deadbee

The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the toggle sync status() function. This makes it possible for unauthenticated attackers to toggle the status of sync rules (enable/disable) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

**Name of the Vulnerable Software and Affected Versions** Chatbot for WordPress plugin versions through 2.4.8 **Description** The Chatbot for WordPress plugin is susceptible to Stored Cross-Site Scripting. This is due to inadequate input sanitization and output escaping in the ` inpost head script[synth header script]` post meta field. Authenticated attackers with Contributor-level access or higher can inject malicious web scripts into pages. These scripts will then execute when a user accesses the compromised page. **Recommendations** Update the Chatbot for WordPress plugin to a version newer than 2.4.8.

**Name of the Vulnerable Software and Affected Versions** Secure Copy Content Protection and Content Locking plugin for WordPress versions through 4.9.8 **Description** The software is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. The vulnerability is triggered through the 'X-Forwarded-For' HTTP header. **Recommendations** Update the Secure Copy Content Protection and Content Locking plugin to a version newer than 4.9.8.

**Name of the Vulnerable Software and Affected Versions** NEX-Forms – Ultimate Forms Plugin for WordPress versions through 9.1.8 **Description** The software contains a flaw that allows unauthorized access to data. A missing capability check within the `NF5 Export Forms` class constructor permits unauthenticated attackers to export form configurations. This export may include sensitive information such as email addresses, PayPal API credentials, and third-party integration keys. Exploitation involves enumerating the `nex forms Id` parameter. **Recommendations** Update to a version later than 9.1.8.

**Name of the Vulnerable Software and Affected Versions** New User Approve plugin for WordPress versions up to and including 3.2.2 **Description** The New User Approve plugin for WordPress is susceptible to unauthorized data access and modification. This is due to a missing capability check on multiple REST API endpoints. An unauthenticated attacker can approve or deny user accounts, retrieve sensitive user information such as emails and roles, and force logout of privileged users. The affected API endpoints include those used for user approval and account management. The vulnerable functionality allows manipulation of user account status and access to user data without proper authorization. **Recommendations** Update the New User Approve plugin to a version beyond 3.2.2.

**Name of the Vulnerable Software and Affected Versions** RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress versions through 5.0.10 **Description** The WordPress RSS Aggregator plugin is susceptible to a Reflected Cross-Site Scripting issue. Insufficient input sanitization and output escaping in the `className` parameter allows unauthenticated attackers to inject arbitrary web scripts into pages. Successful exploitation requires tricking a user into performing an action, such as clicking a malicious link, which then executes the injected script. **Recommendations** Update the RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin to version 5.0.11 or later.

**Name of the Vulnerable Software and Affected Versions** EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress versions prior to 4.2.7.1 **Description** The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is susceptible to sensitive information disclosure via the REST API. An unauthenticated attacker can extract sensitive booking data, including user names, email addresses, ticket details, payment information, and order keys, when the API is enabled by an administrator. The vulnerability was partially addressed in version 4.2.7.0, but remained exploitable. The affected API endpoint is not specified. The vulnerable parameter is not specified. **Recommendations** Update to version 4.2.7.1 or later.

**Name of the Vulnerable Software and Affected Versions** Tainacan plugin for WordPress versions up to and including 1.0.1 **Description** The Tainacan plugin for WordPress has a flaw where unauthorized metadata sections can be created. This is because the `create item permissions check()` function always returns true, bypassing necessary authentication and authorization checks. This allows unauthenticated attackers to create arbitrary metadata sections for any collection through the public REST API, provided they have access to the WordPress site. **Recommendations** Update the Tainacan plugin to a version beyond 1.0.1.

**Name of the Vulnerable Software and Affected Versions** Prime Slider – Addons for Elementor plugin for WordPress versions up to and including 4.0.9 **Description** The Prime Slider – Addons for Elementor plugin for WordPress is susceptible to Server-Side Request Forgery (SSRF). This allows authenticated attackers with subscriber-level access or higher to make web requests to arbitrary locations originating from the web application. This can be used to query and modify information from internal services. The vulnerability is present in the `import elementor template` AJAX action. **Recommendations** Update Prime Slider – Addons for Elementor plugin for WordPress to a version later than 4.0.9.

**Name of the Vulnerable Software and Affected Versions** Secure Copy Content Protection and Content Locking versions prior to 4.9.2 **Description** The Secure Copy Content Protection and Content Locking plugin for WordPress exhibits sensitive information exposure. This occurs because exported CSV files are stored in a publicly accessible directory using predictable filenames. An unauthenticated attacker can access sensitive user data, including emails, IP addresses, usernames, roles, and location data, by directly accessing these CSV files. **Recommendations** Update Secure Copy Content Protection and Content Locking to a version newer than 4.9.2.

**Name of the Vulnerable Software and Affected Versions** Secure Copy Content Protection and Content Locking plugin for WordPress versions through 4.9.2 **Description** The plugin is susceptible to Cross-Site Request Forgery due to the absence of nonce validation on the `ays sccp results export file` AJAX action. This allows unauthenticated attackers to export sensitive plugin data, including email addresses, IP addresses, physical addresses, user IDs, and other user information, by deceiving a site administrator into performing an action. The exported data is stored in a publicly accessible file, enabling attackers to obtain the sensitive information without authentication. **Recommendations** Versions prior to and including 4.9.2 should be updated to a newer, fixed version when available. As a temporary workaround, consider disabling the `ays sccp results export file` AJAX action until a patch is available.

**Name of the Vulnerable Software and Affected Versions** SurveyFunnel – Survey Plugin for WordPress versions up to and including 1.1.5 **Description** The SurveyFunnel – Survey Plugin for WordPress is susceptible to exposure of sensitive information. Unauthenticated attackers can extract sensitive data from survey responses through several unprotected REST API endpoints. Specifically, the `/wp-json/surveyfunnel/v2/` endpoints are vulnerable. **Recommendations** Versions prior to 1.1.5 should be updated to a newer version.

**Name of the Vulnerable Software and Affected Versions** The Photo Gallery by Ays plugin for WordPress versions prior to 6.4.9 **Description** The software is susceptible to Cross-Site Request Forgery due to a lack of nonce verification on the bulk action functionality within the `process bulk action()` function. This allows unauthenticated attackers to perform bulk operations – including deleting, publishing, or unpublishing galleries – if they can trick an administrator into performing an action, such as clicking a link. **Recommendations** Update The Photo Gallery by Ays plugin to version 6.4.9 or later.

**Name of the Vulnerable Software and Affected Versions** The Poll, Survey & Quiz Maker Plugin by Opinion Stage versions prior to 19.12.0 **Description** The software is susceptible to Cross-Site Request Forgery due to missing or insufficient nonce validation. An unauthenticated attacker could disconnect the site from the Opinion Stage platform integration by tricking a site administrator into performing an action. The vulnerable function is `disconnect account action`. **Recommendations** Update The Poll, Survey & Quiz Maker Plugin by Opinion Stage to version 19.12.0 or later.

**Name of the Vulnerable Software and Affected Versions** Tainacan plugin for WordPress versions up to and including 1.0.0 **Description** The Tainacan plugin for WordPress has an information exposure issue in versions up to and including 1.0.0. Uploaded files marked as private are exposed in the wp-content directory without sufficient protection, potentially allowing unauthenticated attackers to extract sensitive information. **Recommendations** Update the Tainacan plugin to a version newer than 1.0.0.

**Name of the Vulnerable Software and Affected Versions** Tainacan versions prior to 1.0.1 **Description** The Tainacan plugin for WordPress is susceptible to Reflected Cross-Site Scripting. This is due to insufficient input sanitization and output escaping in the `search` parameter. An unauthenticated attacker can inject arbitrary web scripts into pages, which will execute if a user is tricked into performing an action, such as clicking a link. The API endpoint affected is not specified. The vulnerable parameter is `search`. **Recommendations** Update Tainacan to version 1.0.1 or later.