Dmitry Ignatyev

The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headingWrapper' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

**Name of the Vulnerable Software and Affected Versions** Yoast SEO versions prior to 28.1 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access or higher can inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. The exploit requires pretty permalinks to be enabled, as it relies on the `get permalink()` function embedding the stored percent-encoded `post name` variable in the generated URL. **Recommendations** Update to a version newer than 28.0.

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end (the value is passed through do shortcode, which echoes non-shortcode content verbatim), allowing users with administrator-level access to store a script that executes in the browser of any visitor who loads a page displaying the widget.

**Name of the Vulnerable Software and Affected Versions** PDF Invoices & Packing Slips for WooCommerce versions prior to 5.14.1 **Description** An Insecure Direct Object Reference (IDOR) exists in the `generate document shortcode` function due to missing validation on a user-controlled key. Authenticated attackers with contributor-level access or higher can generate publicly accessible, session-free download links for arbitrary third-party orders. This leads to the exposure of sensitive data, including customer names, billing and shipping addresses, email addresses, phone numbers, order and invoice numbers, line items, totals, payment details, and customer notes. This issue is exploitable when the Document link access type setting is configured to 'full'; if set to the default 'logged in' value, the shortcode path is not exploitable for unauthorized access because URLs are signed with a per-session nonce. **Recommendations** Update to a version newer than 5.14.0. Change the Document link access type setting from 'full' to 'logged in' to prevent unauthorized access to order documents.

**Name of the Vulnerable Software and Affected Versions** Essential Addons for Elementor versions prior to 6.6.3 **Description** Stored Cross-Site Scripting (XSS) occurs in the Event Calendar widget due to insufficient input sanitization and output escaping on event titles sourced from The Events Calendar. This allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update to a version newer than 6.6.2. Restrict access to the Event Calendar widget for users with Author-level permissions until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Exclusive Addons for Elementor versions prior to 2.7.9.9 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the `post title` parameter, which then execute when a user visits the affected page. **Recommendations** Update Exclusive Addons for Elementor to version 2.7.9.9 or later.

**Name of the Vulnerable Software and Affected Versions** Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress versions prior to 5.9.28 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level access or higher can exploit this via the `ig es handle request` AJAX action. This allows them to overwrite mail settings such as the from name and from email address, create audience lists, insert arbitrary contacts into those lists, create and overwrite newsletter broadcasts and post notifications, add workflows, and queue and dispatch mass emails to arbitrary recipients. **Recommendations** Update the plugin to a version newer than 5.9.27.

**Name of the Vulnerable Software and Affected Versions** Image Optimizer versions prior to 1.7.5 **Description** An issue exists where insufficient path validation in the `Image Backup::remove()` function allows for arbitrary file deletion. The plugin stores backup file paths in the `image optimizer metadata` post meta field and trusts these paths when executing the `delete attachment` hook. An authenticated attacker with Author-level access can modify the `image optimizer metadata` field via the Custom Fields interface to inject absolute file paths. When the attachment is deleted, the plugin invokes `File System::delete()` on the specified paths without verification, enabling the deletion of any file within the web server's filesystem permissions. This can result in data loss, security degradation, or denial of service. **Recommendations** Update to a version newer than 1.7.4. As a temporary mitigation, restrict Author-level users from accessing the Custom Fields interface to prevent modification of the `image optimizer metadata` field.

**Name of the Vulnerable Software and Affected Versions** Qi Blocks versions prior to 1.5.0 **Description** An Insecure Direct Object Reference occurs when the plugin fails to validate a user-controlled key. Authenticated attackers with author-level access or higher can exploit this to modify stored styles of posts, templates, or widgets they do not own. By using reserved values for the `page id` parameter, attackers can affect site-wide surfaces, leading to unauthorized frontend defacement, content hiding, and page degradation. The issue exists because the endpoint's permission check only verifies generic `edit posts` and `publish posts` capabilities without confirming post ownership. **Recommendations** Update Qi Blocks to version 1.5.0 or later. Restrict the use of the `page id` parameter for users with author-level access until the update is applied.

**Name of the Vulnerable Software and Affected Versions** MaxButtons – Create buttons plugin for WordPress versions prior to 9.8.6 **Description** Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages by tricking a user into clicking a malicious link. The issue is triggered via the `view` parameter. **Recommendations** Update the plugin to version 9.8.6 or later. As a temporary mitigation, restrict or monitor the use of the `view` parameter.

**Name of the Vulnerable Software and Affected Versions** WooCommerce Stripe Payment Gateway versions prior to 10.7.1 **Description** The plugin is subject to unauthorized data modification because the `ajax pay for order()` function lacks a capability check. Specifically, the `wc stripe pay for order` WC-AJAX endpoint does not verify order ownership or the `order key` when processing payments. While the function validates a nonce, this value is publicly accessible on any WooCommerce page with Express Checkout enabled. Consequently, unauthenticated attackers can use sequential order ID enumeration and a fake payment method to trigger a payment exception, forcing pending orders into a failed status. **Recommendations** Update to a version later than 10.7.0. As a temporary workaround, restrict access to the `wc stripe pay for order` WC-AJAX endpoint or disable the `ajax pay for order()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** FooGallery versions prior to 3.1.32 **Description** The FooGallery plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the `foogallery sanitize javascript()` function uses an incomplete blacklist for JavaScript event handlers, blocking only a specific subset (onmouseover, onmouseout, onpointerenter, onclick, onload, onchange, onerror) while allowing others like `onmouseenter`. Additionally, the `foogallery build container attributes safe()` function fails to escape the attribute key when constructing the gallery container HTML. Authenticated attackers with contributor-level access or higher can exploit the `custom attribute key` shortcode parameter to inject arbitrary web scripts that execute when a user visits the affected page. **Recommendations** Update to a version later than 3.1.31. As a temporary workaround, restrict the use of the `custom attribute key` shortcode parameter by users with contributor-level access.

**Name of the Vulnerable Software and Affected Versions** Presto Player versions prior to 4.2.1 **Description** The Presto Player plugin for WordPress contains a Stored Cross-Site Scripting issue. The `getOverlays()` function fails to properly sanitize input and escape output, allowing the `link url` parameter of the `[presto player overlay]` shortcode to be copied directly into the overlay configuration without scheme validation. This allows `javascript:` URIs to be rendered as the href of a clickable anchor element by the presto-dynamic-overlay-ui web component. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the affected page. **Recommendations** Update to a version later than 4.2.0. As a temporary workaround, restrict the use of the `link url` parameter within the `[presto player overlay]` shortcode.

**Name of the Vulnerable Software and Affected Versions** All-In-One Security (AIOS) – Security and Firewall plugin for WordPress versions prior to 5.4.8 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization in the `get rest route()` function and missing output escaping in the `column default()` method of the debug log list table. When the 'Disable REST API for non-logged in users' feature (`aiowps disallow unauthorized rest requests`) and debug logging (`aiowps enable debug`) are both enabled, an unauthenticated attacker can embed arbitrary HTML or JavaScript in the REST request path. The path is retrieved via `urldecode($ SERVER['REQUEST URI'])`, which decodes payloads into literal HTML characters. This unsanitized value is stored in the database and subsequently executed in an administrator's browser session when they view the AIOS Dashboard Debug Logs page. This can lead to nonce theft, privileged AJAX/REST actions, and full site compromise. **Recommendations** Update the plugin to a version later than 5.4.7. As a temporary workaround, disable the `aiowps enable debug` debug logging or the `aiowps disallow unauthorized rest requests` feature to prevent the storage and execution of malicious scripts.

The PDF Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.9.3 via the enqueue block assets. This makes it possible for authenticated attackers, with contributor-level access and above, to extract configuration data. License key exposure occurs when the premium add-on is also installed and has saved a key; on Lite-only installations, the exposed data is limited to non-sensitive viewer configuration values such as width, height, toolbar settings, usage tracking, and plan.

The Easy Updates Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'paged' parameter in versions up to, and including, 9.0.20 This is due to insufficient input sanitization and output escaping in the pagination() function. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page granted they can trick an administrator into performing an action such as clicking on a link.

**Name of the Vulnerable Software and Affected Versions** WooCommerce PayPal Payments versions prior to 4.0.2 **Description** Missing authorization checks on the 'ppc-create-order' and 'ppc-get-order' WC-AJAX endpoints allow unauthorized order manipulation and information disclosure. The 'ppc-create-order' endpoint accepts an arbitrary WooCommerce order ID via the `pay-now` context without validating order ownership, enabling attackers to create PayPal orders for any WooCommerce order and write PayPal metadata to it. Additionally, the 'ppc-get-order' endpoint returns full PayPal order details for any PayPal order ID without binding to the requester's session. Unauthenticated attackers can chain these endpoints to manipulate payment flows of other customers and exfiltrate sensitive data, including payer information and shipping data. **Recommendations** Update to a version later than 4.0.1. As a temporary workaround, restrict access to the 'ppc-create-order' and 'ppc-get-order' endpoints to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Creative Mail – Easier WordPress & WooCommerce Email Marketing versions prior to 1.7.0 **Description** An unauthenticated attacker can perform a blind SQL injection, which is a technique used to extract data from a database by asking the server true or false questions. The issue occurs due to insufficient escaping of the user-supplied `checkout uuid` parameter and a lack of proper preparation of the SQL query within the `has checkout consent()` function. This allows the attacker to append additional SQL queries to extract sensitive information, such as administrator hashes and secret tokens. Full exploitation requires WooCommerce to be installed. Over 300,000 users are potentially affected. **Recommendations** Update the plugin to a version newer than 1.6.9. As a temporary workaround, disable the plugin if WooCommerce is also installed.

The MapGeo – Interactive Geo Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'map' parameter in the display-map shortcode in all versions up to, and including, 1.6.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

**Name of the Vulnerable Software and Affected Versions** Hostinger Reach – AI-Powered Email Marketing for WordPress versions prior to 1.3.9 **Description** The Hostinger Reach – AI-Powered Email Marketing for WordPress plugin allows unauthorized modification of data because the `handle ajax action()` function lacks a capability check. Authenticated users with Subscriber-level access or higher can utilize the 'hostinger reach connection notice action' action to update the API key stored in the database. This issue is exploitable only if the plugin is not connected to a site and no API key currently exists in the database. **Recommendations** Update to a version later than 1.3.8.