H0Xilo

**Name of the Vulnerable Software and Affected Versions** Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions versions prior to 3.8.2 **Description** Insufficient input sanitization and output escaping in the `[pmpro member profile edit]` shortcode allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via a readonly user field, enabling the injection of arbitrary web scripts that execute when a user visits the affected page. **Recommendations** Update Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions to version 3.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** Chaty Pro versions prior to 3.5.6 **Description** Authenticated users with subscriber-level access and above can perform a Time-Based Blind SQL Injection. This occurs because the `fetch custom field()` function in admin/class-admin-base.php retrieves the `widget id` POST parameter and concatenates it directly into a raw SQL query without using `$wpdb->prepare()` or integer casting. Furthermore, the nonce verification check is executed after the SQL query, failing to prevent the injection. This flaw allows attackers to execute arbitrary SQL commands to extract sensitive database information, such as configuration data and user credentials. **Recommendations** Update Chaty Pro to a version newer than 3.5.5. As a temporary mitigation, restrict access to the administrative functions that utilize the `fetch custom field()` function.

**Name of the Vulnerable Software and Affected Versions** Breakdance versions prior to 2.7.2 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts through the `fields` parameter, which execute when a user accesses the affected page. **Recommendations** Update Breakdance to version 2.7.2 or later. Avoid using the `fields` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Digits: WordPress Mobile Number Signup and Login versions prior to 9.1.0.6 **Description** Privilege escalation is possible for authenticated users with Subscriber-level access and above. The issue stems from missing authorization and role validation within the `dig update wpwc custom fields()` function. An attacker can elevate their privileges to Administrator by submitting a forged `digits reg userrole` value during a profile update, provided the site administrator has enabled the built-in DIGITS User Role field. **Recommendations** Update to a version newer than 9.1.0.5. As a temporary mitigation, disable the built-in DIGITS User Role field configuration.

**Name of the Vulnerable Software and Affected Versions** WP Grid Builder versions prior to 2.3.4 **Description** An issue exists where missing authorization and meta key validation in the `update()` handler for the '/wp-json/wpgb/v2/metadata' REST endpoint allows authenticated users with Subscriber-level access or higher to elevate their privileges to Administrator. This is achieved by updating the `wp capabilities` user meta using a crafted nested array payload. **Recommendations** Update WP Grid Builder to version 2.3.4 or later. Restrict access to the '/wp-json/wpgb/v2/metadata' REST endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WP Review Slider Pro versions prior to 12.7.3 **Description** An unauthenticated attacker can extract arbitrary data from the database using blind or time-based SQL injection. The issue occurs within the `wprp load more revs` AJAX action, where the `notinstring` parameter is processed. The application uses `sanitize text field()` on the input, which removes HTML and whitespace but fails to ensure SQL safety. This value is then concatenated directly into an unquoted `AND id NOT IN (...)` clause and executed via `$wpdb->get results()` without using `$wpdb->prepare()` or `intval()` casting. Because the input is placed in a numeric context, standard quote-escaping protections are ineffective. The required nonce for the `wp ajax nopriv wprp load more revs` hook is publicly accessible on any frontend page rendering the plugin shortcode. **Recommendations** Update to a version newer than 12.7.2. As a temporary mitigation, restrict access to the `wprp load more revs` AJAX action or avoid using the `notinstring` parameter.

**Name of the Vulnerable Software and Affected Versions** BookingPress Appointment Booking Pro versions prior to 5.7.2 **Description** An issue exists where unauthenticated attackers can execute additional SQL queries to extract sensitive information from the database. This occurs because user-supplied POST data is processed using the `stripslashes deep()` function and then inserted directly into a SQL LIKE clause without using `$wpdb->prepare()` or parameterization. The flaw is located within the `bpa assign staffmember to slots()` function, specifically affecting the `store service date` parameter. **Recommendations** Update BookingPress Appointment Booking Pro to version 5.7.2 or later. As a temporary mitigation, restrict access to the functionality utilizing the `bpa assign staffmember to slots()` function.

**Name of the Vulnerable Software and Affected Versions** ARMember Premium versions prior to 7.3.1 **Description** The ARMember Premium plugin for WordPress contains an insecure password reset mechanism. **Recommendations** Update to version 7.3.1.

**Name of the Vulnerable Software and Affected Versions** ARMember Premium versions prior to 7.3.2 **Description** An issue exists where unauthenticated attackers can append additional SQL queries to existing ones to extract sensitive information from the database. This occurs due to insufficient escaping of the `order` and `orderby` parameters and a lack of sufficient preparation of the SQL query within the `arm get directory members()` function. The flaw is triggered via the 'order' parameter of the 'arm directory paging action' AJAX action endpoint. **Recommendations** Update the plugin to a version later than 7.3.1. As a temporary workaround, restrict access to the 'arm directory paging action' AJAX action or avoid using the `order` and `orderby` parameters until the update is applied.

**Name of the Vulnerable Software and Affected Versions** ARMember Premium versions prior to 7.3.2 **Description** An SQL Injection issue exists in the ARMember Premium plugin for WordPress. The `get private content data` AJAX action fails to properly sanitize the `sSortDir 0` parameter, which is concatenated directly into the ORDER BY clause of an SQL query without a whitelist check. This allows authenticated attackers with Subscriber-level access or higher to append additional SQL queries to extract sensitive information from the database. This issue is only exploitable if the User Private Content addon is enabled. **Recommendations** Update to a version newer than 7.3.1. As a temporary mitigation, disable the User Private Content addon.

**Name of the Vulnerable Software and Affected Versions** Wishlist Member versions prior to 3.30.2 **Description** The Wishlist Member plugin for WordPress allows unauthorized modification of data because of a missing capability check in the `generate api key()` function. Authenticated attackers with Subscriber-level access or higher can update the REST API Secret Key. This allows for the creation of a new membership level assigned the administrator WordPress role and the registration of an arbitrary administrator-level user account, leading to a complete site takeover. **Recommendations** Update to a version newer than 3.30.1. As a temporary workaround, restrict access to the `generate api key()` function to prevent unauthorized users from modifying the API Secret Key.

**Name of the Vulnerable Software and Affected Versions** Wishlist Member versions prior to 3.30.2 **Description** The Wishlist Member plugin for WordPress allows unauthorized modification of data because the `save settings()` function in `WishListMemberFeaturesTeam Accounts` lacks a capability check. Authenticated attackers with Subscriber-level access or higher can update arbitrary plugin options, including the REST API Secret Key. This can be leveraged to create a new membership level with the administrator WordPress role and register an administrator-level user account, leading to a complete site takeover. **Recommendations** Update to a version newer than 3.30.1. As a temporary workaround, restrict access to the `save settings()` function to prevent unauthorized users from modifying plugin settings.

**Name of the Vulnerable Software and Affected Versions** WishList Member versions prior to 3.30.2 **Description** Missing authorization in the `export settings()` function allows for sensitive information disclosure and privilege escalation. The function fails to perform capability checks, enabling an attacker to retrieve the REST API Secret Key via an AJAX JSON response. With this key, an attacker can authenticate to the WishList Member API, create a new membership level with the administrator WordPress role, and register an arbitrary administrator-level user account, leading to a complete site takeover. **Recommendations** Update to a version later than 3.30.1. As a temporary workaround, restrict access to the `export settings()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WishList Member versions prior to 3.30.2 **Description** An issue exists where missing authorization allows for privilege escalation. The `ajax get screen()` function fails to perform necessary capability and nonce checks. Authenticated attackers with Subscriber-level access or higher can provide an arbitrary admin screen identifier through the `data[url]` parameter. This action causes the plugin to load and execute the administrative API configuration template without authorization, returning the plugin's plaintext REST API Secret Key within the AJAX JSON response. An attacker possessing this key can authenticate to the API, create a membership level with the administrator WordPress role, and register an administrator-level user account, leading to a complete site takeover. **Recommendations** Update to a version later than 3.30.1. As a temporary workaround, restrict access to the `ajax get screen()` function to prevent unauthorized users from triggering the administrative API configuration template.

**Name of the Vulnerable Software and Affected Versions** Slider Revolution versions 7.0.0 through 7.0.10 **Description** Insufficient file type validation in the ` get media url()` and ` check file path()` functions allows authenticated attackers with subscriber-level access or higher to perform an Arbitrary File Upload. This flaw enables the upload of executable files, which can lead to remote code execution (the ability to run arbitrary commands on the server). **Recommendations** Update to version 7.0.11.