Haitam Lazaar

The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file.

**Name of the Vulnerable Software and Affected Versions** Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content versions prior to 4.16.17 **Description** An Insecure Direct Object Reference occurs because the software fails to verify if the authenticated user performing a subscription action is the actual owner of the targeted subscription. This allows any user with Subscriber level permissions or higher to cancel active subscriptions belonging to other users. **Recommendations** Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to version 4.16.17 or later.

**Name of the Vulnerable Software and Affected Versions** AI Share & Summarize versions prior to 2.0.4 **Description** Users with the Contributor role and above can perform Stored Cross-Site Scripting (XSS) attacks. This occurs because the plugin fails to sanitize and escape certain shortcode attributes, specifically the `title style` attribute, before they are output on a page. Stored XSS is a type of vulnerability where a malicious script is permanently stored on the target server and executed in the browser of users who visit the affected page. **Recommendations** Update AI Share & Summarize to version 2.0.4 or later. As a temporary mitigation, restrict the use of the `title style` shortcode attribute for users with the Contributor role.

**Name of the Vulnerable Software and Affected Versions** Pie Register versions prior to 3.8.4.10 **Description** The plugin fails to use sufficiently random values when generating account verification tokens. This allows unauthenticated attackers to predict a valid token and activate an account without having access to the associated email inbox. **Recommendations** Update to version 3.8.4.10 or later.