Jonas Benjamin Friedli

**Name of the Vulnerable Software and Affected Versions** CM Registration – Tailored tool for seamless login and invitation-based registrations plugin for WordPress versions through 2.5.6 **Description** The software is susceptible to an Open Redirect issue because of inadequate validation of the redirect URL provided through the `redirect url` parameter. This allows unauthenticated attackers to redirect users to potentially harmful websites if they can trick users into taking an action. **Recommendations** Update the CM Registration – Tailored tool for seamless login and invitation-based registrations plugin for WordPress to a version later than 2.5.6.

**Name of the Vulnerable Software and Affected Versions** Code Quality Control Tool versions 0.1 through 0.1 **Description** The Code Quality Control Tool plugin for WordPress has a flaw that allows viewing of potentially sensitive information through publicly exposed log files. This impacts unauthenticated attackers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Integrate Dynamics 365 CRM plugin for WordPress versions through 1.0.9 **Description** The Integrate Dynamics 365 CRM plugin for WordPress is susceptible to unauthorized access due to missing capability checks and nonce verification on functions hooked to 'init'. This allows unauthenticated attackers to deactivate the plugin, modify OAuth configuration, and initiate test connections that reveal sensitive data through direct requests to vulnerable API endpoints by crafting malicious requests with specific parameters. **Recommendations** Update Integrate Dynamics 365 CRM plugin for WordPress to a version later than 1.0.9.

**Name of the Vulnerable Software and Affected Versions** OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress versions up to and including 6.26.12 **Description** The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is susceptible to improper verification of cryptographic signatures. This occurs due to unsafe JWT token processing without verification or validation within the `get resource owner from id token` function. This allows unauthenticated attackers to bypass authentication, potentially gaining access to existing user accounts, including administrator accounts in certain configurations, or creating arbitrary subscriber-level accounts. **Recommendations** Update the OAuth Single Sign On – SSO (OAuth Client) plugin to version 6.26.13 or later.

The Backup Bolt plugin for WordPress is vulnerable to arbitrary file downloads and backup location writes in all versions up to, and including, 1.4.1 via the process backup batch() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to download directories outside of the webroot and write backup zip files to arbitrary locations.

**Name of the Vulnerable Software and Affected Versions** TableGen – Data Table Generator plugin for WordPress versions prior to 1.3.2 **Description** The software is susceptible to Stored Cross-Site Scripting through admin settings. Insufficient input sanitization and output escaping allow authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages. These scripts execute when a user accesses the injected page. This issue specifically impacts multi-site installations and those where unfiltered html has been disabled. **Recommendations** Update to a version later than 1.3.1.

**Name of the Vulnerable Software and Affected Versions** ContentMX Content Publisher plugin for WordPress versions up to and including 1.0.6 **Description** The software is susceptible to a Cross-Site Request Forgery (CSRF) issue. This is caused by a lack of, or incorrect, nonce validation in the `cmx activate connection` function. An unauthenticated attacker can potentially bind their own ContentMX connection through a forged request if they can trick a site administrator into performing an action, such as clicking a link. **Recommendations** Update the ContentMX Content Publisher plugin to a version later than 1.0.6.

**Name of the Vulnerable Software and Affected Versions** MPWizard – Create Mercado Pago Payment Links plugin for WordPress versions prior to 1.2.2 **Description** The software is susceptible to Cross-Site Request Forgery, allowing unauthenticated attackers to delete arbitrary posts. This is possible due to missing or incorrect nonce validation in the `/includes/admin/class-mpwizard-table.php` file. An attacker can exploit this by tricking a site administrator into performing an action, such as clicking a malicious link, to execute a forged request. **Recommendations** Update the MPWizard – Create Mercado Pago Payment Links plugin for WordPress to version 1.2.2 or later.

The Interactive Human Anatomy with Clickable Body Parts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered html has been disabled.

The Smart Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered html has been disabled.

**Name of the Vulnerable Software and Affected Versions** Post By Email versions through 1.0.4b **Description** The Post By Email plugin for WordPress is susceptible to arbitrary file uploads because of a lack of file type validation within the `save attachments` function. This allows unauthenticated attackers to upload arbitrary files to the affected server, potentially leading to remote code execution. The `save attachments` function is the point of entry for this issue. **Recommendations** Versions prior to 1.0.4b should be updated to a newer version that addresses this issue.

**Name of the Vulnerable Software and Affected Versions** The Hack Repair Guy's Plugin Archiver plugin for WordPress versions up to and including 2.0.4 **Description** The Plugin Archiver plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `bulk remove()` function. This allows unauthenticated attackers to perform arbitrary directory deletion in `/wp-content` via a forged request if they can trick a site administrator into performing an action, such as clicking a link. **Recommendations** Update The Hack Repair Guy's Plugin Archiver plugin to a version later than 2.0.4. As a temporary workaround, restrict access to the `bulk remove()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** User Sync – Remote User Sync plugin for WordPress versions prior to 1.0.3 **Description** The User Sync – Remote User Sync plugin for WordPress is susceptible to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation in the `mo user sync form handler()` function, potentially allowing unauthenticated attackers to deactivate the plugin by tricking a site administrator into performing an action. **Recommendations** Update the User Sync – Remote User Sync plugin to version 1.0.3 or later.

**Name of the Vulnerable Software and Affected Versions** Developer Loggers for Simple History plugin for WordPress versions prior to 0.6 **Description** The Developer Loggers for Simple History plugin for WordPress is susceptible to a Local File Inclusion issue via the `enabled loggers` parameter. This allows authenticated attackers with Administrator-level access or higher to include and execute arbitrary `.php` files on the server. Successful exploitation can lead to bypassing access controls, obtaining sensitive data, or achieving code execution if `.php` file uploads are permitted. **Recommendations** Update the Developer Loggers for Simple History plugin to version 0.6 or later.

Name of the Vulnerable Software and Affected Versions: LWS Cleaner plugin for WordPress versions up to and including 2.4.1.3 Description: The LWS Cleaner plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation within the `lws cl delete file` function. This allows authenticated attackers with Administrator-level access or higher to delete arbitrary files on the server. Deletion of specific files, such as `wp-config.php`, could lead to remote code execution. Recommendations: Update the LWS Cleaner plugin to a version newer than 2.4.1.3.

Name of the Vulnerable Software and Affected Versions: The Hack Repair Guy's Plugin Archiver plugin for WordPress versions up to and including 2.0.4 Description: The Plugin Archiver plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation within the `prepare items` function. This allows authenticated attackers with Administrator-level access or higher to delete arbitrary files on the server. Deletion of specific files, such as `wp-config.php`, could lead to remote code execution. Recommendations: Update The Hack Repair Guy's Plugin Archiver plugin to a version later than 2.0.4.

Name of the Vulnerable Software and Affected Versions: Spotify Embed Creator plugin for WordPress versions up to and including 1.0.5 Description: The Spotify Embed Creator plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s `spotify` shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. Recommendations: Update the Spotify Embed Creator plugin to a version newer than 1.0.5.

Name of the Vulnerable Software and Affected Versions: Time Tracker plugin for WordPress versions through 3.1.0 Description: The Time Tracker plugin for WordPress is susceptible to unauthorized modification and data loss. A missing capability check within the `tt update table function` and `tt delete record function` functions allows authenticated attackers with Subscriber-level access or higher to update options, including user registration and default role settings. This could enable unauthorized users to register as Administrators and delete limited data from the database. Recommendations: Update the Time Tracker plugin to a version beyond 3.1.0.

The Coupon API plugin for WordPress is vulnerable to SQL Injection via the ‘log duration’ parameter in all versions up to, and including, 6.2.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Name of the Vulnerable Software and Affected Versions: Responsive Filterable Portfolio plugin for WordPress versions through 1.0.24 Description: The plugin is susceptible to arbitrary file uploads due to missing file type validation via the `HdnMediaSelection image` field. This allows authenticated attackers with Administrator-level access or higher to upload arbitrary files to the affected server, potentially leading to remote code execution. Recommendations: Update the Responsive Filterable Portfolio plugin to a version beyond 1.0.24.