Lhking

The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax chunk upload finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

**Name of the Vulnerable Software and Affected Versions** SAML Single Sign On – SSO Login plugin for WordPress versions prior to 5.4.4 **Description** An authentication bypass exists due to SAML Signature Algorithm Confusion. The `Mo SAML Utilities::mo saml cast key()` function reads the `SignatureMethod` attribute directly from the attacker-controlled `SAMLResponse` parameter instead of enforcing the locally configured algorithm. This allows the plugin to recast the Identity Provider's RSA public key as an HMAC-SHA1 shared secret and validate a forged signature against it. Consequently, unauthenticated attackers can forge a SAML assertion for any account, including administrators, to obtain valid authentication cookies and achieve full account takeover. **Recommendations** Update the plugin to version 5.4.4 or later.

**Name of the Vulnerable Software and Affected Versions** TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress versions prior to 3.6.14 **Description** Insufficient file path validation in the `delete converted image size()` function allows authenticated attackers with author-level access or higher to delete arbitrary files on the server. This can be achieved by injecting a server file path into the `convert.path` field of the `tiny compress images` post meta on an attachment owned by the attacker and then triggering the attachment deletion. Deleting critical files, such as `wp-config.php`, can lead to remote code execution. **Recommendations** Update the plugin to version 3.6.14 or later.

**Name of the Vulnerable Software and Affected Versions** Page Builder by SiteOrigin versions prior to 2.34.4 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. This happens because the `panels data` parameter is stored as post meta, bypassing the `wp kses` fallback—a WordPress function used to filter HTML—which allows unsanitized `WP Widget Custom HTML` content to be rendered on the frontend when a user accesses the affected page. **Recommendations** Update Page Builder by SiteOrigin to version 2.34.4 or later. As a temporary mitigation, restrict the `panels data` parameter or limit user permissions to prevent Contributor-level users from editing pages.