Marc Montpas

**Name of the Vulnerable Software and Affected Versions** Gravity Forms WordPress plugin versions prior to 2.9.23.1 **Description** The Gravity Forms WordPress plugin does not properly prevent users from uploading dangerous files through its chunked upload functionality. This allows attackers to upload PHP files to affected sites and achieve Remote Code Execution, provided they can discover or enumerate the upload path. **Recommendations** Update Gravity Forms WordPress plugin to version 2.9.23.1 or later.

**Name of the Vulnerable Software and Affected Versions** FunnelKit WordPress plugin versions prior to 3.12.0.1 **Description** The software does not properly sanitize user-provided data before displaying it in certain checkout-related AJAX operations. This can allow attackers to execute reflected cross-site scripting (XSS) attacks against users who are logged in. The issue involves echoing user input without sufficient validation, potentially leading to the injection of malicious scripts. **Recommendations** Update to version 3.12.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** FancyBox for WordPress versions prior to 3.3.6 **Description** The issue is related to the FancyBox plugin for WordPress not escaping captions and titles attributes before using them to populate galleries' caption fields. This was initially detected as a stored XSS vulnerability that required authentication, but it was escalated to an unauthenticated stored XSS issue. **Recommendations** For versions prior to 3.3.6, update to version 3.3.6 or later to resolve the issue. As a temporary workaround, consider disabling the use of captions and titles attributes in galleries until a patch is available. Restrict access to the plugin's functionality to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Jetpack WordPress plugin versions prior to 13.8 Jetpack Boost WordPress plugin versions prior to 3.4.8 Description: The issue concerns the use of regexes in the Site Accelerator features of the Jetpack and Jetpack Boost WordPress plugins when switching image URLs to their CDN counterpart. Some of these regexes may match patterns they shouldn’t, making it possible for contributor and above users to perform Stored XSS attacks. Recommendations: For Jetpack WordPress plugin versions prior to 13.8, update to version 13.8 or later. For Jetpack Boost WordPress plugin versions prior to 3.4.8, update to version 3.4.8 or later.

Name of the Vulnerable Software and Affected Versions: Jetpack WordPress plugin versions prior to 13.8 Description: The issue concerns the Jetpack WordPress plugin, where posts created by the Contact Form are not properly restricted to authorized users. This could allow unauthenticated users to execute arbitrary shortcodes and block them. Recommendations: For versions prior to 13.8, update to version 13.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the Contact Form and its created posts to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Jetpack WordPress plugin (affected versions not specified) **Description** The issue concerns a flaw in one of the Jetpack WordPress plugin's REST endpoints, specifically lacking proper authorization. This flaw allows any authenticated user, such as a subscriber, to read arbitrary feedback data sent via the Jetpack Contact Form. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SEOPress versions prior to 7.9 **Description** The issue is related to insufficient protection of some REST API routes in the SEOPress WordPress plugin, which can be combined with an Object Injection vulnerability to allow unauthenticated attackers to unserialize malicious gadget chains. This can compromise the site if a suitable chain is present. The vulnerability is also related to flaws in the deserialization mechanism, which can allow a remote attacker to execute arbitrary commands in the web console. **Recommendations** For versions prior to 7.9, update to version 7.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the REST API routes until a patch is available. Avoid using the vulnerable Object Injection functionality in the SEOPress plugin until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** The Events Calendar WordPress plugin versions prior to 6.4.0.1 **Description** The issue arises from the improper sanitization of user-submitted content when rendering certain views via AJAX. This can lead to potential security risks. **Recommendations** For versions prior to 6.4.0.1, update to version 6.4.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to AJAX-rendered views until the update is applied.

**Name of the Vulnerable Software and Affected Versions** WP JobSearch versions prior to 2.3.4 **Description** The issue allows attackers to log in as any user with only the knowledge of that user's email address. **Recommendations** For versions prior to 2.3.4, update to version 2.3.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** The Page Builder: Pagelayer WordPress plugin versions prior to 1.8.0 **Description** The issue allows attackers with administrator privileges to insert malicious JavaScript inside a post's header or footer code, even when unfiltered html is disallowed, such as in multi-site WordPress configurations. **Recommendations** For versions prior to 1.8.0, update to version 1.8.0 or later to resolve the issue. As a temporary workaround, consider restricting administrator privileges or monitoring post header and footer code for malicious JavaScript until the update is applied.

**Name of the Vulnerable Software and Affected Versions** WooCommerce Currency Switcher FOX WordPress plugin versions prior to 1.3.7 **Description** The issue concerns a Local File Inclusion (LFI) vulnerability. LFI is a type of attack where an attacker can trick the application into exposing or running files on the server that they shouldn't have access to. This vulnerability can be exploited via the `woocs` shortcode. **Recommendations** For versions prior to 1.3.7, update to version 1.3.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `woocs` shortcode until the update is applied.

**Name of the Vulnerable Software and Affected Versions** WP Fastest Cache versions prior to 0.9.5 **Description** The issue is related to the `set urls with terms` method, which does not properly escape user input before using it in a SQL statement. This leads to an SQL injection that can be exploited by low-privilege users, such as subscribers. **Recommendations** For versions prior to 0.9.5, update to version 0.9.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the `set urls with terms` method until a patch is available.

**Name of the Vulnerable Software and Affected Versions** WP Fastest Cache versions prior to 0.9.5 **Description** The issue is related to a lack of CSRF check in the `wpfc save cdn integration` AJAX action and insufficient sanitization and escaping of some options available via this action. This could allow attackers to make logged-in high-privilege users call the action and set a Cross-Site Scripting payload. **Recommendations** For versions prior to 0.9.5, update to version 0.9.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the `wpfc save cdn integration` AJAX action until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** WP Go Maps versions prior to 9.0.28 **Description** The issue concerns the WP Go Maps WordPress plugin, where most of its REST API routes are not properly protected. This allows attackers to store malicious HTML/Javascript on the site. **Recommendations** For versions prior to 9.0.28, update to version 9.0.28 or later to resolve the issue. As a temporary workaround, consider restricting access to the REST API routes until the update is applied.

**Name of the Vulnerable Software and Affected Versions** The Essential Real Estate WordPress plugin versions prior to 4.4.0 **Description** The issue allows users with limited privileges, such as subscribers, to upload malicious PHP files disguised as ZIP archives, potentially leading to remote code execution. **Recommendations** For versions prior to 4.4.0, update to version 4.4.0 or later to resolve the issue. As a temporary workaround, consider restricting file upload capabilities for users with limited privileges until the update can be applied.

**Name of the Vulnerable Software and Affected Versions** The Essential Blocks WordPress plugin versions prior to 4.4.3 **Description** The issue allows unauthenticated attackers to overwrite local variables when rendering templates over the REST API, potentially leading to Local File Inclusion attacks. Approximately 20,704 devices are affected, mainly in the United States and Germany. **Recommendations** For versions prior to 4.4.3, update to version 4.4.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the REST API until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Popup Builder WordPress plugin versions prior to 4.2.3 **Description** The issue allows simple visitors to update existing popups and inject raw JavaScript, leading to Stored XSS attacks. This could enable attackers to conduct cross-site scripting attacks. Hackers have exploited this flaw to infect over 3,300 sites with malware. The estimated number of potentially affected devices worldwide is not explicitly stated, but the malware campaign has mainly targeted sites in the United States and Germany. In real-world incidents, this issue was exploited to inject malicious code into vulnerable websites' "Custom JS or CSS" sections, redirecting users to phishing sites or injecting further malware. **Recommendations** For versions prior to 4.2.3, update to version 4.2.3 or later to resolve the issue. As a temporary workaround, consider disabling the ability for simple visitors to update existing popups until a patch is available. Restrict access to the "Custom JS or CSS" sections to minimize the risk of exploitation. Avoid using the plugin until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** The Page Builder: Pagelayer WordPress plugin versions prior to 1.7.8 **Description** The issue allows attackers with author privileges and higher to insert malicious JavaScript inside a post's header or footer code. This can be exploited by inserting malicious code in the post's header or footer, potentially leading to security breaches. **Recommendations** For versions prior to 1.7.8, update to version 1.7.8 or later to resolve the issue. As a temporary workaround, consider restricting the ability of authors and higher-privileged users to insert custom JavaScript code in post headers and footers until the update is applied.

**Name of the Vulnerable Software and Affected Versions** The Page Builder: Pagelayer WordPress plugin versions prior to 1.7.7 **Description** The issue allows unauthenticated attackers to update a post's header or footer code on scheduled posts. **Recommendations** For versions prior to 1.7.7, update to version 1.7.7 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to the fixed version Popup Builder WordPress plugin versions through 4.1.15 **Description** The issue is related to insufficient protection of internal data in the WordPress content management system, allowing remote attackers to gain unauthorized access to protected information. Specifically, WordPress does not properly restrict which user fields are searchable via the REST API, enabling unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack. The Popup Builder WordPress plugin through version 4.1.15 does not sanitize and escape some of its settings, which could allow high-privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. **Recommendations** For WordPress, update to a version that contains a fix for this issue. For the Popup Builder WordPress plugin, update to a version later than 4.1.15. As a temporary workaround, consider restricting access to the REST API and sanitizing user input to minimize the risk of exploitation. Restrict access to the vulnerable `Popup Builder` plugin to minimize the risk of Stored Cross-Site Scripting attacks until the issue is resolved.