Maurice Fielenbach

The EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Name of the Vulnerable Software and Affected Versions Attendance Manager plugin for WordPress versions up to and including 0.6.2 Description The Attendance Manager plugin for WordPress is susceptible to SQL Injection through the `attmgr off` parameter. This is a result of inadequate input sanitization and insufficient query preparation, potentially allowing authenticated attackers with Subscriber-level access or higher to inject additional SQL queries and extract sensitive database information. Recommendations Update the Attendance Manager plugin to a version newer than 0.6.2.

**Name of the Vulnerable Software and Affected Versions** File Thingie version 2.5.7 **Description** The software contains an authenticated file upload issue that enables remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a custom PHP payload, upload and unzip it, and then execute arbitrary system commands through a crafted PHP script with a command parameter. The vulnerability requires minimal authentication before delivering full system command execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WP Inventory Manager versions prior to 2.1.0.12 **Description** The issue concerns a Reflected Cross-Site Scripting problem. It arises because the `message` parameter is not properly sanitised and escaped before being outputted back in the page. This could be exploited against high-privilege users, such as administrators. **Recommendations** For versions prior to 2.1.0.12, update to version 2.1.0.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality to minimize the risk of exploitation. Avoid using the `message` parameter in affected areas until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** The Product Catalog Feed by PixelYourSite WordPress plugin versions prior to 2.1.1 **Description** The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the `edit` parameter is not properly sanitized and escaped before being outputted back in an attribute. This could be exploited against high-privilege users, such as administrators. **Recommendations** For versions prior to 2.1.1, update to version 2.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the `edit` parameter to minimize the risk of exploitation.