Mikemyers

**Name of the Vulnerable Software and Affected Versions** Gravity Forms versions prior to 2.9.28.1 **Description** The Gravity Forms plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is caused by a combination of issues: missing authorization on the `create from template` API endpoint, which allows any authenticated user to create forms; inadequate input sanitization using `sanitize text field()`, which allows single quotes; and a lack of output escaping when the form title is displayed in the Form Switcher dropdown, where the `title` attribute is constructed without `esc attr()`, and the JavaScript `saferHtml` utility does not escape quotes. This allows authenticated attackers with Subscriber-level access or higher to inject arbitrary JavaScript that will execute when an Administrator searches within the Form Switcher dropdown in the Form Editor. **Recommendations** Update Gravity Forms to version 2.9.28.1 or later.

Name of the Vulnerable Software and Affected Versions: The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress versions up to, and including, 5.4.01 Description: The issue allows unauthenticated attackers to read the contents of specific file types on the server, which can contain sensitive information, via the `showFile` function. This is a result of a Path Traversal vulnerability. Recommendations: For versions up to, and including, 5.4.01, consider disabling the `showFile` function until a patch is available to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin versions up to, and including, 2.10.0 **Description** The issue is related to a time-based SQL Injection vulnerability. It occurs due to insufficient escaping on the `search` parameter and lack of sufficient preparation on the existing SQL query, allowing unauthenticated attackers to append additional SQL queries to extract sensitive information from the database. **Recommendations** For versions up to, and including, 2.10.0, update to a version that includes a fix for this issue to prevent SQL Injection attacks. As a temporary workaround, consider restricting access to the `search` parameter in the affected plugin until a patch is available.

**Name of the Vulnerable Software and Affected Versions** wpForo Forum plugin for WordPress versions prior to 2.4.2 **Description** The issue arises from insufficient input validation in the `update` method of the `Members` class, allowing authenticated attackers with subscriber-level privileges or higher to read arbitrary files on the server. **Recommendations** For versions prior to 2.4.2, update to version 2.4.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** The Buddyboss Platform plugin for WordPress versions up to and including 2.7.70 **Description** The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via the `link title` parameter. This allows authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page. **Recommendations** For versions up to and including 2.7.70, update to a version that includes the necessary input sanitization and output escaping fixes to prevent Stored Cross-Site Scripting attacks. As a temporary workaround, consider restricting access to the `link title` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Enfold theme for WordPress versions prior to 6.0.9 **Description** The issue allows authenticated attackers with Subscriber-level access and above to make web requests to arbitrary locations originating from the web application. This can be used to query and modify information from internal services via the `attachment id` parameter. **Recommendations** For versions prior to 6.0.9, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the `attachment id` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Enfold theme for WordPress versions up to, and including, 6.0.9 **Description** The issue allows unauthorized access to data due to a missing capability check in the avia-export-class.php file. This enables unauthenticated attackers to export all avia settings, potentially including sensitive information such as the `Mailchimp API Key`, `reCAPTCHA Secret Key`, or `Envato private token` if they are set. **Recommendations** For Enfold theme for WordPress versions up to, and including, 6.0.9, update to a version higher than 6.0.9 to resolve the issue. As a temporary workaround, consider restricting access to the avia-export-class.php file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress versions up to, and including, 6.6.3 **Description** The issue is related to time-based SQL Injection via the `active status` parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This allows unauthenticated attackers to append additional SQL queries into already existing queries, which can be used to extract sensitive information from the database. **Recommendations** For versions up to, and including, 6.6.3, consider updating to a version that addresses this issue, as no specific workaround is provided for these versions. As a temporary workaround, consider restricting access to the `active status` parameter in the affected SQL query until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress versions up to, and including, 10.43 **Description** The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts via the `ip` parameter. This makes it possible for attackers to inject scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 10.43, consider disabling the `ip` parameter input until a patch is available to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Uncode Core plugin for WordPress versions up to, and including, 2.9.1.6 **Description** The issue allows authenticated attackers with Subscriber-level access and above to execute arbitrary shortcodes due to the software not properly validating a value before running `do shortcode`. This enables them to perform actions that could compromise the security of the WordPress installation. **Recommendations** For versions up to, and including, 2.9.1.6, update to a version later than 2.9.1.6 to resolve the issue. As a temporary workaround, consider restricting access to authenticated users with Subscriber-level access and above to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Uncode theme for WordPress versions up to, and including, 2.9.1.6 **Description** The issue is related to Stored Cross-Site Scripting, which occurs due to insufficient input sanitization and output escaping. This allows authenticated attackers with Subscriber-level access or higher to inject arbitrary web scripts in pages via the `mle-description` parameter. These scripts will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 2.9.1.6, consider disabling the `mle-description` parameter to prevent exploitation until a patch is available. Restrict access to pages that use this parameter to minimize the risk of script injection. Update to a version that includes the necessary input sanitization and output escaping fixes to fully resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Uncode theme for WordPress versions up to, and including, 2.9.1.6 **Description** The issue is related to insufficient input validation in the `uncode admin get oembed` function, allowing unauthenticated attackers to read arbitrary files on the server. This makes it possible for attackers to access sensitive information without proper authentication. **Recommendations** For versions up to, and including, 2.9.1.6, consider disabling the `uncode admin get oembed` function as a temporary workaround until a patch is available. Restrict access to sensitive files on the server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Uncode theme for WordPress versions up to, and including, 2.9.1.6 **Description** The issue is related to insufficient input validation in the `uncode recordMedia` function, allowing authenticated attackers with Subscriber-level access and above to read arbitrary files on the server. This enables them to access sensitive information. **Recommendations** For versions up to, and including, 2.9.1.6, consider disabling the `uncode recordMedia` function as a temporary workaround until a patch is available. Restrict access to sensitive files on the server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Avada | Website Builder For WordPress & WooCommerce theme for WordPress versions up to, and including, 7.11.13 **Description** The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution. This is due to the software allowing users to execute an action that does not properly validate a value before running `do shortcode`. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. **Recommendations** For versions up to, and including, 7.11.13, update to a version later than 7.11.13 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Avada Builder plugin for WordPress versions up to, and including, 3.11.13 **Description** The Avada Builder plugin for WordPress is vulnerable to arbitrary shortcode execution. This is due to the software allowing users to execute an action that does not properly validate a value before running `do shortcode()`. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. **Recommendations** For versions up to, and including, 3.11.13, update to a version later than 3.11.13 to resolve the issue. As a temporary workaround, consider restricting access to the `do shortcode()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** The CURCY – Multi Currency for WooCommerce versions up to, and including, 2.2.5 **Description** The issue allows unauthenticated attackers to execute arbitrary shortcodes due to the software not properly validating a value before running `do shortcode()`. This is possible through the `get products price()` function. Unauthenticated users can execute arbitrary shortcodes into the popular free currency exchange plugin. **Recommendations** As a temporary workaround, consider disabling the `get products price()` function until a patch is available. Restrict access to the `do shortcode()` function to minimize the risk of exploitation. Avoid using the `get products price()` function in the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MultiVendorX plugin versions up to 4.2.14 **Description** The issue allows unauthenticated attackers to include PHP files on the server via the `tabname` parameter, enabling the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. **Recommendations** For MultiVendorX plugin versions up to 4.2.14, update the plugin to a version later than 4.2.14 to resolve the issue. As a temporary workaround, consider restricting access to the `tabname` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WooCommerce Product Table Lite plugin for WordPress versions up to, and including, 3.9.4 **Description** The issue allows unauthenticated attackers to execute arbitrary shortcodes due to the software not properly validating a value before running `do shortcode()`. The same `sc attrs` parameter is also vulnerable to Reflected Cross-Site Scripting. This makes it possible for attackers to execute arbitrary shortcodes. **Recommendations** For versions up to, and including, 3.9.4, update to a version later than 3.9.4 to resolve the issue. As a temporary workaround, consider restricting access to the `sc attrs` parameter to minimize the risk of exploitation. Avoid using the `sc attrs` parameter in affected shortcodes until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** The Contact Form & SMTP Plugin for WordPress by PirateForms versions up to, and including, 2.6.0 **Description** The issue arises from the software allowing users to execute an action that does not properly validate a value before running `do shortcode`. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The problem is due to insufficient validation of a value, which enables the execution of arbitrary shortcodes by attackers without authentication. **Recommendations** For versions up to, and including, 2.6.0, update to a version higher than 2.6.0 to resolve the issue. As a temporary workaround, consider restricting access to the `do shortcode` function until a patch is available. Avoid using the plugin until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** AI Power: Complete AI Pack plugin for WordPress versions up to, and including, 1.8.96 **Description** The issue is related to a missing capability check on the `wpaicg save image media` function. This allows authenticated attackers with Subscriber-level access and above to upload image files and embed shortcode attributes in the `image alt` value. The embedded attributes will execute when sending a POST request to the attachment page. **Recommendations** For versions up to, and including, 1.8.96, update to a version higher than 1.8.96 to resolve the issue. As a temporary workaround, consider disabling the `wpaicg save image media` function until a patch is available. Restrict access to the attachment page to minimize the risk of exploitation. Avoid using the `image alt` value in the affected API endpoint until the issue is resolved.