Muhammad Yudha

**Name of the Vulnerable Software and Affected Versions** CM Business Directory versions prior to 1.5.8 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs when arbitrary web scripts are injected into pages via business address meta fields, which then execute when a user accesses the affected page. Because the payload is stored in post meta instead of post content, the WordPress `unfiltered html` capability restriction is bypassed. The affected variables include `cmbd address`, `cmbd cityTown`, `cmbd stateCounty`, `cmbd postalcode`, `cmbd region`, and `cmbd country`. **Recommendations** Update to a version newer than 1.5.7. Restrict the use of the `cmbd address`, `cmbd cityTown`, `cmbd stateCounty`, `cmbd postalcode`, `cmbd region`, and `cmbd country` fields to trusted users only.

**Name of the Vulnerable Software and Affected Versions** WP Photo Album Plus versions prior to 9.1.13.006 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. An attacker can inject arbitrary web scripts into pages by embedding a malicious `[photo]` shortcode in a post submitted for review. These scripts execute when an administrator or any other user views the affected page. The issue is triggered via the `subtext` parameter. **Recommendations** Update WP Photo Album Plus to version 9.1.13.006 or later.

**Name of the Vulnerable Software and Affected Versions** Event Organiser versions prior to 3.13.0 **Description** The Event Organiser plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the `eo events` shortcode accepts attacker-controlled `no events` content and renders it in event list templates without proper output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page. **Recommendations** Update the plugin to a version later than 3.12.9.

**Name of the Vulnerable Software and Affected Versions** FV Flowplayer Video Player versions prior to 7.5.51.722 **Description** Stored Cross-Site Scripting (XSS) occurs due to insufficient input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the `align` attribute of the `video player` shortcode. These scripts execute whenever a user visits the affected page. **Recommendations** Update to a version newer than 7.5.51.7212. As a temporary mitigation, restrict the ability of users with contributor-level access to edit pages or use the `video player` shortcode.

Author Cross Site Scripting (XSS) in Featured Image <= 2.1 versions.

**Name of the Vulnerable Software and Affected Versions** Canvas plugin for WordPress versions prior to 2.5.3 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts via the `tag` parameter. These scripts execute whenever a user accesses the affected page. **Recommendations** Update the plugin to a version later than 2.5.2. As a temporary workaround, restrict access to the `tag` parameter for users with contributor-level permissions.

**Name of the Vulnerable Software and Affected Versions** Simple Divi Shortcode versions prior to 1.3 **Description** The Simple Divi Shortcode plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the `showmodule shortcode()` function fails to properly sanitize input and escape output when handling the `id` parameter of the `[showmodule]` shortcode. The `id` attribute is concatenated directly into a dynamically constructed shortcode string without using `esc attr()` or other escaping methods, allowing an attacker to break the attribute context and inject arbitrary HTML. Authenticated attackers with contributor-level access or higher can inject malicious web scripts into pages, which then execute when a user visits the affected page. **Recommendations** Update to a version later than 1.2. As a temporary workaround, restrict the use of the `id` parameter within the `[showmodule]` shortcode or limit user permissions to prevent contributors from editing pages with this shortcode.

The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headline' parameter in the [shariff] shortcode in all versions up to, and including, 4.6.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability occurs because the plugin uses a custom wp kses implementation with permissive allowed HTML tags, and then performs a str replace operation that injects HTML after sanitization, allowing event handlers to be introduced through the %total placeholder in the style attribute.

The Formidable Kinetic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'kinetic link' shortcode in versions up to, and including, 1.1.01. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes (notably 'window', 'class', and 'label') in the FrmKinetic::link() function, which are concatenated directly into HTML attributes of an anchor tag. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

**Name of the Vulnerable Software and Affected Versions** Query Shortcode versions prior to 0.2.2 **Description** The Query Shortcode plugin for WordPress contains a Local File Inclusion issue within the shortcode function. Authenticated attackers with contributor-level access or higher can exploit this by using the `lens` shortcode attribute to include and execute arbitrary .php files on the server. This allows for the execution of PHP code, which can be used to bypass access controls or obtain sensitive data, particularly when .php files can be uploaded to the server. **Recommendations** Update the plugin to a version later than 0.2.1.

The Livemesh Addons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `labb admin ajax` AJAX action in all versions up to, and including, 3.9.2 due to missing authorization checks and insufficient input sanitization. The AJAX handler verifies a nonce but does not check user capabilities. This makes it possible for authenticated attackers with Subscriber-level access and above to modify plugin settings and inject malicious scripts that execute when administrators access the plugin settings page or when any user visits the frontend.

The Team Master – A Modern WordPress Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[lvca carousel]` and `[lvca posts carousel]` shortcode attributes in all versions up to, and including, 3.9.4 due to insufficient input sanitization and output escaping. Specifically, shortcode attributes are encoded with `wp json encode()` and output into single-quoted `data-settings` HTML attributes without using `esc attr()`, allowing attackers to break out of the attribute by injecting single quotes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Instant-Quote.co Quotation Page plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor-level user can trigger execution against higher-privileged users by embedding the malicious shortcode in a post submitted for review, causing the injected scripts to execute when an administrator previews or views the post.

The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `lvca admin ajax` AJAX action in all versions up to, and including, 3.9.4 due to missing authorization checks and insufficient input sanitization. The AJAX handler verifies a nonce but does not check user capabilities. This makes it possible for authenticated attackers with Subscriber-level access and above to modify plugin settings and inject malicious scripts that execute when administrators access the plugin settings page or when any user visits the frontend.

The Livemesh SiteOrigin Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `lsow admin ajax` AJAX action in all versions up to, and including, 3.9.2 due to missing authorization checks and insufficient input sanitization. The AJAX handler verifies a nonce but does not check user capabilities. This makes it possible for authenticated attackers with Subscriber-level access and above to modify plugin settings and inject malicious scripts that execute when administrators access the plugin settings page or when any user visits the frontend.

The iWR Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `iwrtooltip` shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes in the iwr tooltip() shortcode handler — the `title` attribute is concatenated directly into an HTML attribute without esc attr() or any other escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

**Name of the Vulnerable Software and Affected Versions** Geo Mashup versions prior to 1.13.18 **Description** Improper neutralization of input during web page generation allows for stored Cross-site Scripting (XSS), a condition where malicious scripts are permanently stored on the target server and then served to other users. **Recommendations** Update to a version newer than 1.13.18.

**Name of the Vulnerable Software and Affected Versions** CC Child Pages versions prior to 2.1.2 **Description** The CC Child Pages plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts through the `more` parameter. These scripts execute whenever a user visits the affected page. **Recommendations** Update the plugin to version 2.1.2 or later. As a temporary workaround, restrict access to the `more` parameter for users with Contributor-level permissions.

**Name of the Vulnerable Software and Affected Versions** Meta Field Block versions prior to 1.5.3 **Description** The Meta Field Block plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the `tagName` block attribute. These scripts execute whenever a user visits the affected page. **Recommendations** Update to a version later than 1.5.2. As a temporary workaround, restrict access to the `tagName` block attribute for users with contributor-level permissions.