Nabil Irawan

**Name of the Vulnerable Software and Affected Versions** WP Business Intelligence Lite versions prior to 3.2.1 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with Subscriber-level access or higher can modify stored SQL queries. This can lead to privilege escalation through arbitrary SQL execution when an administrator views the modified query. **Recommendations** Update WP Business Intelligence Lite to a version newer than 3.2.0.

**Name of the Vulnerable Software and Affected Versions** Hide My WP Lite versions prior to 1.4 **Description** An arbitrary file read issue exists when the `elementor assets filter()` function processes the `he wrapper js` and `he wrapper css` query parameters. The function concatenates user-supplied input directly onto ABSPATH and passes it to `file get contents()` without path traversal validation, allow-list, realpath containment, or extension checks. Although the output is processed by `wp kses post()`, which filters HTML tags, it does not prevent the disclosure of arbitrary file contents. This allows unauthenticated attackers to read sensitive files on the server, such as wp-config. This issue requires the Elementor plugin to be installed and the 'Hide Elementor' feature to be enabled. **Recommendations** Update Hide My WP Lite to a version later than 1.3. As a temporary workaround, disable the 'Hide Elementor' feature to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Block, Suspend, Report for BuddyPress versions prior to 3.6.5 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the `link` parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users. **Recommendations** Update to a version newer than 3.6.4. Avoid using the `link` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Widget Logic Visual versions prior to 1.53 **Description** Authenticated attackers with subscriber-level access and above can achieve remote code execution on the server. The issue occurs during the `widget-logic-update-conditional-tags` AJAX action due to a missing capability check and nonce verification in the `widget logic visual check visibility()` function. Additionally, the `nwlv[cod-tag]` parameter is insufficiently sanitized before being stored and later processed by an `eval()` call, which executes the provided code. **Recommendations** Update the plugin to a version newer than 1.52. As a temporary mitigation, restrict access to the `widget-logic-update-conditional-tags` AJAX action or limit user permissions to prevent subscribers from accessing widget settings.

**Name of the Vulnerable Software and Affected Versions** Jssor Slider by jssor.com versions prior to 3.1.25 **Description** The plugin is subject to Directory Traversal, a flaw that allows an attacker to access files and directories that are stored outside the web root folder. Unauthenticated attackers can exploit this by using the `url` parameter to read arbitrary files on the server, potentially exposing sensitive information. **Recommendations** Update the plugin to a version newer than 3.1.24. Avoid using the `url` parameter in the affected plugin until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Backstage - Customizer Demo Access versions prior to 1.4.3 **Description** This issue allows unauthenticated attackers to achieve privilege escalation. The plugin assigns the `manage options` capability to the `backstage customizer user` demo role, which provides permissions exceeding what is required for Customizer-only demo access. Consequently, attackers can navigate beyond the Customizer and modify arbitrary WordPress options, such as the `default role` variable. **Recommendations** Update Backstage - Customizer Demo Access to a version newer than 1.4.2.

**Name of the Vulnerable Software and Affected Versions** WP-BusinessDirectory versions prior to 4.0.2 **Description** Unauthenticated attackers can delete arbitrary files on the server due to insufficient path validation in the `remove()` method of the `JBusinessDirectoryControllerUpload` class. The 'task=upload.remove' endpoint is accessible without authentication. By providing a ` filename` parameter containing path traversal sequences (../) and setting the ` path type` parameter to `2`, an attacker can bypass directory restrictions and trigger the `unlink()` function on critical files, such as `wp-config.php` or `wp-config-backup.php`. **Recommendations** Update WP-BusinessDirectory to version 4.0.2 or later. Restrict access to the 'task=upload.remove' endpoint to prevent unauthenticated requests. Avoid using the ` filename` parameter in the 'task=upload.remove' endpoint until the software is updated.

Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions.

**Name of the Vulnerable Software and Affected Versions** Paytium versions prior to 5.0.3 **Description** An issue allows unauthenticated users to perform privilege escalation. **Recommendations** Update to a version newer than 5.0.2.

**Name of the Vulnerable Software and Affected Versions** Flash & HTML5 Video versions prior to 2.11.1 **Description** An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. **Recommendations** Update to a version newer than 2.11.0.

**Name of the Vulnerable Software and Affected Versions** Welcome Software Publishing versions prior to 0.0.32 **Description** The plugin is subject to an Arbitrary Options Update issue caused by a missing capability check in the `nc setOption()` function, which is exposed through the 'nc.setOption' XML-RPC method. While the function verifies credentials via `$wp xmlrpc server->login()`, it fails to perform authorization checks, such as `current user can('manage options')`. This allows authenticated attackers with Subscriber-level access or higher to update arbitrary WordPress options via XML-RPC requests. An attacker can exploit this to change the `default role` option to 'administrator' and register a new administrator account, leading to full privilege escalation and site takeover. **Recommendations** Update to a version later than 0.0.31. As a temporary workaround, restrict access to the 'nc.setOption' XML-RPC method or disable XML-RPC functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Premmerce Dev Tools versions prior to 2.1 **Description** The Premmerce Dev Tools plugin for WordPress allows authenticated attackers with Subscriber-level access and above to achieve remote code execution. The issue occurs because the `generatePluginHandler()` function does not perform authorization checks before processing user-supplied POST data. Additionally, the `createFromStub()` function performs unsanitized string substitution of the `premmerce plugin namespace` parameter into PHP stub files saved in the wp-content/plugins/ directory. An attacker can inject a semicolon and arbitrary PHP code into the `premmerce plugin namespace` parameter, resulting in the creation and execution of a malicious PHP file when accessed via HTTP. **Recommendations** Update the plugin to a version later than 2.0. As a temporary workaround, restrict access to the `generatePluginHandler()` function to prevent unauthorized users from processing POST data.

The FPW Category Thumbnails plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'fpw fs get file' AJAX action in all versions up to, and including, 1.9.5. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the plugin's settings page.

**Name of the Vulnerable Software and Affected Versions** BirdSeed versions prior to 2.2.1 **Description** The BirdSeed plugin for WordPress is subject to Cross-Site Request Forgery. This occurs because the `birdseed plugin settings page()` function fails to perform nonce validation—a security mechanism used to ensure that a request was intentionally sent by the user. The function processes the `birdseed token` GET parameter and saves it to the database using `update option()` without verification. Consequently, unauthenticated attackers can modify the plugin's BirdSeed token setting by tricking a site administrator into clicking a malicious link. **Recommendations** Update to a version later than 2.2.0. As a temporary workaround, restrict administrative access to the plugin settings page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** bPlugins Tiktok Feed versions prior to 1.0.25 **Description** A missing authorization issue exists due to incorrectly configured access control security levels, which allows for broken access control. **Recommendations** Update to a version later than 1.0.24.

Cross-Site Request Forgery (CSRF) vulnerability in Recorp Export WP Page to Static HTML/CSS allows Cross Site Request Forgery. This issue affects Export WP Page to Static HTML/CSS: from n/a through 6.0.0.

Missing Authorization vulnerability in Lucian Apostol Auto Affiliate Links allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Auto Affiliate Links: from n/a through 6.8.8.3.

Missing Authorization vulnerability in WPPOOL FlexTable allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FlexTable: from n/a through 3.24.0.

**Name of the Vulnerable Software and Affected Versions** VillaTheme HAPPY versions prior to 1.0.11 **Description** A missing authorization issue in VillaTheme HAPPY allows for the exploitation of incorrectly configured access control security levels. **Recommendations** Update to version 1.0.11 or later.

The 診断ジェネレータ作成プラグイン (Diagnosis Generator) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'js' parameter in versions up to and including 1.4.16. This is due to missing authorization checks and insufficient input sanitization in the themeFunc() function. The function is hooked to 'admin init' and processes theme update requests without verifying user capabilities, allowing any authenticated user (including subscribers) to save malicious JavaScript to theme files. Additionally, the save() function uses stripslashes() which removes WordPress's magic quotes protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in theme files that will execute whenever a user accesses a page containing the diagnosis form shortcode.