Nosleep

The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The vulnerability was partially patched in version 5.0.4.

**Name of the Vulnerable Software and Affected Versions** Breadcrumb NavXT versions prior to 7.5.1 **Description** The Breadcrumb NavXT plugin for WordPress has an authorization bypass issue. This occurs because the Gutenberg block renderer trusts the `post id` parameter without proper verification within the includes/blocks/build/breadcrumb-trail/render.php file. An attacker can manipulate the `post id` parameter to enumerate and view breadcrumb trails for draft or private posts, potentially revealing post titles and hierarchy that should not be accessible. The vulnerable parameter is `post id`. **Recommendations** Update Breadcrumb NavXT to version 7.5.1 or later.

**Name of the Vulnerable Software and Affected Versions** Breeze - WordPress Cache Plugin versions through 2.2.21 **Description** The Breeze - WordPress Cache Plugin is affected by an issue allowing unauthorized cache clearing. The REST API endpoint `/wp-json/breeze/v1/clear-all-cache` is registered without proper permission checks (`permission callback => ' return true'`) and authentication is disabled by default when the API is enabled. This allows unauthenticated attackers to clear all site caches (page cache, Varnish, and Cloudflare) by sending a POST request to the API endpoint, provided the administrator has enabled the API integration feature. **Recommendations** Versions prior to 2.2.21 should be updated.

**Name of the Vulnerable Software and Affected Versions** Checkout Manager for WooCommerce versions prior to 7.8.6 **Description** The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress has an authorization issue. The plugin does not properly verify user authorization to delete attachments and has flawed guest order ownership validation. This allows unauthenticated attackers to delete attachments linked to guest orders by using the `wooccm upload` nonce and the attachment ID. **Recommendations** Update to version 7.8.6 or later.

**Name of the Vulnerable Software and Affected Versions** All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic versions prior to 4.9.3 **Description** The plugin is susceptible to unauthorized data access because of a missing capability check on the `/aioseo/v1/ai/credits` REST endpoint. Authenticated attackers with Contributor-level access or higher can disclose the global AI access token. **Recommendations** Update to version 4.9.3 or later.

**Name of the Vulnerable Software and Affected Versions** Advanced Ads versions prior to 2.0.15 **Description** The Advanced Ads plugin for WordPress is susceptible to Remote Code Execution through the `change-ad content` shortcode parameter. This allows authenticated attackers with editor-level permissions or higher to execute code on the server. The vulnerable parameter is `change-ad content`. **Recommendations** Update Advanced Ads to version 2.0.15 or later.

**Name of the Vulnerable Software and Affected Versions** MailerLite – Signup forms (official) versions up to and including 1.7.16 **Description** The MailerLite – Signup forms (official) plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `form description` and `success message` parameters. Insufficient input sanitization and output escaping allow authenticated attackers with administrator access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Versions prior to 1.7.16 should be updated.