Peter Thaleikis

**Name of the Vulnerable Software and Affected Versions** rtMedia for WordPress, BuddyPress and bbPress versions prior to 4.6.19 **Description** The plugin is subject to time-based SQL Injection, a technique where an attacker sends a query that forces the database to wait a specific amount of time before responding, allowing them to infer data. This occurs due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. Authenticated attackers with subscriber-level access or higher can manipulate the `order by` parameter to append malicious SQL queries and extract sensitive information from the database. **Recommendations** Update rtMedia for WordPress, BuddyPress and bbPress to version 4.6.19 or later. As a temporary mitigation, restrict access to the functionality utilizing the `order by` parameter for users with subscriber-level permissions.

The affiliate-toolkit – WP Affiliate Plugin with Amazon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'atkp product' shortcode in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is a bypass to CVE-2024-10227.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Master Slider allows DOM-Based XSS. This issue affects Master Slider: from n/a through 3.10.8.

**Name of the Vulnerable Software and Affected Versions** Royal Elementor Addons versions prior to 1.7.1053 **Description** Improper neutralization of input during web page generation allows for Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server and later executed in the browser of a user visiting the affected page. **Recommendations** Update to version 1.7.1053 or later.

**Name of the Vulnerable Software and Affected Versions** Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress versions through 7.3.20 **Description** The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress is susceptible to a privilege escalation issue. The `videowhisper register form()` function does not adequately restrict user roles during registration. This allows authenticated attackers with Author-level access or higher to create posts or pages containing a registration form configured to assign administrator privileges. Attackers can then utilize this form to register a new administrator account, effectively gaining administrative control. While contributors can also attempt this exploit, its success depends on an administrator approving the form with the administrator role assigned. **Recommendations** Update the Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress to version 7.3.21.

**Name of the Vulnerable Software and Affected Versions** Drift versions prior to 1.5.1 **Description** The Drift theme for WordPress is susceptible to Stored Cross-Site Scripting through the post title. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update Drift to version 1.5.1 or later.

**Name of the Vulnerable Software and Affected Versions** Renden versions prior to 1.8.2 **Description** The Renden theme for WordPress is susceptible to Stored Cross-Site Scripting through the post title. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update Renden to version 1.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** Target Video Easy Publish plugin for WordPress versions prior to 3.8.8 **Description** The Target Video Easy Publish plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping related to the `placeholder img` parameter. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update the Target Video Easy Publish plugin to a version later than 3.8.8.

**Name of the Vulnerable Software and Affected Versions** SpiceForms Form Builder plugin for WordPress versions prior to 1.1 **Description** The SpiceForms Form Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'spiceforms' shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update the SpiceForms Form Builder plugin to version 1.1 or later.

**Name of the Vulnerable Software and Affected Versions** landwire Responsive Block Control versions through 1.2.9 **Description** The software contains a flaw related to improper input handling during web page generation, specifically a DOM-Based Cross-Site Scripting issue. This allows for the potential execution of malicious scripts within the context of a user's browser. The issue is present in the Responsive Block Control component. **Recommendations** Update landwire Responsive Block Control to a version newer than 1.2.9.

**Name of the Vulnerable Software and Affected Versions** ThinkUpThemes Minamaze versions through 1.10.1 **Description** The software contains a flaw due to improper handling of user-supplied data when creating web pages, leading to a Stored Cross-site Scripting (XSS) condition. This allows an attacker to inject malicious scripts into web pages viewed by other users. The vulnerability affects the Minamaze theme. **Recommendations** Update ThinkUpThemes Minamaze to a version later than 1.10.1.

**Name of the Vulnerable Software and Affected Versions** ThinkUpThemes Consulting versions through 1.5.0 **Description** The software contains a flaw due to improper neutralization of input during web page generation, leading to a Cross-site Scripting (XSS) issue. This specific instance allows for Stored XSS, meaning malicious scripts are persistently stored on the target server and executed in the context of other users’ browsers. **Recommendations** Update ThinkUpThemes Consulting to a version later than 1.5.0.

**Name of the Vulnerable Software and Affected Versions** Livemesh Addons for Beaver Builder versions through 3.9.2 **Description** The software contains a flaw related to improper handling of user-supplied data when creating web pages, potentially leading to Cross-site Scripting (XSS). This issue allows for Stored XSS attacks, where malicious scripts are stored on the target server and executed by other users. **Recommendations** Update Livemesh Addons for Beaver Builder to a version newer than 3.9.2.

**Name of the Vulnerable Software and Affected Versions** ThinkUpThemes Melos versions through 1.6.0 **Description** The software contains a flaw due to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting (XSS). This means that malicious scripts can be stored on the server and executed by other users when they view the affected web page. The vulnerability allows an attacker to inject malicious code into web pages viewed by other users. **Recommendations** Update to a version later than 1.6.0.

**Name of the Vulnerable Software and Affected Versions** Shuttlethemes Shuttle versions through 1.5.0 **Description** The Shuttlethemes Shuttle software contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting (XSS). This can potentially allow an attacker to inject malicious scripts into web pages viewed by other users. The affected component is susceptible to exploitation through crafted input. **Recommendations** Update Shuttlethemes Shuttle to a version later than 1.5.0.

**Name of the Vulnerable Software and Affected Versions** Revmakx WPCal.Io versions through 0.9.5.9 **Description** The software contains a flaw related to improper input handling during web page generation, leading to a DOM-Based Cross-Site Scripting (XSS) condition. This allows for the potential execution of malicious scripts within the context of a user's browser. The issue affects the application's handling of user-supplied data when constructing web pages. The vulnerability could be exploited through crafted input that is not properly sanitized before being included in the generated HTML. This could allow an attacker to inject malicious code, potentially leading to the compromise of user accounts or sensitive information. **Recommendations** Update Revmakx WPCal.Io to a version later than 0.9.5.9.

**Name of the Vulnerable Software and Affected Versions** Kingcabs theme for WordPress versions prior to 1.1.9 **Description** The Kingcabs theme for WordPress is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping related to the `progressbarLayout` parameter. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. **Recommendations** Update the Kingcabs theme to a version later than 1.1.9.

The Simple Nivo Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode parameter in all versions up to, and including, 0.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

**Name of the Vulnerable Software and Affected Versions** The Simple post listing plugin for WordPress versions up to and including 0.2 **Description** The software is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping of user-supplied attributes. Specifically, the 'class name' parameter within the postlist shortcode is affected. This allows authenticated attackers with contributor-level access or higher to inject malicious web scripts into pages. These scripts will execute when a user accesses the compromised page through mouse interaction. **Recommendations** Update The Simple post listing plugin for WordPress to a version newer than 0.2.

**Name of the Vulnerable Software and Affected Versions** TR Timthumb plugin for WordPress versions up to and including 1.0.4 **Description** The TR Timthumb plugin for WordPress is susceptible to Stored Cross-Site Scripting through shortcode attributes. Insufficient input sanitization and output escaping allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. **Recommendations** Update the TR Timthumb plugin to a version later than 1.0.4.