Prism

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.17.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary company locations in the ERP database.

**Name of the Vulnerable Software and Affected Versions** Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.0.14 **Description** The plugin contains a Directory Traversal flaw, which occurs when an application fails to properly sanitize user-supplied input used to construct a file path, allowing access to files or directories outside the intended folder. Authenticated attackers with editor-level access or higher can exploit this via the `family` parameter to delete arbitrary directories on the server, potentially leading to data loss and service unavailability. **Recommendations** Update the plugin to version 6.0.14 or later. Avoid using the `family` parameter until the update is applied.

The ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'number' and 'group' Shortcode Attributes in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

**Name of the Vulnerable Software and Affected Versions** Kali Forms — Contact Form & Drag-and-Drop Builder versions prior to 2.4.19 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. Attackers can inject arbitrary web scripts through the `digitalSignature` field value. These scripts execute whenever a user accesses the affected page. The attack is possible because the required form-submission nonce is publicly available on any page containing the form shortcode. **Recommendations** As a temporary workaround, disable or replace the plugin until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WP Hotel Booking versions prior to 2.3.3 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user into clicking a link containing a malicious script injected via the `check in date` parameter, which then executes in the user's browser. **Recommendations** Update WP Hotel Booking to version 2.3.3 or later. As a temporary mitigation, restrict or sanitize the input received by the `check in date` parameter.

**Name of the Vulnerable Software and Affected Versions** WPBot – AI ChatBot for Live Support, Lead Generation, AI Services versions prior to 8.5.7 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can trigger the arbitrary re-embedding of stored RAG (Retrieval-Augmented Generation) documents. This process modifies the `rag documents` table and results in the unauthorized consumption of the site owner's paid third-party AI API credits from providers such as OpenAI, Gemini, OpenRouter, or xAI. **Recommendations** Update WPBot – AI ChatBot for Live Support, Lead Generation, AI Services to version 8.5.7 or later.

The The Cache Purger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.20. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently truncate the plugin's cache-purge audit log (wp-content/purge.log), destroying the entire cache-purge audit history. The tcp log purge nonce is rendered in the admin bar on frontend pages accessible to all authenticated users including subscribers, meaning any authenticated user possesses the nonce required to trigger the deletion.

**Name of the Vulnerable Software and Affected Versions** WP TripAdvisor Review Slider versions prior to 14.7 **Description** Insufficient escaping of user-supplied input and lack of proper preparation in SQL queries allow authenticated attackers with administrator-level access and above to perform a generic SQL Injection. By manipulating the `filtersource` parameter, an attacker can append additional SQL queries to extract sensitive information from the database. **Recommendations** Update WP TripAdvisor Review Slider to version 14.7 or later. As a temporary mitigation, restrict access to the administrative functions that utilize the `filtersource` parameter.

**Name of the Vulnerable Software and Affected Versions** SEO Booster versions prior to 7.3.2 **Description** An issue exists where authenticated attackers with administrator-level access and above can perform a time-based SQL Injection. This occurs because the `orderby` parameter is not sufficiently escaped and the SQL query is not properly prepared. Although `esc sql()` and `sanitize text field()` are used, they do not neutralize SQL keywords, commas, parentheses, or subquery syntax within an unquoted ORDER BY context, allowing the clause to be controlled by the attacker to extract sensitive information from the database. **Recommendations** Update SEO Booster to version 7.3.2 or later. As a temporary mitigation, restrict administrator-level access to the plugin settings to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Product Feed Manager For WooCommerce versions prior to 7.6.2 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user into clicking a link containing a malicious script injected via the `s` search parameter. Reflected Cross-Site Scripting is a type of attack where a script is reflected off a web application to the user's browser. **Recommendations** Update to version 7.6.2 or later. As a temporary mitigation, restrict access to the search functionality utilizing the `s` parameter.

**Name of the Vulnerable Software and Affected Versions** Quiz Master Next versions prior to 11.2.1 **Description** An issue exists where authenticated attackers with Author-level access or higher can perform a second-order SQL Injection. This occurs because the `qsm ajax save pages()` AJAX handler does not sufficiently escape the `pages` parameter, and the `qsm options questions tab content()` function fails to use `$wpdb->prepare()` or integer casting when interpolating stored page IDs into an IN() clause. An attacker can plant a SQL payload that executes when any user, including an administrator, views the Questions tab of a quiz, potentially allowing the extraction of sensitive database information. **Recommendations** Update to a version newer than 11.2.0.

**Name of the Vulnerable Software and Affected Versions** Customize My Account for WooCommerce – Live My Account Customizer versions prior to 4.4.15 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with shop manager-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the `row type` parameter, which then execute when a user accesses the affected page. **Recommendations** Update the plugin to version 4.4.15 or later. As a temporary mitigation, restrict access to the `row type` parameter for users with shop manager-level permissions.

**Name of the Vulnerable Software and Affected Versions** Tickera – Sell Tickets & Manage Events versions prior to 3.6.0.1 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the `price wrapper` shortcode attribute. These scripts execute when a user visits the affected page, provided the victim has the referenced ticket ID in their cart cookie, meaning the payload only triggers for users who previously added that specific ticket to their cart. **Recommendations** Update Tickera – Sell Tickets & Manage Events to version 3.6.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** Themify Builder versions prior to 7.7.8 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can overwrite or delete generated CSS stylesheet files for arbitrary posts, including private and draft posts belonging to other users, and modify plugin-scoped font options. This is facilitated by the `tf nonce` CSRF nonce, which is exposed on public front-end builder pages via `wp localize script`, allowing any authenticated user to obtain it. **Recommendations** Update Themify Builder to version 7.7.8 or later.

**Name of the Vulnerable Software and Affected Versions** SEO Booster versions prior to 7.3.2 **Description** An issue exists where insufficient escaping of user-supplied input and lack of proper preparation of SQL queries allow authenticated attackers with administrator-level access and above to perform SQL Injection. By manipulating the `sort field` parameter, an attacker can append additional SQL queries to extract sensitive information from the database. **Recommendations** Update to a version newer than 7.3.1. As a temporary mitigation, restrict access to the functionality utilizing the `sort field` parameter.

**Name of the Vulnerable Software and Affected Versions** Tickera – Sell Tickets & Manage Events versions prior to 3.6.0.1 **Description** An issue exists where authenticated attackers with custom-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of user-supplied data and a lack of proper preparation of the SQL query. By manipulating the `s` parameter, an attacker can append additional SQL queries to extract sensitive information from the database. **Recommendations** Update the plugin to a version newer than 3.6.0.0. Avoid using the `s` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Advance Product Search- Voice & Ajax Search for WooCommerce versions prior to 1.4.5 **Description** An issue exists where unauthenticated attackers can append additional SQL queries to existing ones to extract sensitive information from the database. This occurs due to insufficient escaping of user-supplied parameters and a lack of sufficient preparation of the SQL query. The flaw is triggered via the 's' and `match` parameters in the search functionality. **Recommendations** Update Advance Product Search- Voice & Ajax Search for WooCommerce to version 1.4.5 or later. As a temporary mitigation, restrict access to the search functionality that utilizes the `s` and `match` parameters.

The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute in versions up to, and including, 1.10.2. This is due to insufficient input sanitization and output escaping in the wrap direction text() function, which interpolates the user-supplied href value from nested link nodes ($node['props']['href']) directly into an anchor tag via sprintf() at line 1627 without esc url() or any URL scheme validation. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts (including javascript: URIs) in pages that will execute whenever a user (such as an editor or administrator previewing the pending post) accesses an injected page and clicks the malicious link.

**Name of the Vulnerable Software and Affected Versions** MxChat – AI Chatbot & Content Generation for WordPress versions prior to 3.2.11 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the admin settings. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts into pages. These scripts execute whenever a user accesses the affected page. This issue specifically impacts multi-site installations and environments where `unfiltered html` has been disabled. **Recommendations** Update to a version newer than 3.2.10.

**Name of the Vulnerable Software and Affected Versions** MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions versions prior to 5.0.10 **Description** An issue exists where insufficient escaping of user-supplied input and lack of query preparation allow authenticated attackers with subscriber-level access and above to perform SQL Injection. This occurs via the `order by` parameter in the transactions endpoint. Attackers can append additional SQL queries to extract sensitive information from the database. This is particularly exploitable when the store approval setting is configured to automatically approve store owners, as any logged-in user can self-register as a store owner via the public Stores REST endpoint to obtain the necessary `edit stores` capability. **Recommendations** Update MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions to version 5.0.10 or later. Restrict the use of the `order by` parameter in the transactions endpoint as a temporary mitigation. Disable the automatic approval of store owners in the plugin settings to prevent unauthorized users from obtaining the `edit stores` capability.