Rein Daelman

Name of the Vulnerable Software and Affected Versions: The Business Directory Plugin – Easy Listing Directories for WordPress versions prior to 6.4.15 Description: The issue is related to Insecure Direct Object Reference. It affects the `ajax listing submit image upload` function due to missing validation on a user-controlled key. This allows unauthenticated attackers to add arbitrary images to listings. Recommendations: For versions prior to 6.4.15, update to version 6.4.15 or later to resolve the issue. As a temporary workaround, consider disabling the `ajax listing submit image upload` function until a patch is available. Restrict access to the image upload functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Pure Chat – Live Chat & More! plugin for WordPress versions up to, and including, 2.31 **Description** The issue concerns Stored Cross-Site Scripting via the `purechatWidgetName` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 2.31, consider disabling the `purechatWidgetName` parameter until a patch is available to prevent exploitation. Restrict access to the plugin's functionality to minimize the risk of arbitrary web script injection. Update to a version later than 2.31 once available to fully resolve the issue.

**Name of the Vulnerable Software and Affected Versions** The Booking calendar, Appointment Booking System plugin for WordPress versions up to, and including, 3.2.15 **Description** The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. **Recommendations** For versions up to, and including, 3.2.15, update to a version higher than 3.2.15 to resolve the issue. As a temporary workaround, consider restricting SVG file uploads until a patch is available.

**Name of the Vulnerable Software and Affected Versions** The Hash Form – Drag & Drop Form Builder plugin for WordPress versions up to, and including, 1.1.9 **Description** The issue is related to a misconfigured file type validation in the `handleUpload` function, allowing unauthenticated attackers to upload files that are excluded from both the `allowedExtensions` and `unallowed extensions` arrays on the affected site's server. This includes files that may contain cross-site scripting. **Recommendations** For versions up to, and including, 1.1.9, update to a version that fixes the misconfigured file type validation issue in the `handleUpload` function to prevent unauthenticated file uploads. As a temporary workaround, consider disabling the `handleUpload` function until a patch is available. Restrict access to file uploads to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: The Garden Gnome Package plugin for WordPress versions up to, and including, 2.2.9 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the plugin's `ggpkg` shortcode. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages, which will execute whenever a user accesses an injected page. Recommendations: For versions up to, and including, 2.2.9, update to a version that includes the necessary input sanitization and output escaping fixes to prevent Stored Cross-Site Scripting attacks. As a temporary workaround, consider restricting access to the `ggpkg` shortcode for users with contributor-level access and above until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Backup and Staging by WP Time Capsule plugin for WordPress versions up to, and including, 1.22.21 **Description** The issue is related to arbitrary file uploads due to missing file type validation in the UploadHandler.php file and no direct file access prevention. This allows unauthenticated attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible. The estimated number of potentially affected devices worldwide is over 20,000 sites. The vulnerability can be exploited to inject backdoors or malware and take full control of affected websites. **Recommendations** For versions up to, and including, 1.22.21, update the plugin to a version that includes the fix for this issue. As a temporary workaround, consider disabling the UploadHandler.php file until a patch is available. Restrict access to the UploadHandler.php file to minimize the risk of exploitation. Avoid using the plugin until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** String locator plugin for WordPress versions up to, and including, 2.6.5 **Description** The issue is related to Reflected Cross-Site Scripting via the `sql-column` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The exploitation of this issue requires WP DEBUG to be enabled. **Recommendations** For versions up to, and including, 2.6.5, consider disabling the `sql-column` parameter until a patch is available to prevent the injection of arbitrary web scripts. Additionally, restrict access to the plugin's functionality to minimize the risk of exploitation. Ensure WP DEBUG is disabled to reduce the likelihood of successful exploitation.

**Name of the Vulnerable Software and Affected Versions** Simple Membership plugin for WordPress versions up to, and including, 4.3.8 **Description** The issue is related to Reflected Cross-Site Scripting via the `environment mode` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. **Recommendations** For versions up to, and including, 4.3.8, consider disabling the `environment mode` parameter until a patch is available to prevent exploitation. Restrict access to the Simple Membership plugin to minimize the risk of exploitation. Avoid using the `environment mode` parameter in affected pages until the issue is resolved.