San6051

**Name of the Vulnerable Software and Affected Versions** MapSVG versions prior to 8.14.1 **Description** The MapSVG plugin for WordPress allows authenticated attackers with Administrator-level access and above to upload arbitrary files to the server. This issue occurs because of an incorrect conditional check in the `SVGFile` constructor that bypasses file type validation. The flaw is exploitable via the '/mapsvg/v1/svgfile' endpoint and could lead to remote code execution. **Recommendations** Update MapSVG to a version newer than 8.14.0.

**Name of the Vulnerable Software and Affected Versions** rognone versions prior to 0.6.3 **Description** The rognone plugin for WordPress is subject to Reflected Cross-Site Scripting, a flaw where an application includes untrusted data in a web page without proper validation or escaping. This occurs due to insufficient input sanitization and output escaping in the `mode` parameter. Unauthenticated attackers can exploit this by tricking a user into clicking a crafted link, allowing the execution of arbitrary web scripts in the user's browser. **Recommendations** Update the plugin to a version later than 0.6.2. As a temporary workaround, restrict or sanitize the use of the `mode` parameter.

**Name of the Vulnerable Software and Affected Versions** Word Replacer versions prior to 0.5 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with Administrator-level access and above to perform Stored Cross-Site Scripting. This occurs via the `replacement` parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by a user. **Recommendations** Update to a version later than 0.4. As a temporary workaround, restrict access to the `replacement` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** hiWeb Migration Simple versions prior to 2.0.0.2 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs via the `new domain` parameter, enabling the injection of arbitrary web scripts into pages that execute when an administrator is tricked into clicking a malicious link. **Recommendations** Update hiWeb Migration Simple to a version newer than 2.0.0.1. Avoid using the `new domain` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** rognone versions prior to 0.6.3 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs via the `a` parameter, enabling the injection of arbitrary web scripts into pages that execute when a user is tricked into clicking a malicious link. **Recommendations** Update to a version newer than 0.6.2. Avoid using the `a` parameter in the affected plugin until the update is applied.

**Name of the Vulnerable Software and Affected Versions** rexCrawler versions prior to 1.0.16 **Description** The rexCrawler plugin for WordPress contains a Stored Cross-Site Scripting issue within the admin settings caused by insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages, which then execute when a user visits the affected page. This issue specifically impacts multi-site installations and environments where `unfiltered html` has been disabled. **Recommendations** Update to a version later than 1.0.15.

**Name of the Vulnerable Software and Affected Versions** myLinksDump versions prior to 1.7 **Description** The myLinksDump plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level access or higher to inject arbitrary web scripts into pages, which then execute when a user visits the affected page. This issue specifically impacts multi-site installations and environments where `unfiltered html` has been disabled. The flaw is triggered via the `link title` parameter. **Recommendations** Update to a version later than 1.6. As a temporary mitigation, restrict administrator-level access or ensure `unfiltered html` is managed according to security policies to minimize the risk of script injection via the `link title` parameter.

**Name of the Vulnerable Software and Affected Versions** MinhNhut Link Gateway versions prior to 3.6.2 **Description** The MinhNhut Link Gateway plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping within the plugin settings, specifically affecting the `Description`, `Title`, and other fields. This allows authenticated attackers with Administrator-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the redirect page. This issue specifically impacts multi-site installations and environments where `unfiltered html` has been disabled. **Recommendations** Update the plugin to a version later than 3.6.1.

**Name of the Vulnerable Software and Affected Versions** MinhNhut Link Gateway versions prior to 3.6.2 **Description** The MinhNhut Link Gateway plugin for WordPress contains a Reflected Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping of the `url` parameter on the redirect page. Unauthenticated attackers can exploit this by tricking a user into clicking a link, allowing the injection and execution of arbitrary web scripts in the user's browser. **Recommendations** Update the plugin to a version newer than 3.6.1. As a temporary workaround, restrict or sanitize the use of the `url` parameter on the redirect page.

**Name of the Vulnerable Software and Affected Versions** Multi Functional Flexi Lightbox plugin for WordPress versions prior to 1.3 **Description** The software is susceptible to Stored Cross-Site Scripting through the `arv lb[message]` parameter. Insufficient input sanitization and output escaping allow authenticated attackers with Administrator-level access to inject arbitrary web scripts into pages. These scripts execute when a user accesses a page or post with the lightbox enabled. The `arv lb options val()` sanitize callback returns user input without sanitization, and the stored `message` value is output in the `genLB()` function without escaping. **Recommendations** Update the Multi Functional Flexi Lightbox plugin to version 1.3 or later.

**Name of the Vulnerable Software and Affected Versions** rexCrawler plugin for WordPress versions prior to 1.0.16 **Description** The rexCrawler plugin for WordPress is susceptible to Reflected Cross-Site Scripting through the `url` and `regex` parameters within the search-pattern tester page. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. Successful exploitation requires tricking an administrator into performing an action, such as clicking a malicious link. This issue specifically impacts multi-site installations and those where unfiltered html has been disabled. **Recommendations** Update the rexCrawler plugin to version 1.0.16 or later.

**Name of the Vulnerable Software and Affected Versions** myLinksDump plugin for WordPress versions through 1.6 **Description** The myLinksDump plugin for WordPress is susceptible to SQL Injection through the `sort by` and `sort order` parameters. This is due to inadequate input sanitization and insufficient SQL query preparation. An authenticated attacker with administrator-level access or higher can inject additional SQL queries into existing database queries, potentially extracting sensitive information. The vulnerable parameters are `sort by` and `sort order`. **Recommendations** Update the myLinksDump plugin to a version newer than 1.6.

**Name of the Vulnerable Software and Affected Versions** itsukaita plugin for WordPress versions prior to 0.1.3 **Description** The itsukaita plugin for WordPress is susceptible to Reflected Cross-Site Scripting. This is due to insufficient input sanitization and output escaping related to the `day from` and `day to` parameters. An unauthenticated attacker can inject arbitrary web scripts into pages, which will execute if an administrator is tricked into performing an action, such as clicking a malicious link. **Recommendations** Update the itsukaita plugin to version 0.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** MinhNhut Link Gateway versions prior to 3.6.2 **Description** The MinhNhut Link Gateway plugin for WordPress has a Stored Cross-Site Scripting issue related to the 'linkgate' shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. **Recommendations** Update the MinhNhut Link Gateway plugin to version 3.6.2 or later.

**Name of the Vulnerable Software and Affected Versions** Keep Backup Daily plugin for WordPress versions up to and including 2.1.2 **Description** The Keep Backup Daily plugin for WordPress is susceptible to a Stored Cross-Site Scripting issue. This occurs because of inadequate input sanitization and output escaping. Specifically, the backup title alias, represented by the `val` parameter, within the `update kbd bkup alias` AJAX action is not properly handled. While `sanitize text field()` removes HTML tags during saving, it fails to encode double quotes. Consequently, backup titles are displayed in HTML attribute contexts without using `esc attr()`, allowing authenticated attackers with Administrator-level access or higher to inject malicious web scripts. These scripts will execute whenever another administrator views the backup list page. **Recommendations** Update the Keep Backup Daily plugin to a version later than 2.1.2.

**Name of the Vulnerable Software and Affected Versions** Keep Backup Daily plugin for WordPress versions up to and including 2.1.1 **Description** The Keep Backup Daily plugin for WordPress is susceptible to a Limited Path Traversal issue. This is a result of inadequate validation of the `kbd path` parameter within the `kbd open upload dir` AJAX action, where only `sanitize text field()` is used for sanitization. This insufficient sanitization allows authenticated attackers with Administrator-level access or higher to potentially list the contents of directories outside the intended uploads directory on the server. **Recommendations** Versions prior to and including 2.1.1 should be updated.

**Name of the Vulnerable Software and Affected Versions** CM Custom Reports – Flexible reporting to track what matters most plugin for WordPress versions through 1.2.7 **Description** The plugin is susceptible to Stored Cross-Site Scripting through admin settings due to inadequate input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages. These scripts will execute whenever a user accesses the injected page. This issue only impacts multi-site installations and those where `unfiltered html` has been disabled. **Recommendations** Update CM Custom Reports – Flexible reporting to track what matters most plugin for WordPress to a version later than 1.2.7.

**Name of the Vulnerable Software and Affected Versions** CM Custom Reports plugin for WordPress versions up to and including 1.2.7 **Description** The CM Custom Reports plugin for WordPress is susceptible to Reflected Cross-Site Scripting due to inadequate input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages. Successful exploitation requires tricking a user into performing an action, such as clicking a link. The vulnerable parameters are `date from` and `date to`. **Recommendations** Update the CM Custom Reports plugin to a version newer than 1.2.7.

**Name of the Vulnerable Software and Affected Versions** Slidorion versions up to and including 1.0.2 **Description** The Slidorion plugin for WordPress is susceptible to Stored Cross-Site Scripting through admin settings. Insufficient input sanitization and output escaping allow authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. This issue only impacts multi-site installations and those where unfiltered html has been disabled. **Recommendations** Update Slidorion to a version later than 1.0.2.