San6051

**Name of the Vulnerable Software and Affected Versions** rognone versions prior to 0.6.3 **Description** The rognone plugin for WordPress is subject to Reflected Cross-Site Scripting, a flaw where an application includes untrusted data in a web page without proper validation or escaping. This occurs due to insufficient input sanitization and output escaping in the `mode` parameter. Unauthenticated attackers can exploit this by tricking a user into clicking a crafted link, allowing the execution of arbitrary web scripts in the user's browser. **Recommendations** Update the plugin to a version later than 0.6.2. As a temporary workaround, restrict or sanitize the use of the `mode` parameter.

**Name of the Vulnerable Software and Affected Versions** Word Replacer versions prior to 0.5 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with Administrator-level access and above to perform Stored Cross-Site Scripting. This occurs via the `replacement` parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by a user. **Recommendations** Update to a version later than 0.4. As a temporary workaround, restrict access to the `replacement` parameter until the update is applied.

The hiWeb Migration Simple plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'new domain' parameter in all versions up to, and including, 2.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'a' parameter in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

**Name of the Vulnerable Software and Affected Versions** MinhNhut Link Gateway versions prior to 3.6.2 **Description** The MinhNhut Link Gateway plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping within the plugin settings, specifically affecting the `Description`, `Title`, and other fields. This allows authenticated attackers with Administrator-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the redirect page. This issue specifically impacts multi-site installations and environments where `unfiltered html` has been disabled. **Recommendations** Update the plugin to a version later than 3.6.1.

**Name of the Vulnerable Software and Affected Versions** MinhNhut Link Gateway versions prior to 3.6.2 **Description** The MinhNhut Link Gateway plugin for WordPress contains a Reflected Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping of the `url` parameter on the redirect page. Unauthenticated attackers can exploit this by tricking a user into clicking a link, allowing the injection and execution of arbitrary web scripts in the user's browser. **Recommendations** Update the plugin to a version newer than 3.6.1. As a temporary workaround, restrict or sanitize the use of the `url` parameter on the redirect page.

**Name of the Vulnerable Software and Affected Versions** rexCrawler versions prior to 1.0.16 **Description** The rexCrawler plugin for WordPress contains a Stored Cross-Site Scripting issue within the admin settings caused by insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages, which then execute when a user visits the affected page. This issue specifically impacts multi-site installations and environments where `unfiltered html` has been disabled. **Recommendations** Update to a version later than 1.0.15.

**Name of the Vulnerable Software and Affected Versions** myLinksDump versions prior to 1.7 **Description** The myLinksDump plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level access or higher to inject arbitrary web scripts into pages, which then execute when a user visits the affected page. This issue specifically impacts multi-site installations and environments where `unfiltered html` has been disabled. The flaw is triggered via the `link title` parameter. **Recommendations** Update to a version later than 1.6. As a temporary mitigation, restrict administrator-level access or ensure `unfiltered html` is managed according to security policies to minimize the risk of script injection via the `link title` parameter.

**Name of the Vulnerable Software and Affected Versions** Multi Functional Flexi Lightbox plugin for WordPress versions prior to 1.3 **Description** The software is susceptible to Stored Cross-Site Scripting through the `arv lb[message]` parameter. Insufficient input sanitization and output escaping allow authenticated attackers with Administrator-level access to inject arbitrary web scripts into pages. These scripts execute when a user accesses a page or post with the lightbox enabled. The `arv lb options val()` sanitize callback returns user input without sanitization, and the stored `message` value is output in the `genLB()` function without escaping. **Recommendations** Update the Multi Functional Flexi Lightbox plugin to version 1.3 or later.

**Name of the Vulnerable Software and Affected Versions** rexCrawler plugin for WordPress versions prior to 1.0.16 **Description** The rexCrawler plugin for WordPress is susceptible to Reflected Cross-Site Scripting through the `url` and `regex` parameters within the search-pattern tester page. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. Successful exploitation requires tricking an administrator into performing an action, such as clicking a malicious link. This issue specifically impacts multi-site installations and those where unfiltered html has been disabled. **Recommendations** Update the rexCrawler plugin to version 1.0.16 or later.

**Name of the Vulnerable Software and Affected Versions** myLinksDump plugin for WordPress versions through 1.6 **Description** The myLinksDump plugin for WordPress is susceptible to SQL Injection through the `sort by` and `sort order` parameters. This is due to inadequate input sanitization and insufficient SQL query preparation. An authenticated attacker with administrator-level access or higher can inject additional SQL queries into existing database queries, potentially extracting sensitive information. The vulnerable parameters are `sort by` and `sort order`. **Recommendations** Update the myLinksDump plugin to a version newer than 1.6.

**Name of the Vulnerable Software and Affected Versions** itsukaita plugin for WordPress versions prior to 0.1.3 **Description** The itsukaita plugin for WordPress is susceptible to Reflected Cross-Site Scripting. This is due to insufficient input sanitization and output escaping related to the `day from` and `day to` parameters. An unauthenticated attacker can inject arbitrary web scripts into pages, which will execute if an administrator is tricked into performing an action, such as clicking a malicious link. **Recommendations** Update the itsukaita plugin to version 0.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** MinhNhut Link Gateway versions prior to 3.6.2 **Description** The MinhNhut Link Gateway plugin for WordPress has a Stored Cross-Site Scripting issue related to the 'linkgate' shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. **Recommendations** Update the MinhNhut Link Gateway plugin to version 3.6.2 or later.

**Name of the Vulnerable Software and Affected Versions** Keep Backup Daily plugin for WordPress versions up to and including 2.1.2 **Description** The Keep Backup Daily plugin for WordPress is susceptible to a Stored Cross-Site Scripting issue. This occurs because of inadequate input sanitization and output escaping. Specifically, the backup title alias, represented by the `val` parameter, within the `update kbd bkup alias` AJAX action is not properly handled. While `sanitize text field()` removes HTML tags during saving, it fails to encode double quotes. Consequently, backup titles are displayed in HTML attribute contexts without using `esc attr()`, allowing authenticated attackers with Administrator-level access or higher to inject malicious web scripts. These scripts will execute whenever another administrator views the backup list page. **Recommendations** Update the Keep Backup Daily plugin to a version later than 2.1.2.

**Name of the Vulnerable Software and Affected Versions** Keep Backup Daily plugin for WordPress versions up to and including 2.1.1 **Description** The Keep Backup Daily plugin for WordPress is susceptible to a Limited Path Traversal issue. This is a result of inadequate validation of the `kbd path` parameter within the `kbd open upload dir` AJAX action, where only `sanitize text field()` is used for sanitization. This insufficient sanitization allows authenticated attackers with Administrator-level access or higher to potentially list the contents of directories outside the intended uploads directory on the server. **Recommendations** Versions prior to and including 2.1.1 should be updated.

**Name of the Vulnerable Software and Affected Versions** CM Custom Reports – Flexible reporting to track what matters most plugin for WordPress versions through 1.2.7 **Description** The plugin is susceptible to Stored Cross-Site Scripting through admin settings due to inadequate input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages. These scripts will execute whenever a user accesses the injected page. This issue only impacts multi-site installations and those where `unfiltered html` has been disabled. **Recommendations** Update CM Custom Reports – Flexible reporting to track what matters most plugin for WordPress to a version later than 1.2.7.

**Name of the Vulnerable Software and Affected Versions** CM Custom Reports plugin for WordPress versions up to and including 1.2.7 **Description** The CM Custom Reports plugin for WordPress is susceptible to Reflected Cross-Site Scripting due to inadequate input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages. Successful exploitation requires tricking a user into performing an action, such as clicking a link. The vulnerable parameters are `date from` and `date to`. **Recommendations** Update the CM Custom Reports plugin to a version newer than 1.2.7.

**Name of the Vulnerable Software and Affected Versions** Slidorion versions up to and including 1.0.2 **Description** The Slidorion plugin for WordPress is susceptible to Stored Cross-Site Scripting through admin settings. Insufficient input sanitization and output escaping allow authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. This issue only impacts multi-site installations and those where unfiltered html has been disabled. **Recommendations** Update Slidorion to a version later than 1.0.2.