Tharadol Suksamran

**Name of the Vulnerable Software and Affected Versions** My Calendar – Accessible Event Manager versions prior to 3.7.15 **Description** An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user-controlled key. Unauthenticated attackers can enumerate occurrence IDs via the `vcal` parameter to access the full iCalendar export of personal, draft, trashed, and non-public calendar events. This leads to the disclosure of sensitive metadata, including titles, descriptions, dates, locations, permalinks, and details regarding the organizer and host. **Recommendations** Update My Calendar – Accessible Event Manager to version 3.7.15 or later. As a temporary mitigation, restrict access to the `vcal` parameter to prevent unauthorized event enumeration.

**Name of the Vulnerable Software and Affected Versions** GLS Shipping for WooCommerce versions prior to 1.4.1 **Description** Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user is tricked into performing an action, such as clicking a link. The issue involves the `failed orders` parameter. **Recommendations** Update to a version later than 1.4.0. As a temporary workaround, restrict access to or avoid using the `failed orders` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Youzify versions prior to 1.3.7 **Description** The Youzify plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level access or higher can inject arbitrary web scripts through the `checkin place id` parameter. These scripts execute whenever a user visits the affected page. **Recommendations** Update the plugin to a version later than 1.3.6. As a temporary workaround, restrict the use of the `checkin place id` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Categories Images plugin for WordPress versions prior to 3.3.2 **Description** The plugin is subject to Stored Cross-Site Scripting via the 'z taxonomy image' shortcode. The issue occurs because the shortcode rendering path passes attacker-controlled class input into a fallback image builder that concatenates HTML attributes without proper escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts that execute when users interact with the injected frontend page through the `class` shortcode attribute. **Recommendations** Update the plugin to a version newer than 3.3.1. As a temporary workaround, restrict the use of the `class` attribute within the 'z taxonomy image' shortcode.

Name of the Vulnerable Software and Affected Versions Beaver Builder Page Builder versions up to and including 2.10.1.1 Description The Beaver Builder Page Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `settings[js]` parameter due to inadequate input sanitization and output escaping. This allows authenticated attackers with author-level access or higher to inject malicious web scripts into pages, which will then execute when a user accesses the compromised page. Recommendations Update Beaver Builder Page Builder to a version later than 2.10.1.1.

**Name of the Vulnerable Software and Affected Versions** Contact List plugin for WordPress versions prior to 3.0.19 **Description** The Contact List plugin for WordPress is susceptible to Stored Cross-Site Scripting through the ` cl map iframe` parameter. Insufficient input sanitization and output escaping when handling the Google Maps iframe custom field allows for the injection of malicious scripts. The `saveCustomFields()` function in the class-contact-list-custom-fields.php file extracts iframe tags using a regular expression but fails to validate or sanitize the iframe's attributes, enabling the inclusion of event handlers like 'onload'. The extracted iframe HTML is stored using the `update post meta()` function and subsequently rendered on the front-end in class-cl-public-card.php without proper escaping or filtering. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which will execute when a user accesses the affected page. **Recommendations** Update the Contact List plugin to version 3.0.19 or later.

**Name of the Vulnerable Software and Affected Versions** Unlimited Elements for Elementor plugin for WordPress versions prior to 2.0.6 **Description** The Unlimited Elements for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting through the form entry fields. This is caused by inadequate input sanitization and output escaping of form submission data when displayed in the admin Form Entries Trash view. This allows unauthenticated attackers to inject arbitrary web scripts that will execute when an administrator views the trashed form entries. **Recommendations** Update the Unlimited Elements for Elementor plugin to version 2.0.6 or later.

**Name of the Vulnerable Software and Affected Versions** EventPrime versions prior to 4.2.8.5 **Description** The EventPrime plugin for WordPress is susceptible to unauthorized image file uploads. The plugin registers the `upload file media` API endpoint as publicly accessible without requiring authentication, authorization, or nonce verification, despite a nonce being created. This allows unauthenticated attackers to upload image files to the WordPress uploads directory and create Media Library attachments via the `ep upload file media` endpoint. **Recommendations** Update EventPrime to version 4.2.8.5 or later.

**Name of the Vulnerable Software and Affected Versions** MyRewards – Loyalty Points and Rewards for WooCommerce plugin versions prior to 5.6.1 **Description** The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress does not properly verify user authorization when performing actions within the `ajax` function. This allows authenticated attackers with subscriber-level access or higher to modify, add, or delete loyalty program earning rules. Specifically, attackers can manipulate point multipliers to arbitrary values. **Recommendations** Update the MyRewards – Loyalty Points and Rewards for WooCommerce plugin to version 5.6.1 or later.

**Name of the Vulnerable Software and Affected Versions** Tutor LMS versions prior to 3.9.5 **Description** The Tutor LMS plugin for WordPress is susceptible to Insecure Direct Object References (IDOR) due to insufficient object-level authorization checks. Specifically, the `course list bulk action()`, `bulk delete course()`, and `update course status()` functions lack proper validation. This allows authenticated attackers with Tutor Instructor-level access or higher to modify or delete courses they do not own by manipulating course IDs in bulk action requests. The vulnerable parameter is the course ID used in bulk action requests. **Recommendations** Update Tutor LMS to a version later than 3.9.5. As a temporary workaround, restrict access to the `course list bulk action()`, `bulk delete course()`, and `update course status()` functions for users with Tutor Instructor-level access or higher.

**Name of the Vulnerable Software and Affected Versions** IndieWeb plugin for WordPress versions through 4.0.5 **Description** The IndieWeb plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to inadequate input sanitization and output escaping related to the `Telephone` parameter. Authenticated attackers with author-level access or higher can inject malicious web scripts into pages. These scripts will then execute when a user views the compromised page. **Recommendations** Update the IndieWeb plugin to a version later than 4.0.5.