Vincent Fourcade

**Name of the Vulnerable Software and Affected Versions** WP Import Export Lite plugin for WordPress versions up to and including 3.9.29 **Description** The WP Import Export Lite plugin for WordPress is susceptible to arbitrary file uploads because of a lack of file type validation within the `wpie parse upload data` function. This allows authenticated attackers with Subscriber-level access or higher, and permissions granted by an Administrator, to upload arbitrary files to the affected server, potentially leading to remote code execution. The vulnerability was partially addressed in version 3.9.29. **Recommendations** Versions prior to 3.9.29 should be updated. As a temporary workaround, restrict file upload permissions for users with Subscriber-level access and below.

**Name of the Vulnerable Software and Affected Versions** WP Import Export Lite versions through 3.9.28 **Description** The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `wpie tempalte import` function. This allows authenticated attackers with Subscriber-level access and above, and permissions granted by an Administrator, to upload arbitrary files to the affected site's server, potentially leading to remote code execution. **Recommendations** Update WP Import Export Lite to a version beyond 3.9.28.

**Name of the Vulnerable Software and Affected Versions** Wise Chat plugin for WordPress versions up to, and including, 3.3.4 **Description** The issue is related to Stored Cross-Site Scripting via the X-Forwarded-For header due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For Wise Chat plugin for WordPress versions up to, and including, 3.3.4, update to a version later than 3.3.4 to resolve the issue. As a temporary workaround, consider restricting access to the X-Forwarded-For header to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Connections Business Directory plugin for WordPress versions up to, and including, 10.4.66 **Description** The issue is related to insufficient file path validation when deleting a connections image directory, allowing authenticated attackers with Administrator-level access and above to delete arbitrary folders on the server and all their content. **Recommendations** For versions up to, and including, 10.4.66, update to a version higher than 10.4.66 to resolve the issue. As a temporary workaround, consider restricting access to the directory deletion functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** AutomatorWP – Automator plugin for WordPress versions up to, and including, 5.0.9 **Description** The AutomatorWP plugin is vulnerable to Reflected Cross-Site Scripting via the `a-0-o-search field value` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability can be leveraged to execute arbitrary code when used in conjunction with the plugin's import and code action feature. The issue is actively exploited in the wild. **Recommendations** For versions up to, and including, 5.0.9, update to a version higher than 5.0.9 to resolve the issue. As a temporary workaround, consider restricting access to the `a-0-o-search field value` parameter to minimize the risk of exploitation. Avoid using the `a-0-o-search field value` parameter in affected pages until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress versions up to, and including, 20231101 **Description** The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue only affects multi-site installations and installations where unfiltered html has been disabled. **Recommendations** For versions up to, and including, 20231101, update to a version later than 20231101 to resolve the issue. As a temporary workaround, consider restricting access to admin settings to minimize the risk of exploitation. Additionally, ensure that unfiltered html is enabled, if possible, to reduce the vulnerability's impact.