Wcraft

**Name of the Vulnerable Software and Affected Versions** Comments WordPress plugin versions prior to 7.6.40 **Description** The Comments WordPress plugin does not properly validate user identity when utilizing the disqus.com provider. This allows an attacker to log in as any user, given knowledge of their email address, even if the user does not have an existing account on disqus.com. **Recommendations** Update the Comments WordPress plugin to version 7.6.40 or later.

**Name of the Vulnerable Software and Affected Versions** W3 Total Cache versions prior to 2.8.13 **Description** The W3 Total Cache WordPress plugin is affected by a command injection issue through the ` parse dynamic mfunc` function. This allows unauthenticated users to execute arbitrary PHP commands by submitting a comment containing a malicious payload to a post. It is estimated that over one million WordPress sites are potentially impacted. Exploitation involves submitting a crafted comment, which allows attackers to inject and execute PHP code, potentially leading to full site takeover. The ` parse dynamic mfunc` function is responsible for processing calls to dynamic functions embedded in cached content. The vulnerability allows attackers to bypass authentication and execute commands on the server. A proof-of-concept exploit has been published. **Recommendations** Update to W3 Total Cache version 2.8.13 or later.

**Name of the Vulnerable Software and Affected Versions** Ninja Forms WordPress plugin versions prior to 3.11.1 **Description** The Ninja Forms WordPress plugin is susceptible to PHP Object Injection due to the unserialization of user-supplied data through form fields. This allows unauthenticated users to potentially execute malicious payloads. **Recommendations** Update Ninja Forms to version 3.11.1 or later.

**Name of the Vulnerable Software and Affected Versions** MainWP Child plugin versions prior to 5.3 **Description** The MainWP Child plugin for WordPress is vulnerable to privilege escalation due to a missing authorization check on the `register site` function when a site is left in an unconfigured state. This makes it possible for unauthenticated attackers to log in as an administrator on instances where MainWP Child is not yet connected to the MainWP Dashboard. The vulnerability only affects sites that have MainWP Child installed, have not yet connected to the MainWP Dashboard, and do not have the unique security ID feature enabled. **Recommendations** For versions prior to 5.2: Update to version 5.3 to fully resolve the issue. For version 5.2.1: Although a partial patch is included, it is recommended to update to version 5.3 for the complete patch. As a temporary workaround, consider disabling the `register site` function until a patch is available. Restrict access to the MainWP Child plugin to minimize the risk of exploitation. Avoid using the plugin in an unconfigured state until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor Page Builder Lite versions through 5.6.14 Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This means that an attacker could potentially inject malicious scripts into the webpage, affecting users who interact with the page. Recommendations: For versions through 5.6.14, update to a version later than 5.6.14 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this vulnerability.

Name of the Vulnerable Software and Affected Versions: WP Royal Royal Elementor Addons versions 1.3.980 and earlier Description: The issue is related to an Improper Restriction of XML External Entity Reference vulnerability, which allows XML Injection. This vulnerability affects WP Royal Royal Elementor Addons. Recommendations: For WP Royal Royal Elementor Addons versions 1.3.980 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Brainstorm Force Starter Templates versions n/a through 4.4.0 **Description** The issue is related to improper neutralization of input during web page generation, which allows Stored Cross-site Scripting (XSS). This means that an attacker can inject malicious scripts into the website, potentially leading to unauthorized access or data theft. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. **Recommendations** For versions n/a through 4.4.0, update to a version later than 4.4.0 to resolve the issue. As a temporary workaround, consider restricting user input to minimize the risk of exploitation. Avoid using potentially vulnerable features in Brainstorm Force Starter Templates until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Essential Addons for Elementor versions through 5.9.26 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks. **Recommendations** For versions through 5.9.26, update to a version later than 5.9.26 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Element Pack Elementor Addons versions through 5.6.11 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks. **Recommendations** For Element Pack Elementor Addons versions through 5.6.11, update to a version later than 5.6.11 to resolve the issue. As a temporary workaround, consider restricting user input to minimize the risk of Stored XSS attacks.

**Name of the Vulnerable Software and Affected Versions** Elementor – Header, Footer & Blocks Template versions 1.6.35 and earlier **Description** The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for DOM-Based XSS, which can be exploited. **Recommendations** For versions 1.6.35 and earlier, update to a version later than 1.6.35 to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable templates until a patch is available.

**Name of the Vulnerable Software and Affected Versions** OceanWP Ocean Extra versions 2.2.9 and earlier **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks. **Recommendations** For OceanWP Ocean Extra versions 2.2.9 and earlier, update to a version later than 2.2.9 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Slider Revolution versions 6.7.13 and earlier **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This is a type of security vulnerability that can allow an attacker to inject malicious scripts into a website, potentially leading to unauthorized access or control. **Recommendations** For versions 6.7.13 and earlier, update to a version later than 6.7.13 to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific issue.

**Name of the Vulnerable Software and Affected Versions** Premium Addons for Elementor versions 4.10.34 and earlier **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks. **Recommendations** For versions 4.10.34 and earlier, update to a version later than 4.10.34 to resolve the issue. As a temporary workaround, consider restricting user input in web page generation to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PDF Viewer for Elementor plugin for WordPress versions up to, and including, 2.9.3 **Description** The issue is related to Stored Cross-Site Scripting via the `render` function due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page. **Recommendations** For versions up to, and including, 2.9.3, update to a version that addresses the insufficient input sanitization and output escaping in the `render` function to prevent Stored Cross-Site Scripting attacks. As a temporary workaround, consider restricting access to the `render` function for users with contributor-level access and above until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Revslider plugin for WordPress versions up to, and including, 6.6.20 **Description** The issue is related to Stored Cross-Site Scripting via svg upload due to insufficient input sanitization and output escaping. This allows authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure revslider can be extended to authors. **Recommendations** For versions up to, and including, 6.6.20, update to a version higher than 6.6.20 to resolve the issue. As a temporary workaround, consider restricting access to the svg upload feature to minimize the risk of exploitation. Additionally, limit the ability to use and configure revslider to only trusted administrators to reduce the potential attack surface.

**Name of the Vulnerable Software and Affected Versions** The Beaver Builder – WordPress Page Builder plugin for WordPress versions up to, and including, 2.7.4.2 **Description** The issue is related to Stored Cross-Site Scripting via the `button link` parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 2.7.4.2, update to a version higher than 2.7.4.2 to resolve the issue. As a temporary workaround, consider restricting access to the `button link` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Beaver Builder plugin for WordPress versions up to, and including, 2.7.4.2 **Description** The issue is related to Stored Cross-Site Scripting in the Icon Widget due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages via the `fl builder data[node preview][link]` and `fl builder data[settings][link target]` parameters. These scripts will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 2.7.4.2, consider disabling the Icon Widget until a patch is available to prevent exploitation. Restrict access to the `fl builder data[node preview][link]` and `fl builder data[settings][link target]` parameters to minimize the risk of arbitrary web script injection. Avoid using these parameters in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.