Adrien Brunner

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms checkout] shortcode. This is due to the llms get template() helper performing extract() on the shortcode attribute array before resolving the template path, which allows the attacker-supplied 'template name' and 'default path' shortcode attributes to overwrite the function's local parameters and ultimately control the path passed to a PHP include. This makes it possible for authenticated attackers, with Instructor-level access and above, to include and execute arbitrary files on the server, that can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files with safe extensions containing attacker-controlled content can be uploaded and included.

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post title' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

**Name of the Vulnerable Software and Affected Versions** Payment Plugins for Stripe WooCommerce versions prior to 4.0.18 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS) via the `#response` URL fragment. This occurs when the `getErrorMessage()` function returns a raw Stripe error string instead of a safe mapped message, which happens if the 'Generic Errors' setting is unchecked. This allows the injection of arbitrary web scripts that execute when a user visits the affected page. **Recommendations** Update to version 4.0.18 or later. Enable the 'Generic Errors' setting to prevent the `getErrorMessage()` function from returning raw error strings.

**Name of the Vulnerable Software and Affected Versions** HivePress versions prior to 1.7.32 **Description** The HivePress – Business Directory, Listings & Classified Ads Plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages via a custom user attribute field name parameter. These scripts execute when a user accesses the affected page. This occurs when an administrator configures a text-type custom user attribute where the `%value%` is placed inside an HTML attribute context and front-end user profiles are enabled. **Recommendations** Update to a version newer than 1.7.31. As a temporary mitigation, avoid configuring text-type custom user attributes that place `%value%` inside HTML attribute contexts or disable front-end user profiles.

**Name of the Vulnerable Software and Affected Versions** Photo Reviews for WooCommerce versions prior to 1.2.31 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. By exploiting the `wcpr image upload id` parameter, an attacker can inject arbitrary web scripts into comment meta, which is not processed by `wp kses` (a WordPress function used to sanitize HTML). The attack is facilitated by the publicly available `wcpr image upload` nonce on product review forms, as the system fails to perform capability, authentication, or attachment ownership checks. The injected scripts execute when a user views the affected review on the frontend. **Recommendations** Update to a version later than 1.2.30.

**Name of the Vulnerable Software and Affected Versions** Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App versions prior to 4.0.2 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the `user email` parameter. On WordPress Multisite installations with public registration enabled, attackers can use email addresses containing numeric HTML character references. While the plugin's validator rejects these, the attacker-controlled address is persisted verbatim to the email log through the failed-send exception message, executing the script when a user accesses the affected page. **Recommendations** Update to version 4.0.2 or later. As a temporary mitigation, restrict public registration on WordPress Multisite installations to prevent unauthenticated users from triggering the vulnerability via the `user email` parameter.

**Name of the Vulnerable Software and Affected Versions** SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent versions prior to 3.5.4 **Description** An issue exists where insufficient escaping of user-supplied parameters and lack of preparation in SQL queries allow authenticated attackers to perform time-based SQL Injection. This occurs via the `sort by` parameter, enabling attackers with custom-level access and above to append additional SQL queries to extract sensitive information from the database. Successful exploitation requires the attacker to possess a Subscriber-level (or higher) WordPress role and a SupportCandy Agent account with the 'Assign Agents' permission configured. **Recommendations** Update SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent to version 3.5.4 or later. As a temporary mitigation, restrict the 'Assign Agents' permission for SupportCandy Agent accounts to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Mail logging – WP Mail Catcher versions prior to 2.1.13 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). This occurs via the PHPMailer `wp mail failed` error message, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page. Exploitation requires a separate plugin, such as Contact Form 7, to pass unauthenticated user-controlled input into mail fields that PHPMailer includes in its failure error message. **Recommendations** Update to a version newer than 2.1.12.

**Name of the Vulnerable Software and Affected Versions** SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent versions prior to 3.5.4 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts via the `name` parameter. These scripts execute when a user accesses the affected page. This issue is exploitable when the 'Register user if not exists' setting is disabled, which is the default configuration. **Recommendations** Update SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent to version 3.5.4 or later.

**Name of the Vulnerable Software and Affected Versions** SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress versions prior to 10.3 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping of the author display name. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This requires the `Track Authors` custom dimension to be enabled in the Google Analytics 4 or Matomo settings, and the attacker must be able to publish public singular content, such as bbPress forum topics, to ensure the injected display name is rendered in the tracking script. **Recommendations** Update the plugin to version 10.3 or later. As a temporary mitigation, disable the `Track Authors` custom dimension in the Google Analytics 4 or Matomo settings.

**Name of the Vulnerable Software and Affected Versions** Business Essentials for Contact Form 7 versions prior to 1.2.2 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This issue affects the `gateway` form field and requires the Payments module to be enabled, with a form configured to accept both PayPal and Stripe as payment gateways. **Recommendations** Update Business Essentials for Contact Form 7 to version 1.2.2 or later. As a temporary mitigation, disable the Payments module or restrict the use of the `gateway` form field.

**Name of the Vulnerable Software and Affected Versions** Zero Spam for WordPress versions prior to 5.7.11 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). This occurs through the Contact Form 7 integration when a request is submitted with a nested POST array key containing arbitrary HTML or JavaScript. PHP parses the field name into a nested array key, which is then stored verbatim in the `zerospam log.submission data` column if the submission is flagged as spam due to the missing `zerospam david walsh key` field. This allows the injection of web scripts that execute when a user accesses the affected page. **Recommendations** Update to a version newer than 5.7.10.

**Name of the Vulnerable Software and Affected Versions** BA Book Everything versions prior to 1.8.28 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server and executed in the browser of users who visit the affected page. The issue exists in the `action to pay()` handler via the `first name` parameter. An attacker can trigger this by placing a guest booking through the `[babe-booking-form]` shortcode to obtain the necessary `order id`, `order num`, and `order hash` credentials. **Recommendations** Update to a version newer than 1.8.27. As a temporary mitigation, restrict access to the `action to pay()` handler or avoid using the `first name` parameter in the affected process until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots versions prior to 3.0.5 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored DOM-Based Cross-Site Scripting. This occurs because the `sanitize text field()` function in WordPress core preserves HTML-entity-encoded payloads, such as an `iframe` `srcdoc` attribute. This allows an encoded string to be stored as a user display name without requiring the `unfiltered html` capability. The plugin then decodes this string server-side before rendering, enabling the execution of arbitrary web scripts when a user accesses the affected page. **Recommendations** Update to a version newer than 3.0.4.

**Name of the Vulnerable Software and Affected Versions** Qi Addons For Elementor versions prior to 1.12 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when the Table of Contents widget is placed on a template that renders on the WordPress search-results page, such as a sitewide header or footer, and the 'Limit ToC to Main Page Content' option is set to No. Under these conditions, the widget scans the search-results heading which reflects the unsanitized `s` parameter, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page. **Recommendations** Update Qi Addons For Elementor to version 1.12 or later. As a temporary mitigation, enable the 'Limit ToC to Main Page Content' option or remove the Table of Contents widget from templates that render on the search-results page.

**Name of the Vulnerable Software and Affected Versions** Themify – WooCommerce Product Filter versions prior to 1.5.6 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user into clicking a link containing a malicious script within a query parameter name, which then executes in the user's browser. **Recommendations** Update the plugin to version 1.5.6 or later.

**Name of the Vulnerable Software and Affected Versions** Broken Link Checker versions prior to 2.4.14 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. An attacker can submit a link via the WordPress comment author URL field; if an administrator performs the standard dismiss-and-recheck workflow, the attacker's server can issue a redirect to a URL containing an HTML/JavaScript payload. This payload is stored verbatim in the link log and executes whenever a user accesses the affected page. **Recommendations** Update to a version newer than 2.4.13.

**Name of the Vulnerable Software and Affected Versions** WP Fastest Cache – WordPress Cache Plugin versions prior to 1.5.1 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) via the HTTP Host Header. This occurs when the Polylang or Polylang Pro plugin is active and the Combine JS option is enabled, triggering a code path that writes attacker-controlled script src values into the shared page-cache file. Consequently, arbitrary web scripts execute whenever a user accesses an affected page. **Recommendations** Update the plugin to a version later than 1.5.0. Disable the Combine JS option as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** Forminator Forms – Contact Form, Payment Form & Custom Form Builder versions prior to 1.58.0 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform DOM-Based Reflected Cross-Site Scripting. This occurs when arbitrary web scripts are injected into pages, which then execute upon user access. The issue is specifically triggerable on pages hosting a form configured to use the Stripe Checkout Sessions payment API via the `error description` parameter. **Recommendations** Update to a version newer than 1.57.0. Avoid using the `error description` parameter in the Stripe Checkout Sessions payment API configuration until the update is applied.