Afifudin Maarif

The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat number' parameter in all versions up to, and including, 2.1.30.260413 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload executes in the administrator's browser context when reviewing an order via WooCommerce → Orders → Edit Order, enabling privilege escalation up to and including full site takeover via rogue administrator account creation.

**Name of the Vulnerable Software and Affected Versions** Magic Tooltips For Contact Form 7 versions prior to 1.0.35 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. The issue arises because the `esc html` filter callback decodes HTML-entity-encoded payloads back into live HTML. Consequently, a script payload submitted via the `author` parameter—which bypasses `sanitize text field`—is rendered as executable markup when an administrator accesses the 'wp-admin/edit-comments.php' endpoint. **Recommendations** Update Magic Tooltips For Contact Form 7 to version 1.0.35 or later.

**Name of the Vulnerable Software and Affected Versions** No External Links versions prior to 5.2.1 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This issue is triggered via the `/goto/{base64}` redirect endpoint and is only exploitable if the administrator has enabled the `Link Encoding: Base64` option in the plugin settings. **Recommendations** Update to a version newer than 5.2.0. Disable the `Link Encoding: Base64` option in the plugin settings as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** Welcart e-Commerce plugin for WordPress versions prior to 2.12.2 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the `custom order` parameter in the guest checkout form. An attacker can inject arbitrary web scripts that execute when an administrator views the affected order within the WordPress admin panel. **Recommendations** Update the Welcart e-Commerce plugin for WordPress to version 2.12.2 or later. As a temporary mitigation, restrict access to the guest checkout form or avoid viewing orders containing the `custom order` parameter until the update is applied.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** نظام حجز الصالونات – الإصدار المجاني، الإصدارات الأقدم من 10.30.33 **الوصف** هذه المشكلة هي عبارة عن تزوير طلب عبر المواقع (CSRF) يسمح للمهاجمين غير المصادق عليهم بتنفيذ تعليمات برمجية عن بُعد على الخادم. توجد هذه الثغرة بسبب عدم وجود التحقق من صحة الرقم العشوائي (nonce) أو وجود خطأ فيه في الدالة `setCustomText()`. يمكن للمهاجم خداع مسؤول الموقع للنقر على رابط لتشغيل طلب مزور، مما يؤدي إلى إدخال تعليمات برمجية PHP عشوائية في ملف `translate-constants.php`. على الرغم من أن المعلمة `value` تتم معالجتها بواسطة الدالة `sanitize text field()`، إلا أن هذه الدالة تفشل في تحييد أحرف مثل الأقواس المفردة، والأقواس، والفاصلة المنقوطة، و$، و[ ])، مما يسمح للمهاجم بالخروج من السلسلة النصية الثابتة في PHP قبل كتابة البيانات على القرص باستخدام الدالة `file put contents()`. **التوصيات** تحديث المكون الإضافي إلى إصدار أحدث من 10.30.32.