Braintx

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute slug> (e.g. hp custom link)' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has configured a custom user attribute with a display format template placing the %value% token inside an href, src, or style attribute context, which is a documented and expected use of the plugin's attribute display feature.

**Name of the Vulnerable Software and Affected Versions** Data Tables Generator by Supsystic versions prior to 1.15.2 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. This occurs via the `updateRows` action through the `data` variable of a table cell. The issue is exploitable by subscriber-level users if an administrator has added their role to the `access roles` setting, which provides the `dtgs nonce` required to access the vulnerable handler. **Recommendations** Update Data Tables Generator by Supsystic to version 1.15.2 or later. Restrict the `access roles` setting to prevent lower-privileged users from accessing the `updateRows` action.

**Name of the Vulnerable Software and Affected Versions** EWWW Image Optimizer versions prior to 8.7.8 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs via the `REQUEST URI` parameter key, enabling the injection of arbitrary web scripts that execute when a user is tricked into clicking a malicious link. This issue is only exploitable if the `enable help` option is active, as the vulnerable HelpScout Beacon script block is only emitted under this configuration. **Recommendations** Update EWWW Image Optimizer to version 8.7.8 or later. As a temporary mitigation, disable the `enable help` option to prevent the vulnerable script block from being emitted.

**Name of the Vulnerable Software and Affected Versions** SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress versions prior to 10.3 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs via the `seopress google analytics matomo id` parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users. This issue is exploitable only if an administrator has delegated the Analytics management capability to the Subscriber role through the plugin's Advanced > Security settings. **Recommendations** Update the plugin to version 10.3 or later. Restrict the Analytics management capability to higher-privileged roles within the Advanced > Security settings to prevent lower-level users from accessing the vulnerable parameter.

**Name of the Vulnerable Software and Affected Versions** Form Maker by 10Web versions prior to 1.15.47 **Description** Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages by tricking a user into clicking a link, utilizing the `bulk action` parameter. **Recommendations** Update to a version later than 1.15.46. Avoid using the `bulk action` parameter until the update is applied.