Crow

The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'image hub api keys * (6 options)' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the plaintext API credentials for six third-party services — Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash — emitted verbatim into every admin page's HTML via wp localize script. The leaked page HTML also contains a valid image hub nonce AJAX nonce, which — combined with the absence of any capability check in the image hub update settings AJAX handler — allows the same Subscriber-level attacker to overwrite all six stored API credential options via update option().

The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

**اسم البرنامج المصاب والإصدارات المتأثرة** Meow Lightbox الإصدارات السابقة لـ 5.6.3 **الوصف** يؤدي عدم كفاية تنقية المدخلات ومعالجة المخرجات إلى السماح للمهاجمين المصرح لهم، والذين يمتلكون صلاحيات وصول بمستوى مشترك أو أعلى، بتنفيذ هجوم Stored Cross-Site Scripting. يحدث هذا عبر المعلمتين `display name` و `comment` مما يمكنهم من حقن نصوص برمجية ويب عشوائية يتم تنفيذها عندما يزور المستخدم الصفحة المصابة. هذه الثغرة قابلة للاستغلال فقط عندما يكون خيار Output Buffering مفعلًا، وتتطلب أن يكون لدى المهاجم تعليق واحد معتمد مسبقًا على الموقع لضمان اعتماد التعليقات اللاحقة تلقائيًا بواسطة نواة WordPress. **التوصيات** التحديث إلى إصدار أحدث من 5.6.2. تعطيل خيار Output Buffering للحد من مخاطر الاستغلال.

**اسم البرنامج المصاب والإصدارات المتأثرة** Gallery Custom Links الإصدارات السابقة لـ 2.3.4 **الوصف** يؤدي عدم كفاية تعقيم المدخلات ومعالجة المخرجات إلى السماح للمهاجمين المصرح لهم، ممن لديهم صلاحيات وصول بمستوى مشترك أو أعلى، بتنفيذ هجوم Stored Cross-Site Scripting. يحدث هذا عندما يقدم المهاجم مدخلين منسقين: حمولة تعليق HTML في المعلمة `comment` عبر 'wp-comments-post.php' ومفتاح ضوضاء simple html dom مطابق في المعلمة `display name` عبر 'profile.php'. تتم عملية الاستبدال أثناء تمرير تخزين المخر akhirnya المؤقت الافتراضي للإضافة على الصفحة التي يتم عرضها، مما يسمح بتنفيذ برامج نصية ويب عشوائية عندما يصل المستخدم إلى الصفحة المتأثرة. **التوصيات** التحديث إلى إصدار أحدث من 2.3.3.

**اسم البرنامج المصاب والإصدارات المتأثرة** إضافة Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation لـ WordPress الإصدارات السابقة لـ 2.10.7 **الوصف** توجد ثغرة تصعيد صلاحيات غير مصرح بها تسمح للمهاجمين بالسيطرة الكاملة على حساب المسؤول. تحدث المشكلة لأن الدالة `IntegrationHandler::executeWithCapture()` تقوم بتخزين قيم حقول خام يتحكم بها المهاجم، مثل `user pass` و `user email` في جدول `wp btcbi log.field data` أثناء طلبات الواجهة الأمامية المجهولة دون التحقق من الصلاحيات. لاحقاً، تقوم الدالة `LogHandler::reexecute()` بتمرير هذا الحمولة المخزنة عبر `Flow::execute()` داخل جلسة المسؤول الذي يقوم بإعادة التنفيذ دون التحقق من الهوية التي أنتجت البيانات في الأصل، مما يؤدي بالدالة `RegistrationController::updateUser()` إلى تحديد معرف المستخدم المستهدف على أنه المسؤول وكتابة كلمة المرور التي قدمها المهاجم عبر `wp update user()`. يتطلب الاستغلال أن يكون المسؤول قد قام بتكوين تدفق يربط حقلاً يدخله المستخدم بمعلمة `user pass` لإجراء "Update User" في تسجيل مستخدمي WP، وأن يقوم المسؤول لاحقاً بالنقر على "Re-execute" في صف سجل الفشل الناتج عن الإرسال المجهول من شاشة سجل الإضافة. **التوصيات** تحديث الإضافة إلى إصدار أحدث من 2.10.6.

**اسم البرنامج المصاب والإصدارات المتأثرة** ShopMagic الإصدارات السابقة لـ 4.9.1 **الوصف** توجد ثغرة تضمين ملفات محلية (Local File Inclusion) غير مصرح بها تتيح للمهاجمين تضمين وتنفيذ ملفات .php عشوائية على الخادم. يحدث هذا عبر المعلمة `billing address.first name` مما يسمح بتنفيذ كود PHP أو تجاوز ضوابط الوصول أو الحصول على بيانات حساسة. تكون عملية الاستغلال ممكنة عندما تقوم وصفة منشورة بمعالجة نائب `{{ customer.first name }}`، مثل وصفة "بريد إلكتروني لطلب جديد مع روابط ملفات تعريف التواصل الاجتماعي" الافتراضية، والتي يمكن تفعيلها ببساطة عن طريق إرسال عملية دفع كضيف. **التوصيات** التحديث إلى إصدار أحدث من 4.9.0. تقييد استخدام المعلمة `billing address.first name` في عمليات دفع الضيوف حتى يتم تطبيق التحديث.

**Name of the Vulnerable Software and Affected Versions** FunnelKit – Funnel Builder for WooCommerce Checkout versions prior to 3.16.0.6 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts via the `shipping first name` parameter, which execute when a user accesses the affected page. **Recommendations** Update FunnelKit – Funnel Builder for WooCommerce Checkout to version 3.16.0.6 or later. Avoid using the `shipping first name` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress versions prior to 5.2.13 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. This occurs via the `comment (href attribute inside comment content)` parameter. In the free version, the plugin's author-filter rewriter fails to append the `?m bm=true` marker to its anchors because the `has pro()` function returns false, leaving the `href` attributes fully controlled by the attacker. This enables the injection of arbitrary web scripts that execute when a user visits the affected page. **Recommendations** Update Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress to version 5.2.13 or later.

**Name of the Vulnerable Software and Affected Versions** Simple Newsletter Plugin – Noptin versions prior to 4.3.11 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the `noptin fields[<custom field merge tag>]` parameter (e.g., `first name`) in the public `manage preferences` form. Exploitation requires a published campaign post containing a `[[subscriber.*]]` merge tag. An attacker can submit an entity-encoded payload to the form and then trigger the execution by sending a campaign preview URL containing their `confirm key` to a privileged user through social engineering. **Recommendations** Update to a version newer than 4.3.10.

**Name of the Vulnerable Software and Affected Versions** Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) versions prior to 3.7.2 **Description** Improper authentication allows for account persistence. The `maybe load shared dashboard()` handler issues a genuine WordPress session cookie for the `burst statistics viewer` account to visitors providing a valid share token via `wp set auth cookie()`. Because the plugin does not restrict the `/wp-json/wp/v2/users/me` password update endpoint or filter the `edit user` capability for this account, unauthenticated attackers with a valid `burst share token` can set a custom password for the `burst statistics viewer` account. This results in a permanent takeover of the limited-privilege account that persists even after share-token revocation, expiration, or the execution of the `cleanup viewer sessions()` function. **Recommendations** Update Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) to version 3.7.2 or later.

**Name of the Vulnerable Software and Affected Versions** BA Book Everything versions prior to 1.8.29 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the `booking service qty` parameter. Exploitation is triggered when an administrator or privileged user views the injected order record within the wp-admin order management area during the standard order-review workflow. **Recommendations** Update BA Book Everything to version 1.8.29 or later.

**Name of the Vulnerable Software and Affected Versions** Customer Reviews for WooCommerce versions prior to 5.123.0 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. This occurs when the image attachment feature `ivole attach image` is enabled, allowing attackers to submit a review with an entity-encoded malicious author name and upload an image via the `wp ajax nopriv cr upload local images frontend` endpoint. The injected scripts execute whenever a user accesses the affected page. **Recommendations** Update to a version newer than 5.122.0. As a temporary mitigation, disable the `ivole attach image` image attachment feature.

**Name of the Vulnerable Software and Affected Versions** The Newsletter – Send awesome emails from WordPress versions prior to 9.4.1 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server and executed in the browser of users who visit the affected page. The issue exists in the subscription endpoint 'na=sa', which lacks nonce verification, capability checks, and CAPTCHA. Attackers can bypass email-address validation by embedding the `{profile 1}` placeholder in the local part of the email address, as the `is email()` function permits curly braces. This allows the injection of arbitrary web scripts via the `np1` custom field parameter. **Recommendations** Update The Newsletter – Send awesome emails from WordPress to version 9.4.1 or later. As a temporary mitigation, restrict access to the 'na=sa' subscription endpoint.

**Name of the Vulnerable Software and Affected Versions** Simply Schedule Appointments versions prior to 1.6.12.28 **Description** The Simply Schedule Appointments plugin for WordPress contains a Local File Inclusion flaw. This issue occurs via the `ssa locale` parameter, allowing attackers to include and execute arbitrary .php files on the server. This can lead to the execution of PHP code, bypassing of access controls, or the theft of sensitive data, particularly when .php files can be uploaded. Although described as requiring subscriber-level access, exploitation is possible without authentication because the locale filter is installed on every request during `plugins loaded` and the callback lacks nonce or capability checks before returning the raw GET parameter value. **Recommendations** Update the plugin to a version newer than 1.6.12.27. As a temporary mitigation, restrict or filter the use of the `ssa locale` parameter.

**Name of the Vulnerable Software and Affected Versions** Online Scheduling and Appointment Booking System – Bookly versions prior to 28.3 **Description** An authorization bypass exists due to PHP Type Juggling, a condition where PHP converts a variable from one data type to another during a comparison. The `postValidateCustomer()` function uses a loose inequality operator (`!=`) to compare a session-stored verification code with the `verification code` parameter. Because the `json data` input channel uses `json decode()`, an attacker can submit a boolean `true` value, which satisfies the loose comparison against the non-zero integer code, bypassing the verification guard. This issue is exacerbated by the booking AJAX controller registering methods as `wp ajax nopriv ` handlers and overriding `csrfTokenValid()` to always return true, leaving the endpoint unauthenticated and unprotected against Cross-Site Request Forgery (CSRF). Consequently, unauthenticated attackers can bypass phone or email ownership verification to overwrite the name, email, phone, and address fields of any existing customer record, redirecting booking notifications to their own contact details. **Recommendations** Update Online Scheduling and Appointment Booking System – Bookly to a version newer than 28.2.

**Name of the Vulnerable Software and Affected Versions** HUSKY – Products Filter for WooCommerce Professional versions prior to 1.4.5 **Description** The plugin is subject to Local File Inclusion, a condition where an application includes files from the local file system without proper validation. Unauthenticated attackers can exploit this via the `shortcode` parameter to include and execute arbitrary .php files on the server. This can lead to the execution of PHP code, bypassing of access controls, or the theft of sensitive data. The issue exists because the access control relies on a nonce check against `woof front nonce`, which is publicly exposed in inline JavaScript on all front-end pages, making it accessible to any visitor. **Recommendations** Update to a version newer than 1.4.4. Restrict the use of the `shortcode` parameter until the update is applied.

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is a regression: the esc url() wrapper that remediated the equivalent CVE-2023-5749 in version 3.9.2 was removed in version 4.3.0 during a refactor that introduced the 'unique' parameter.