Daroo

The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased plan' parameter in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site owner has previously completed the standard Freemius opt-in flow; once that condition is met, any Subscriber can reach the vulnerable handler simply by loading /wp-admin/profile.php with the requisite query parameters.

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my calendar above=...]` shortcode; `mc generate calendar nav()` then splits the `above` attribute on commas and dispatches each element via `call user func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit user()` — which PHP coerces to integer `1` as the `$user id` argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation.

The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Script Blocking feature to be enabled, and the exploit chain depends on an attacker submitting two coordinated comments — one embedding event-handler syntax inside an allowed <code> element and one placing the deterministic noise restoration key inside an allowed <abbr title=""> attribute — with the key offset confirmable via an unauthenticated wpconsent debug=1 request.

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target site to allow unmoderated comment submission on at least one post and to have a secondary language configured — both conditions reflect TranslatePress's primary use case.

**اسم البرنامج المصاب والإصدارات المتأثرة** Backuply الإصدارات السابقة لـ 1.5.9 **الوصف** يعاني Backuply من ثغرة حقن SQL من الدرجة الثانية تسمح للمستخدمين المصرح لهم، بدءًا من مستوى المشترك فما فوق، بتصعيد الامتيازات والسيطرة الكاملة على الموقع. تحدث المشكلة عندما يضع المستخدم سلسلة نصية مصممة خصيصًا في حقل المعلومات السيرية (Biographical Info) في ملفه الشخصي. وبينما يقوم المكون الإضافي بتصدير هذه القيمة داخل ملف نسخ احتياطي SQL، يتم تفعيل الثغرة أثناء عملية الاستعادة. وتحديدًا، يستخدم المكون الإضافي تعبيرًا نمطيًا غير مثبت (unanchored regular expression) لتحديد بادئات الجداول لا يتجاهل القيم الموجودة بين علامات الاقتباس. إذا كانت المعلومات السيرية تحتوي على السلسلة `backuply version` ، يتم تنفيذ الحمولة المصممة ضمن استعلام `UPDATE` بصلاحيات كاملة على قاعدة البيانات. يسمح هذا الأمر للمهاجمين بتعديل سجلات قاعدة البيانات، مثل تحديث خيار `default role` في `wp options` إلى مسؤول (administrator) وتفعيل التسجيل المفتوح للمستخدمين. ونتيجة لذلك، يتم منح أي حساب يتم تسجيله لاحقًا دور المسؤول تلقائيًا. تؤثر هذه المشكلة على أكثر من 600,000 تثبيت نشط. **التوصيات** تحديث Backuply إلى الإصدار 1.5.9. كإجراء مؤقت، تجنب استعادة أي نسخ احتياطية تم إنشاؤها بينما كان لدى المشتركين إذن بتعديل ملفاتهم الشخصية حتى يتم تطبيق التحديث.

**Name of the Vulnerable Software and Affected Versions** 10Web Booster – Website speed optimization, Cache & Page Speed optimizer versions prior to 2.34.9 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. The issue is triggered via the `author` parameter, where a comment author name containing ` src=` and an event-handler payload can bypass the `sanitize text field` function. The plugin's `str replace()` function then injects a single quote that allows the payload to break out of the attribute context within the alt attribute. **Recommendations** Update 10Web Booster – Website speed optimization, Cache & Page Speed optimizer to version 2.34.9 or later.

**Name of the Vulnerable Software and Affected Versions** Avada | Website Builder For WordPress & WooCommerce versions prior to 7.16.2 **Description** Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages by tricking a user into clicking a link. The issue exists because the `lang` parameter is processed through the `set active language()` function in `Fusion Multilingual` and concatenated into a URL by the `get setting link()` function in `Fusion Settings` without applying `urlencode()`, `esc url()`, or `esc attr()` before being echoed into a double-quoted href attribute in the post editor metabox. **Recommendations** Update Avada | Website Builder For WordPress & WooCommerce to version 7.16.2 or later. As a temporary mitigation, restrict access to the post editor metabox to authorized users only.

**Name of the Vulnerable Software and Affected Versions** Download Manager versions prior to 3.3.71 **Description** The Download Manager plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated users with subscriber-level access or higher can inject arbitrary web scripts through the display name field. This exploitation is possible when the `[wpdm edit profile]` shortcode is present on a front-end page accessible to these users, allowing them to bypass sanitization using a multiply entity-encoded payload. The injected scripts execute whenever a user visits the affected page. **Recommendations** Update Download Manager to version 3.3.71 or later. As a temporary mitigation, remove the `[wpdm edit profile]` shortcode from all front-end pages accessible to Subscriber-level users.

**Name of the Vulnerable Software and Affected Versions** Ninja Forms - File Uploads versions prior to 3.3.35 **Description** An issue exists in the external (Amazon S3) upload flow where the plugin trusts a file path supplied by the user during form submission and stores it as the `file path` variable. This variable is used without validation, allowing unauthenticated attackers to perform arbitrary file operations. Specifically, this can lead to arbitrary file read when a form Email action is configured to attach the uploaded file, arbitrary file write which can result in remote code execution when the external store is configured, and arbitrary file deletion through scheduled cleanup. Exploitation requires the site to have the External File Upload (Amazon S3) action enabled. **Recommendations** Update Ninja Forms - File Uploads to version 3.3.35 or later. As a temporary mitigation, disable the External File Upload (Amazon S3) action.

**Name of the Vulnerable Software and Affected Versions** Kubio AI Page Builder versions prior to 2.9.3 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts via the `comment` parameter. These scripts execute automatically whenever a user accesses the affected page. **Recommendations** Update the plugin to version 2.9.3 or later. As a temporary mitigation, restrict the use of the `comment` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Redux Framework versions prior to 4.5.15 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with Subscriber-level access and above to perform Stored Cross-Site Scripting. Attackers can inject arbitrary web scripts into pages by storing a payload in user meta fields such as the biography, `session tokens` (via a crafted User-Agent at login), or `persisted preferences` (via the REST API). These payloads are promoted to the site-wide `redux demo` option when a media URL repair is triggered on the demo panel via the `user-mediaurl` Media Field. **Recommendations** Update Redux Framework to version 4.5.15 or later.

Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.

**Name of the Vulnerable Software and Affected Versions** Groups – Memberships and Access Control versions prior to 4.6.1 **Description** An issue exists where the `groups join()` function determines group-join eligibility based on the author capabilities of the ambient post via the global `$post->post author` instead of the authenticated user's own capabilities. Because the system returns a valid groups-join-data hash and WordPress nonce in the same response, authorization barriers for self-enrollment are removed. Authenticated attackers with Subscriber-level access or higher can enroll themselves in any group, including those with the `groups admin groups` capability. By creating and joining a group containing all registered WordPress capabilities, an attacker can escalate their privileges to Administrator. This is achieved by providing an Administrator-authored post ID through the `post ID` parameter of the `wp ajax parse media shortcode` handler to establish a privileged context for the authorization check. **Recommendations** Update Groups – Memberships and Access Control to a version newer than 4.6.0.

**Name of the Vulnerable Software and Affected Versions** WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters versions prior to 4.9.9 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. Attackers can inject arbitrary web scripts via the `shapes values` parameter, which execute when a user visits the affected page. The `fc-call-nonce` nonce required by the endpoint is exposed to all frontend visitors through `window.wpgmp local.nonce`, allowing authenticated subscribers to craft valid requests. Furthermore, the secondary ` wpnonce` check in the drawing handler can be bypassed by omitting the ` wpnonce` parameter from the request. **Recommendations** Update to version 4.9.9 or later. Avoid using the `shapes values` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** WP Photo Album Plus versions prior to 9.2.09.003 **Description** Authenticated users with subscriber-level access and above can achieve Remote Code Execution via the `wppa image magick()` function. The issue stems from insufficient sanitization of the multipart upload filename before it is concatenated into an ImageMagick command string executed via `exec()`. While `escapeshellcmd()` is applied to the entire command, it fails to prevent argument injection because spaces still act as argument separators, and the filename sanitization used at the database layer is not applied to the physical temporary file path used during ImageMagick processing. **Recommendations** Update to a version newer than 9.2.09.002. As a temporary mitigation, restrict access to the `wppa image magick()` function for users with subscriber-level permissions.

**Name of the Vulnerable Software and Affected Versions** Jeg Kit for Elementor versions prior to 3.2.17 **Description** Stored Cross-Site Scripting (XSS) occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages via comment content. The scripts execute when a user accesses the affected page. Exploitation requires the targeted post to render a legitimate Jeg Kit Countdown widget, which triggers the countdown frontend script to initialize on matching DOM elements, including forged widget markup stored in comments. **Recommendations** Update Jeg Kit for Elementor to version 3.2.17 or later.

**Name of the Vulnerable Software and Affected Versions** JetFormBuilder versions prior to 3.6.3 **Description** An issue exists where the plugin fails to validate if a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post content as form schema and executing an Advanced Validation server-side callback. This flaw allows unauthenticated attackers to perform privilege escalation by creating a new administrator-level user account. **Recommendations** Update to a version newer than 3.6.2.

**Name of the Vulnerable Software and Affected Versions** AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress versions prior to 11.0.5 **Description** A Directory Traversal issue exists that allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information. This occurs via the `user[name]` parameter. Exploitation is possible only if the Embed images option is enabled in the configuration. **Recommendations** Update to version 11.0.5 or later. Disable the Embed images option in the AcyMailing configuration as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.2.1 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts through the `comment` parameter, which execute when a user accesses the affected page. **Recommendations** Update Kirki – Freeform Page Builder, Website Builder & Customizer to version 6.2.1 or later. As a temporary workaround, restrict the use of the `comment` parameter until the update is applied.