David Álvarez Robles

The issue is related to a directory traversal vulnerability. The `f` parameter is not properly checked in the resource "/m4pdf/pdf.php", allowing an attacker to download any file given its relative path. This could potentially enable an attacker to access sensitive files, such as "/etc/passwd", if they exist on the server.

The M4 PDF plugin for Prestashop sites is vulnerable to an arbitrary HTML Document crafting vulnerability. The resource "/m4pdf/pdf.php" uses templates to dynamically create documents. If the template does not exist, the application returns a fixed document with a message in mpdf format. An attacker could exploit this vulnerability by inputting a valid HTML/CSS document as the value of the `parameter`.

The issue allows an attacker to interact with the database, potentially enabling them to read, modify, and delete data, due to the use of concatenation in constructing SQL queries.

The issue arises from the plugin's failure to properly escape the current page URL before reusing it in an HTML attribute, leading to a reflected cross-site scripting vulnerability.

The Enfold WordPress theme is affected by a Reflected Cross-Site Scripting (XSS) issue. This issue is present in Enfold versions that use Avia Page Builder and are previous to version 4.8.4.