Dmitry Ignatyev

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

**Name of the Vulnerable Software and Affected Versions** Twenty20 Image Before-After versions prior to 2.0.6 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the `offset` shortcode attribute, which execute when a user visits the affected page. **Recommendations** Update the plugin to version 2.0.6 or later.

**Name of the Vulnerable Software and Affected Versions** Giveaways and Contests by RafflePress versions prior to 1.12.27 **Description** The plugin fails to remove the reCAPTCHA secret key from the giveaway settings embedded in public giveaway pages. This allows unauthenticated visitors to retrieve the secret key of any active giveaway that has reCAPTCHA configured. **Recommendations** Update Giveaways and Contests by RafflePress to version 1.12.27 or later.

**Name of the Vulnerable Software and Affected Versions** Hostinger Reach WordPress plugin versions prior to 1.8.3 **Description** Insufficient sanitization and escaping of a widget setting before it is output in the editor preview allows users with contributor-level access and above to perform a stored cross-site scripting attack. This occurs when a higher-privileged user opens the affected content in the editor, causing the injected arbitrary web scripts to execute within their session. **Recommendations** Update Hostinger Reach WordPress plugin to version 1.8.3 or later.

**Name of the Vulnerable Software and Affected Versions** NextScripts: Social Networks Auto-Poster WordPress plugin versions prior to 4.4.8 **Description** The plugin fails to perform capability or ownership checks on several AJAX actions, relying solely on a nonce. This allows users who have been granted access to posting features by an administrator to export configured social account credentials, delete arbitrary posts, and reset the plugin configuration. **Recommendations** Update NextScripts: Social Networks Auto-Poster WordPress plugin to version 4.4.8 or later.

**Name of the Vulnerable Software and Affected Versions** WP YouTube Lyte WordPress plugin versions prior to 1.7.31 **Description** Insufficient escaping of attributes within YouTube embed blocks occurs during the rendering process when they are outputted into an HTML attribute. This flaw allows users with contributor-level permissions to execute Stored Cross-Site Scripting (XSS) attacks, a technique where malicious scripts are permanently stored on the target server and served to other users. **Recommendations** Update the plugin to version 1.7.31 or later.

**Name of the Vulnerable Software and Affected Versions** PowerPress Podcasting versions prior to 11.17.2 **Description** Insufficient sanitization and escaping of a block attribute before it is output on a page allows users with the contributor role and above to execute Stored Cross-Site Scripting attacks. Stored Cross-Site Scripting is a type of attack where malicious scripts are permanently stored on the target server. **Recommendations** Update to version 11.17.2 or later.

**Name of the Vulnerable Software and Affected Versions** Optimole WordPress plugin versions prior to 4.2.13 **Description** The plugin fails to escape unrecognized attributes within its video-player block before rendering them onto the block's wrapper element. This allows users with the Author role or higher to inject an event-handler attribute, enabling the execution of arbitrary scripts in the browser of any user, including administrators, who views the affected post. **Recommendations** Update the Optimole WordPress plugin to version 4.2.13 or later.

**Name of the Vulnerable Software and Affected Versions** Gutenverse versions prior to 4.0.9 **Description** The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress contains a Stored Cross-Site Scripting issue. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages via the `suffixMain` attribute of the Post Comment Block. This occurs because of insufficient input sanitization and output escaping. The issue persists despite WordPress core `wp kses post` sanitization because the payload is stored within a Gutenberg block delimiter comment and is only rendered as exploitable HTML during the PHP render stage. **Recommendations** Update the plugin to version 4.0.9 or later.

**Name of the Vulnerable Software and Affected Versions** Custom Field Template versions prior to 2.7.9 **Description** The plugin contains an Insecure Direct Object Reference (IDOR) flaw, which occurs when an application provides direct access to objects based on user-supplied input. The issue exists in the `edit meta value` function due to missing validation on a user-controlled key. Authenticated attackers with contributor-level access or higher can delete arbitrary media attachments across the site by providing a numeric attachment ID in the `file-field` parameter along with a delete flag. This can lead to content loss and broken pages. This is possible when the attacker's post is managed by a template containing a file-type field where the `mediaRemove` option is disabled, which is the default setting. **Recommendations** Update the plugin to a version newer than 2.7.8. As a temporary mitigation, restrict contributor-level access to posts governed by Custom Field Templates containing file-type fields.

**Name of the Vulnerable Software and Affected Versions** Pochipp versions prior to 1.20.3 **Description** The plugin is subject to Reflected Cross-Site Scripting, a flaw where an application includes untrusted data in a web page without proper validation or escaping. This occurs because the application reads the `keyword` parameter from the `$ GET` array and applies `sanitize text field()`, which removes HTML tags but preserves double quotes. The value is then inserted into the value attribute of a search input using a PHP heredoc without the use of `esc attr()`. Unauthenticated attackers can exploit this by tricking a user with `upload files` capabilities (Author level or higher) into clicking a crafted link to the '/wp-admin/media-upload' endpoint, allowing the execution of arbitrary web scripts. **Recommendations** Update to a version newer than 1.20.2. Avoid using the `keyword` parameter in the '/wp-admin/media-upload' endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Master Addons for Elementor versions prior to 3.2.3 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level access or higher can modify the title and metadata of arbitrary WordPress posts or permanently delete them. This is achieved by providing a controlled `popup id` variable. The necessary nonce is available on the edit-jltma popup admin screen, which is accessible to contributors because the `jltma popup` custom post type is registered with `capability type='post'`. **Recommendations** Update the plugin to a version newer than 3.2.2.

**Name of the Vulnerable Software and Affected Versions** Xpro Addons — 140+ Widgets for Elementor WordPress plugin versions prior to 1.7.9 **Description** The plugin fails to validate or sanitize a widget link setting before it is stored and subsequently used in a JavaScript navigation call. This allows users with the contributor role or higher to perform a stored cross-site scripting attack by injecting JavaScript that executes in the browser of any user who interacts with the affected widget. **Recommendations** Update Xpro Addons — 140+ Widgets for Elementor WordPress plugin to version 1.7.9 or later.

**اسم البرنامج المصاب والإصدارات المتأثرة** Translate WordPress with GTranslate الإصدارات السابقة لـ 3.0.10 **Description** يؤدي عدم التحقق الكافي من إعداد معين إلى السماح للمستخدمين الذين يمتلكون صلاحيات المسؤول بتخزين JavaScript. يتم تنفيذ هذا السكريبت ضمن جلسة أي زائر للموقع عندما تقوم نصوص front-end المرفقة ببناء العلامات (markup) بناءً على الإعداد المتأثر. **Recommendations** التحديث إلى الإصدار 3.0.10 أو إصدار أحدث.

The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

**Name of the Vulnerable Software and Affected Versions** Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE versions prior to 3.1.8 **Description** An Insecure Direct Object Reference (IDOR) exists in the `watch checkout()` function due to missing validation on a user-controlled key. This allows unauthenticated attackers to obtain entitlement for a premium product while paying for a lower-cost one by manipulating the `product id` parameter independently of the `price id` parameter within the Stripe checkout URL. **Recommendations** Update the plugin to version 3.1.8 or later.

**Name of the Vulnerable Software and Affected Versions** Xpro Addons versions prior to 1.7.4 **Description** The plugin fails to properly escape settings for several widgets before they are rendered within HTML attributes. This flaw allows users with the Contributor role or higher to execute Stored Cross-Site Scripting (XSS) attacks, which occur when a malicious script is permanently stored on the target server and served to other users. **Recommendations** Update to version 1.7.4 or later.

**Name of the Vulnerable Software and Affected Versions** The Ultimate Before After Image Slider & Gallery versions prior to 4.7.19 **Description** The plugin fails to properly escape the `before-label` value of the slider. This allows users with the Author role or higher to store a malicious payload that is subsequently re-injected into the Document Object Model (DOM) by a bundled client-side script. This results in the execution of the payload in the browser of any user, including administrators, who views the slider. **Recommendations** Update The Ultimate Before After Image Slider & Gallery to version 4.7.19 or later.

The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks.

**Name of the Vulnerable Software and Affected Versions** Smart Slider 3 versions prior to 3.5.1.39 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the `slider` block attribute. The scripts execute when a user, specifically Editors or Administrators, opens the affected post within the WordPress block editor. **Recommendations** Update Smart Slider 3 to version 3.5.1.39 or later.