Erwan Lr

The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks on installs where the payment key has not been configured.

The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network administrators, allowing an administrator of a single site on a multisite network to change it for the entire network.

**اسم البرنامج المصاب والإصدارات المتأثرة** إضافة click5 CRM لـ Ninja Forms WordPress الإصدارات السابقة لـ 1.0.2 **الوصف** يفشل نقطة نهاية (endpoint) غير مصادق عليها في تنقية وتعقيم المحتوى المرسل قبل عرضه في صفحة المسؤول. يؤدي ذلك إلى حدوث ثغرة Cross-Site Scripting (XSS) مخزنة، وهي حالة يتم فيها تخزين النصوص البرمجية الخبيثة بشكل دائم على الخادم وتنفيذها في متصفح المستخدمين ذوي الصلاحيات العالية، مثل المسؤولين. **التوصيات** تحديث إضافة click5 CRM لـ Ninja Forms WordPress إلى الإصدار 1.0.2 أو إصدار أحدث.

**اسم البرنامج المصاب والإصدارات المتأثرة** إضافة click5 CRM لـ Gravity Forms WordPress الإصدارات السابقة لـ 1.0.4 **الوصف** يفشل نقطة نهاية (endpoint) غير مصادق عليها في تنقية وتعقيم المحتوى المرسل قبل عرضه في صفحة المسؤول. يؤدي ذلك إلى حدوث ثغرة Cross-Site Scripting (XSS) مخزنة، وهي حالة يتم فيها تخزين النصوص البرمجية الخبيثة بشكل دائم على الخادم وتنفيذها في متصفح المستخدمين ذوي الصلاحيات العالية، مثل المسؤولين. **التوصيات** تحديث إضافة click5 CRM لـ Gravity Forms WordPress إلى الإصدار 1.0.4 أو إصدار أحدث.

**اسم البرنامج المصاب والإصدارات المتأثرة** إضافة click5 CRM لـ WPForms WordPress plugin الإصدارات السابقة لـ 1.0.4 **الوصف** يفشل نقطة نهاية (endpoint) غير مصادق عليها في تنقية وتعقيم المحتوى المرسل قبل عرضه في صفحة المسؤول. يؤدي ذلك إلى حدوث ثغرة Cross-Site Scripting (XSS) مخزنة، وهي حالة يتم فيها تخزين النصوص البرمجية الخبيثة بشكل دائم على الخادم وتنفيذها في متصفح المستخدمين ذوي الصلاحيات العالية، مثل المسؤولين. **التوصيات** تحديث إضافة click5 CRM لـ WPForms WordPress plugin إلى الإصدار 1.0.4 أو إصدار أحدث.

**اسم البرنامج المصاب والإصدارات المتأثرة** إضافة paymendo لـ WordPress الإصدارات السابقة لـ 1.2 **الوصف** تفشل الإضافة في تنقية وتعقيم المعلمة `orderBy` بشكل صحيح قبل استخدامها في استعلام SQL. يسمح هذا الخلل للمستخدمين المصرح لهم بتنفيذ هجمات حقن SQL، والتي تتضمن إدخال كود SQL خبيث في الاستعلام للتلاعب بقاعدة البيانات. **التوصيات** تحديث إضافة paymendo لـ WordPress إلى إصدار أحدث من 1.1. كإجراء مؤقت، قم بتقييد الوصول إلى الوظيفة التي تستخدم المعلمة `orderBy` لتقليل مخاطر الاستغلال.

**اسم البرنامج المصاب والإصدارات المتأثرة** إضافة click5 CRM لـ Contact Form 7 WordPress الإصدارات السابقة لـ 1.0.5 **الوصف** يفشل نقطة نهاية (endpoint) غير مصادق عليها في تعقيم وتطهير المحتوى المرسل قبل عرضه في صفحة المسؤول. يؤدي ذلك إلى حدوث ثغرة Cross-Site Scripting (XSS) مخزنة، وهي حالة يتم فيها تخزين النصوص البرمجية الخبيثة بشكل دائم على الخادم وتنفيذها في متصفح المستخدمين ذوي الصلاحيات العالية، مثل المسؤولين. **التوصيات** تحديث إضافة click5 CRM لـ Contact Form 7 WordPress إلى الإصدار 1.0.5 أو إصدار أحدث.

**Name of the Vulnerable Software and Affected Versions** Ultimate Multisite WordPress plugin versions prior to 2.17.0 **Description** An authentication bypass exists where a logged-out checkout can be linked to and logged in as an existing WordPress account matching the submitted email address. This occurs because the duplicate-account check normalizes the email address differently than the lookup used to create the customer. An unauthenticated attacker can exploit this to log in as any existing user, including a Network Super Admin, provided they know the user's email address. This issue requires a checkout form configured without a password field (using auto-generated passwords) and a target account that lacks an existing customer record within the plugin. **Recommendations** Update Ultimate Multisite WordPress plugin to version 2.17.0 or later.

**Name of the Vulnerable Software and Affected Versions** Magee Shortcodes WordPress plugin versions prior to 2.1.2 **Description** The plugin fails to restrict the recipient of certain unauthenticated contact-form actions. This allows unauthenticated users to perform a mail relay, sending arbitrary emails to any specified address through the website. **Recommendations** Update the plugin to version 2.1.2 or later.

**Name of the Vulnerable Software and Affected Versions** File Uploads Addon for WooCommerce WordPress plugin versions prior to 1.7.6 **Description** An issue exists where the plugin fails to verify if the user requesting a customer-uploaded file is the original uploader. This allows unauthenticated attackers to download files uploaded by other customers if they can determine or guess the file name. **Recommendations** Update the File Uploads Addon for WooCommerce WordPress plugin to version 1.7.6 or later.

**Name of the Vulnerable Software and Affected Versions** WP User Frontend WordPress plugin versions prior to 4.3.12 **Description** A flaw in a post-creation handler fails to enforce subscription-purchase requirements. This allows authenticated users with subscriber-level access or higher to create and potentially publish posts using forms that should be restricted to paying subscribers, depending on the specific form configuration. **Recommendations** Update the plugin to version 4.3.12 or later.

**Name of the Vulnerable Software and Affected Versions** Paytm Payment Gateway WordPress plugin versions prior to 2.8.9 **Description** Unauthenticated users can perform SQL injection attacks because the plugin fails to properly escape data received from payment callbacks before incorporating it into a SQL statement. Additionally, the integrity check for these callbacks can be forged if the gateway is enabled without credentials. **Recommendations** Update the plugin to version 2.8.9 or later.

**Name of the Vulnerable Software and Affected Versions** All in One Files Upload WordPress plugin versions prior to 2.0.17 **Description** Insufficient capability checks and a lack of request authenticity verification occur when saving settings. This allows any authenticated user, including those with subscriber-level privileges, to modify the plugin settings. **Recommendations** Update All in One Files Upload WordPress plugin to version 2.0.17 or later.

**Name of the Vulnerable Software and Affected Versions** Solace Extra WordPress plugin versions prior to 1.7.2 **Description** Insufficient authorization and post-status checks on front-end preview routes allow unauthenticated visitors to read the rendered content of non-published posts and pages of any type that would otherwise be restricted by WordPress. **Recommendations** Update Solace Extra WordPress plugin to version 1.7.2 or later.

**Name of the Vulnerable Software and Affected Versions** Post Voting System WordPress plugin version 1.0 **Description** An issue exists where the software fails to properly sanitize and escape a parameter before incorporating it into a SQL query. This allows authenticated users to execute SQL injection attacks, which involve inserting malicious SQL code into a query to manipulate the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** wp-review-slider-pro versions prior to 12.7.12 **Description** The plugin fails to perform a capability check on the AJAX handler used to save review submission forms. Additionally, the nonce (a unique token used to prevent replay attacks) is generated for every visitor. This allows any authenticated user, including those with subscriber-level privileges, to overwrite a live form with field values. Because these values are output on public pages without proper escaping, it leads to Stored Cross-Site Scripting (XSS), where malicious scripts are permanently stored on the server and executed in the browsers of other users. **Recommendations** Update wp-review-slider-pro to version 12.7.12 or later.

**Name of the Vulnerable Software and Affected Versions** wp-review-slider-pro versions prior to 12.7.12 **Description** An issue exists where a value stored through an AJAX handler is not sanitized before being used in a SQL statement. The handler also lacks a capability check, which allows any authenticated user, including those with subscriber-level privileges, to execute SQL injection attacks. The results of these attacks are subsequently displayed to unauthenticated visitors. **Recommendations** Update wp-review-slider-pro to version 12.7.12 or later.

**Name of the Vulnerable Software and Affected Versions** wp-review-slider-pro versions prior to 12.7.12 **Description** An issue exists where an AJAX handler fails to perform a capability check. Because the nonce protecting this handler is generated for every visitor, any authenticated user, including those with subscriber privileges, can store arbitrary review content. This content is subsequently rendered on public pages without proper escaping, resulting in Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server and executed in the browsers of other users. **Recommendations** Update wp-review-slider-pro to version 12.7.12 or later.

**Name of the Vulnerable Software and Affected Versions** zportals WordPress plugin versions prior to 6.4.2 **Description** The plugin fails to perform capability or nonce checks on an AJAX action. This allows users with subscriber-level accounts to disclose the display name and email address of all registered users, including those with administrator privileges. A nonce is a unique token used to protect against cross-site request forgery. **Recommendations** Update the zportals WordPress plugin to version 6.4.2 or later.

**Name of the Vulnerable Software and Affected Versions** zportals WordPress plugin versions prior to 6.4.2 **Description** The plugin fails to perform capability or nonce checks on several AJAX actions. This allows users with subscriber-level accounts to modify stored integration settings. A nonce is a unique token used to protect against cross-site request forgery (CSRF) by ensuring that a request was intentionally sent by the user. **Recommendations** Update zportals WordPress plugin to version 6.4.2 or later.