Eunho Kim

The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permission callback => ' return true', and the handler at PopupNotification::handle popup submission() accepts an attacker-controlled nx id, loads whichever NotificationX campaign that id points to, and copies that campaign's own source into the new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup (the two sources this form is intended to serve). This makes it possible for unauthenticated attackers to inject forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign — WP Comments, WooCommerce/EDD/Give sales, reviews, etc.

**Name of the Vulnerable Software and Affected Versions** WP Ultimate Review versions prior to 2.4.4 **Description** Authenticated users with subscriber-level access and above can execute arbitrary shortcodes. This occurs because the software fails to properly validate a value before executing the `do shortcode()` function. The issue is triggered when the `strip shortcodes()` function unwraps double-bracket escapes, allowing a shortcode to persist in the `wp insert post` storage and execute when the `xs review` post type is rendered via `the content`. **Recommendations** Update WP Ultimate Review to version 2.4.4 or later.

**Name of the Vulnerable Software and Affected Versions** Redux Framework versions prior to 4.5.15 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can delete arbitrary media library attachments, including files owned by administrators. This occurs when a Custom Fonts field is registered on the user profile page via the `set profile()` function in `Redux Users`, which causes the `redux custom fonts` nonce to be rendered on the `wp-admin/profile.php` page. **Recommendations** Update Redux Framework to version 4.5.15 or later.

**Name of the Vulnerable Software and Affected Versions** Tutor LMS versions prior to 4.0.9 **Description** The Tutor LMS plugin for WordPress contains an authorization bypass that allows authenticated users with subscriber-level access or higher to permanently delete arbitrary WordPress posts, such as pages, courses, quizzes, and WooCommerce products. This occurs because the plugin fails to properly verify if a user is authorized to perform the deletion action via the `wp delete post()` function. The exploitation process involves triggering the profile-photo upload flow to obtain an authored attachment row, creating a Tutor topic linked to that attachment, and then calling the lesson deletion handler using a target post ID through the `lesson id` parameter. **Recommendations** Update the plugin to version 4.0.9 or later.

Name of the Vulnerable Software and Affected Versions: CM Pop-Up Banners for WordPress versions prior to 1.7.3 Description: The issue allows high privilege users, such as Contributors, to perform Cross-Site Scripting attacks due to the plugin not sanitising and escaping some of its popup fields. Recommendations: For versions prior to 1.7.3, update to version 1.7.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Watu Quiz WordPress plugin versions prior to 3.4.1.2 **Description** The issue allows users, such as authors authorized by admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, due to the plugin not sanitizing and escaping some of its settings. **Recommendations** For versions prior to 3.4.1.2, update to version 3.4.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Popup Builder WordPress plugin versions prior to 1.1.33 **Description** The issue concerns the Popup Builder WordPress plugin, where certain Notification fields are not properly sanitised and escaped. This could allow users with contributor or higher permissions to perform Stored Cross-Site Scripting attacks. **Recommendations** For versions prior to 1.1.33, update to version 1.1.33 or later to resolve the issue. As a temporary workaround, consider restricting access to the Notification fields in the plugin to minimize the risk of exploitation.