Francisco Díaz-Pache Alonso

The issue is related to a directory traversal vulnerability. The `f` parameter is not properly checked in the resource "/m4pdf/pdf.php", allowing an attacker to download any file given its relative path. This could potentially enable an attacker to access sensitive files, such as "/etc/passwd", if they exist on the server.

The M4 PDF plugin for Prestashop sites is vulnerable to an arbitrary HTML Document crafting vulnerability. The resource "/m4pdf/pdf.php" uses templates to dynamically create documents. If the template does not exist, the application returns a fixed document with a message in mpdf format. An attacker could exploit this vulnerability by inputting a valid HTML/CSS document as the value of the `parameter`.

The issue arises from the plugin's failure to properly escape the current page URL before reusing it in an HTML attribute, leading to a reflected cross-site scripting vulnerability.

The Enfold WordPress theme is affected by a Reflected Cross-Site Scripting (XSS) issue. This issue is present in Enfold versions that use Avia Page Builder and are previous to version 4.8.4.