Ivaylo

**اسم البرنامج المصاب والإصدارات المتأثرة** AcyMailing الإصدارات السابقة لـ 11.1.1 **الوصف** يحدث ثغرة Cross-Site Scripting مخزنة عبر المعلمة `customField[]` في نقطة النهاية 'frontusers::subscribe'. ينبع هذا الخلل من عدم كفاية تنقية المدخلات في الدالة `acym cleanVar()`، حيث يقوم برنامج إزالة وسوم HTML بمطابقة الوسوم الكاملة فقط. بالإضافة إلى ذلك، تقوم الدالة `SubscriberInsertion::replaceUserInformation()` وقالب عرض الأرشيف باستبدال قيمة حقل المشترك المخزنة في جسم البريد وإرسالها بدون ترميز HTML. يتيح ذلك للمهاجمين غير المصرح لهم حقن برمجيات ويب عشوائية يتم تنفيذها عندما يصل المستخدم، بما في ذلك المسؤولون الذين ينقرون على الرابط في شاشة سجل المشتركين، إلى رابط الأرشيف عبر الإنترنت للمشترك المتضرر. **التوصيات** التحديث إلى إصدار أحدث من 11.1.0. تقييد الوصول إلى نقطة النهاية 'frontusers::subscribe' أو تجنب استخدام المعلمة `customField[]` حتى يتم تطبيق التحديث.

**Name of the Vulnerable Software and Affected Versions** Advanced Classifieds & Directory Pro versions prior to 3.4.5 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with custom-level access or higher can inject arbitrary web scripts via the `phone` parameter. These scripts execute when a user visits the affected page. Exploitation requires the `acadp misc settings['force bootstrap']` setting to be enabled and the 'ACADP Listing Address' widget to be active on a sidebar of single listing pages. **Recommendations** Update Advanced Classifieds & Directory Pro to version 3.4.5 or later. Disable the `acadp misc settings['force bootstrap']` setting as a temporary mitigation. Remove the 'ACADP Listing Address' widget from sidebars on single listing pages to minimize risk.

**Name of the Vulnerable Software and Affected Versions** Podlove Podcast Publisher versions prior to 4.5.7 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. This occurs when a request is sent to the Auphonic webhook endpoint with a POST body where the `status string` field is not equal to 'Done'. This action causes the raw POST superglobal to be stored in the plugin log before authentication key validation, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page. **Recommendations** Update to a version newer than 4.5.6. Restrict access to the Auphonic webhook endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Photo Reviews for WooCommerce versions prior to 1.2.31 **Description** An issue allows unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media attachments. The flaw occurs because the plugin stores attacker-controlled post IDs from the `wcpr image upload id` parameter of a public review submission into the review's reviews-images comment meta without verifying ownership. When an administrator deletes the review, or when the `wp scheduled delete` cron task empties the comment trash, the `delete reviews image()` function calls `wp delete post( $id, true )` on every stored ID, leading to the deletion of the specified content. **Recommendations** Update Photo Reviews for WooCommerce to version 1.2.31 or later.

**Name of the Vulnerable Software and Affected Versions** CMB2 versions prior to 2.13.1 **Description** The CMB2 plugin for WordPress contains a Stored Cross-Site Scripting issue due to insufficient input sanitization and output escaping within the `file list` field type. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user accesses the affected page. This issue is only exploitable if an integrating plugin or theme registers a `file list` field on a user meta box or a publicly accessible front-end form, as the library does not expose these fields by default. **Recommendations** Update to a version newer than 2.13.0. As a temporary mitigation, restrict the use of the `file list` field type on publicly accessible front-end forms or user meta boxes.

**Name of the Vulnerable Software and Affected Versions** wpForo Forum versions prior to 3.1.7 **Description** Stored Cross-Site Scripting occurs via the 'telegram' profile field due to insufficient input sanitization and output escaping in the `profile update` action. The raw `$ POST['data']` array is copied into a `$custom fields` variable before the `validate()` and `sanitize()` functions are executed; since these functions only operate on a parallel `$user` reference, `$custom fields` remains unsanitized when saved via `update custom fields()`. During rendering, `wpforo decode()` reverses entity encoding, and the value is echoed without escaping in `field wrap profile()`. This allows authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts that execute when a user visits the affected page. **Recommendations** Update to a version newer than 3.1.6. As a temporary mitigation, restrict the use of the 'telegram' profile field until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots versions prior to 3.0.5 **Description** An issue exists where authenticated users with subscriber-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of the user-supplied `group id` parameter and a lack of proper preparation of the SQL query. This allows attackers to append additional SQL queries to extract sensitive information from the database. Exploitation is possible if the BuddyBoss Platform plugin is installed and its Social Groups component is disabled, as the `wp bp groups` table remains in the database after deactivation. **Recommendations** Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to version 3.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** WP Yelp Review Slider versions prior to 9.3 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. The issue occurs when the plugin imports Yelp review text via the `wpyelp download source` function. A malicious payload can be created by an anonymous reviewer on the public Yelp platform and is subsequently introduced into the WordPress database when a site administrator uses the Download Reviews feature. This allows the execution of arbitrary web scripts in the browsers of users who access the affected pages. **Recommendations** Update WP Yelp Review Slider to version 9.3 or later.

**Name of the Vulnerable Software and Affected Versions** WPBot – AI ChatBot for Live Support, Lead Generation, AI Services versions prior to 8.7.4 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the `conversation` parameter. Because the nonce used for validation is localized into every public-facing page via `wp localize script`, it fails to act as an effective access control barrier, allowing the injected scripts to execute when a user accesses the affected page. **Recommendations** Update WPBot – AI ChatBot for Live Support, Lead Generation, AI Services to version 8.7.4 or later. Avoid using the `conversation` parameter until the plugin is updated.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** Invisible Anti-Spam & CAPTCHA — بديل reCAPTCHA لجميع النماذج، الإصدارات السابقة للإصدار 5.2 **الوصف** يؤدي عدم كفاية تنقية المدخلات وتهريب المخرجات إلى السماح للمهاجمين غير المصادق عليهم بتنفيذ هجمات «البرمجة النصية عبر المواقع المخزنة» (XSS)، وهي تقنية يتم فيها تخزين البرامج النصية الخبيثة بشكل دائم على الخادم المستهدف. تحدث المشكلة عبر المعلمة `action` في نقطة النهاية `admin-ajax.php`. يمكن للمهاجم حقن نصوص برمجية ويب عشوائية عن طريق إرسال طلب تكون فيه قيمة `action` مطابقة لإدخال في قائمة الإجراءات الصريحة للمكوّن الإضافي، والتي يتم ملؤها تلقائيًا لمنشئي النماذج الشائعة أثناء التنشيط وتفتقر إلى متطلبات المصادقة للوصول إلى مسار الحفظ. يتم تنفيذ هذه النصوص البرمجية كلما قام مستخدم بالوصول إلى الصفحة المتأثرة. **التوصيات** قم بالتحديث إلى إصدار أحدث من 5.1.