Karthik Ramakrishnan

The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server's fetch reveals whether an internal resource responds and its HTTP status, but the resource's contents are not returned to the attacker.

**اسم البرنامج المصاب والإصدارات المتأثرة** إضافة Dokan: AI Powered WooCommerce Multivendor Marketplace Solution لـ WordPress الإصدارات السابقة لـ 5.2.0 **الوصف** تفشل الإضافة في التحقق مما إذا كان البائع الذي يطلب حساب العمولات هو نفسه البائع الذي يتم طلب الحساب له. يسمح هذا للبائعين بالكشف عن معدل العمولات والرسوم الثابتة التي حددها مدير السوق لبائعين آخرين. **التوصيات** تحديث الإضافة إلى الإصدار 5.2.0 أو إصدار أحدث.

**اسم البرنامج المصاب والإصدارات المتأثرة** إضافة Envira Gallery لـ WordPress الإصدارات السابقة لـ 1.16.2 **Description** تفشل الإضافة في التحقق مما إذا كان المستخدم يمتلك صلاحيات التثبيت المطلوبة قبل معالجة طلب تثبيت معالج الإعداد. بالإضافة إلى ذلك، فإنها لا تقيد عمليات التثبيت بقائمة منسقة. يسمح هذا لمسؤول الموقع الفرعي في شبكة Multisite بتثبيت أي إضافة منشورة على WordPress.org في الدليل المشترك للشبكة، وهي ميزة مخصصة عادةً للمسؤول العام للشبكة (Super Admin). **Recommendations** تحديث إضافة Envira Gallery لـ WordPress إلى الإصدار 1.16.2 أو إصدار أحدث.

**اسم البرنامج المتأثر والإصدارات المتأثرة** إضافة Envira Gallery لـ WordPress الإصدارات السابقة لـ 1.16.2 **Description** تؤدي عمليات التحقق غير الكافية من التصريح في ميزة تحويل المعرض (gallery-conversion) إلى السماح للمستخدمين الذين لديهم صلاحيات بمستوى مساهم بإنشاء ونشر منشورات المعرض. يقوم النظام بالتحقق بشكل خاطئ مما إذا كان مقدم الطلب يمكنه تحرير منشور عشوائي مسمى بدلاً من التأكد من امتلاكه صلاحية إنشاء محتوى المعرض، مما يتجاوز إعدادات الإضافة المحددة. **Recommendations** تحديث إضافة Envira Gallery لـ WordPress إلى الإصدار 1.16.2 أو إصدار أحدث.

**اسم البرنامج المصاب والإصدارات المتأثرة** Envira Gallery الإصدارات السابقة لـ 1.16.2 **الوصف** يؤدي عدم التحقق الكافي من معرفات الصور داخل الإضافة إلى السماح للمستخدمين الذين لديهم القدرة على إنشاء وتحرير المعارض (عادةً دور المؤلف فما فوق) بالوصول إلى معلومات غير مسموح لهم برؤيتها. من خلال إضافة معرف صورة معين إلى المعرض، يمكن للمهاجم الكشف عن عنوان ومقتطف من منشورات المستخدمين الآخرين الخاصة أو المسودات أو المعلقة أو الموجودة في سلة المهملات. **التوصيات** تحديث Envira Gallery إلى الإصدار 1.16.2 أو إصدار أحدث.

**Name of the Vulnerable Software and Affected Versions** Rank Math SEO versions prior to 1.0.280 **Description** Insufficient sanitization and escaping of a parameter used in a SQL query allows high-privilege users, such as administrators, to perform SQL injection attacks. This occurs via the `per page` parameter. **Recommendations** Update Rank Math SEO to version 1.0.280 or later.

**Name of the Vulnerable Software and Affected Versions** Rank Math SEO versions prior to 1.0.280 **Description** The settings import feature fails to correctly validate the type of uploaded files. This allows users with administrator-level access to upload a PHP file, which can lead to remote code execution (RCE), a process where an attacker executes arbitrary code on the server. **Recommendations** Update Rank Math SEO to version 1.0.280 or later.

**Name of the Vulnerable Software and Affected Versions** W3 Total Cache versions prior to 2.10.6 **Description** The plugin fails to confine media-import file copies to the document root and does not enforce effective file-type restrictions. This allows users with the Author role or higher to plant content that, when processed by an administrator during an import, copies an arbitrary server-readable file into a publicly served directory, making it accessible for unauthenticated retrieval. This issue involves a path traversal, which occurs when an application uses user-supplied input to construct a pathname that includes characters like "../" to access files outside the intended directory. **Recommendations** Update W3 Total Cache to version 2.10.6 or later.

**Name of the Vulnerable Software and Affected Versions** Rank Math SEO versions prior to 1.0.280 **Description** The plugin fails to escape a stored redirection source value before outputting it in an administrative list view. This allows users with redirection management privileges, such as Administrators, to store JavaScript that executes in the session of any user who accesses that view, including Super Administrators on multisite installations. This is a Stored Cross-Site Scripting (XSS) issue, where malicious scripts are permanently stored on the server and served to other users. **Recommendations** Update Rank Math SEO to version 1.0.280 or later.

**Name of the Vulnerable Software and Affected Versions** Kirki WordPress plugin versions prior to 6.3.2 **Description** The plugin fails to prevent the execution of shortcodes contained within comments during rendering. Additionally, it displays comments regardless of their moderation status. This allows unauthenticated visitors to execute shortcodes registered on the site and access private custom fields of the page being viewed. **Recommendations** Update the Kirki WordPress plugin to version 6.3.2 or later.

**Name of the Vulnerable Software and Affected Versions** Image Photo Gallery Final Tiles Grid versions prior to 3.6.14 **Description** Insufficient sanitization of gallery configuration values that can be overridden via the gallery shortcode allows users with contributor-level access and above to perform a Stored Cross-Site Scripting (XSS) attack. This occurs when the values are printed into an inline script block, enabling the injection of arbitrary JavaScript. The script executes in the session of any user viewing the post, including administrators previewing pending submissions. This issue does not require gallery ownership, as any existing gallery on the site can be referenced. **Recommendations** Update Image Photo Gallery Final Tiles Grid to version 3.6.14 or later.

The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.

**Name of the Vulnerable Software and Affected Versions** Envira Gallery WordPress plugin versions prior to 1.16.1 **Description** Insufficient sanitization and escaping of user-supplied gallery display configuration values before they are stored and outputted in an image tag attribute. This allows users with the Author role and above to perform a Cross-Site Scripting (XSS) attack—a technique where malicious scripts are injected into trusted websites—which execute when any visitor, including an administrator, views a page containing the affected gallery. **Recommendations** Update the Envira Gallery WordPress plugin to version 1.16.1 or later.

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on a multisite network, files belonging to a different site they have no access to.

**Name of the Vulnerable Software and Affected Versions** WPeMatico RSS Feed Fetcher versions prior to 2.8.27 **Description** The plugin fails to perform a capability check before fetching a user-supplied URL and rendering the response. This allows users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the responses back, a technique known as Server-Side Request Forgery (SSRF), where an attacker induces the server-side application to make requests to an unintended location. **Recommendations** Update WPeMatico RSS Feed Fetcher to version 2.8.27 or later.

**Name of the Vulnerable Software and Affected Versions** WPeMatico RSS Feed Fetcher versions prior to 2.8.27 **Description** The plugin fails to verify if a user managing a feed campaign has the necessary permissions to publish content or attribute posts to other accounts. This allows users with contributor-level access or higher to publish posts live and assign any registered user, including administrators, as the post author. **Recommendations** Update WPeMatico RSS Feed Fetcher to version 2.8.27 or later.

**Name of the Vulnerable Software and Affected Versions** Link Library versions prior to 7.9.6 **Description** Insufficient escaping of parameters used in the addresses of links generated on front-end directory pages allows Reflected Cross-Site Scripting (XSS). This occurs via the `link tags` and `link price` parameters in sort and breadcrumb links, potentially affecting any visitor, including logged-in administrators. **Recommendations** Update Link Library to version 7.9.6 or later.

**Name of the Vulnerable Software and Affected Versions** Link Library versions prior to 7.9.6 **Description** Insufficient sanitization of a user-supplied destination folder occurs when writing a generated image to disk. This allows users with the Contributor role and above to create directories and write or overwrite image files in any location accessible to the web server, including areas outside the site's document root. This issue is triggered via the `filepath` parameter. Because the written file name is always numeric with a fixed image extension, executable code cannot be uploaded through this method. **Recommendations** Update Link Library to version 7.9.6 or later.

**Name of the Vulnerable Software and Affected Versions** WPeMatico RSS Feed Fetcher versions prior to 2.8.26 **Description** The plugin fails to sanitize and escape content retrieved from a user-supplied source before rendering it. This allows users with contributor-level permissions or higher to execute Stored Cross-Site Scripting (XSS) attacks—a technique where malicious scripts are permanently stored on the target server—against higher-privileged users who review the campaign. **Recommendations** Update WPeMatico RSS Feed Fetcher to version 2.8.26 or later.

**Name of the Vulnerable Software and Affected Versions** Masteriyo LMS versions prior to 3.4.2 **Description** An Insecure Direct Object Reference (IDOR) exists where the software fails to verify if the authenticated user requesting course-progress records is the actual owner of those records. This allows any authenticated user, including self-registered subscribers, to access the learning activity of other users. Furthermore, if the requested account is not specified with a non-zero value, the system skips the ownership check entirely and returns the progress records of all learners on the site. **Recommendations** Update Masteriyo LMS to version 3.4.2 or later.