Lana Codes

**Name of the Vulnerable Software and Affected Versions** Customer Reviews for WooCommerce WordPress plugin versions prior to 5.17.0 **Description** The issue is related to the failure of the Customer Reviews for WooCommerce WordPress plugin to validate and escape some of its shortcode attributes before outputting them back in a page or post where the shortcode is embedded. This could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. **Recommendations** For versions prior to 5.17.0, update to version 5.17.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of shortcodes to minimize the risk of exploitation. Avoid using unvalidated and unescaped shortcode attributes in pages or posts until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Qubely WordPress plugin versions prior to 1.8.5 **Description** The issue is related to the Qubely WordPress plugin, which does not validate and escape some of its block options before outputting them back in a page or post where the block is embedded. This could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. **Recommendations** For versions prior to 1.8.5, update to version 1.8.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the vulnerable block options to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** UpQode Google Maps WordPress plugin versions 1.0.0 through 1.0.5 **Description** The issue is related to the plugin not validating and escaping some of its shortcode attributes before outputting them back in a page or post where the shortcode is embedded. This could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. **Recommendations** For versions 1.0.0 through 1.0.5, update to a version that includes the necessary validation and escaping of shortcode attributes to prevent Stored Cross-Site Scripting attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kebo Twitter Feed plugin versions prior to 1.5.12 **Description** The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user is authenticated to. **Recommendations** For versions prior to 1.5.12, update to version 1.5.12 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** WP Hide Post plugin versions <= 2.0.10 **Description** The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web application. **Recommendations** For WP Hide Post plugin versions <= 2.0.10, update to a version higher than 2.0.10 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Wbcom Designs – BuddyPress Activity Social Share plugin versions <= 3.5.0 **Description** The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user is authenticated to. **Recommendations** For versions <= 3.5.0, update to a version higher than 3.5.0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** MyThemeShop WP Shortcode by MyThemeShop plugin versions <= 1.4.16 **Description** The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user is authenticated to. **Recommendations** For MyThemeShop WP Shortcode by MyThemeShop plugin versions <= 1.4.16, update to a version higher than 1.4.16 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Designs & Code Forget About Shortcode Buttons plugin versions <= 2.1.2 **Description** The issue is a Cross-Site Request Forgery (CSRF) vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user is authenticated to. **Recommendations** For versions <= 2.1.2, update to a version higher than 2.1.2 to resolve the issue. As a temporary workaround, consider implementing additional CSRF protection measures, such as token-based validation, to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WP Reactions Lite plugin versions 1.3.8 and earlier **Description** A Cross-Site Request Forgery (CSRF) issue affects the WP Reactions Lite plugin. This allows an attacker to perform unintended actions on a user's behalf. **Recommendations** For WP Reactions Lite plugin versions 1.3.8 and earlier, update to a version later than 1.3.8 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** WPClever WPC Smart Wishlist for WooCommerce plugin versions <= 4.7.1 **Description** The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user is authenticated to. **Recommendations** For versions <= 4.7.1, update to a version higher than 4.7.1 to resolve the issue. As a temporary workaround, consider implementing additional CSRF protection measures, such as token-based validation, to minimize the risk of exploitation. Restrict access to sensitive functionality within the WPC Smart Wishlist for WooCommerce plugin to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SendPress Newsletters plugin for WordPress versions up to, and including, 1.22.3.31 **Description** The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcode(s), allowing authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page. **Recommendations** For SendPress Newsletters plugin for WordPress versions up to, and including, 1.22.3.31, update to a version that addresses the insufficient input sanitization and output escaping issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The Simple Like Page Plugin for WordPress versions up to, and including, 1.5.1 **Description** The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'sfp-page-plugin' shortcode, allowing authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 1.5.1, update to a version that addresses the insufficient input sanitization and output escaping issue in the 'sfp-page-plugin' shortcode. As a temporary workaround, consider restricting access to the 'sfp-page-plugin' shortcode for users with contributor-level and above permissions until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Interact: Embed A Quiz On Your Site plugin for WordPress versions up to, and including, 3.0.7 **Description** The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'interact-quiz' shortcode. This allows authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages. The injected scripts will execute whenever a user accesses the injected page. **Recommendations** For versions up to, and including, 3.0.7, update to a version later than 3.0.7 to resolve the issue. As a temporary workaround, consider restricting access to the 'interact-quiz' shortcode for users with contributor-level and above permissions until a patch is available.

**Name of the Vulnerable Software and Affected Versions** WP MapIt plugin for WordPress versions up to, and including, 2.7.1 **Description** The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'wp mapit' shortcode. This allows authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages. The injected scripts will execute whenever a user accesses the injected page. **Recommendations** For WP MapIt plugin for WordPress versions up to, and including, 2.7.1, update to a version that addresses the insufficient input sanitization and output escaping issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Social Feed plugin for WordPress versions up to, and including, 1.5.4.6 **Description** The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the `socialfeed` shortcode. This allows authenticated attackers with author-level and above permissions to inject arbitrary web scripts in pages. The injected scripts will execute whenever a user accesses the injected page. **Recommendations** For Social Feed plugin for WordPress versions up to, and including, 1.5.4.6, update to a version that addresses the insufficient input sanitization and output escaping issue. As a temporary workaround, consider restricting access to the `socialfeed` shortcode for users with author-level and above permissions until a patch is available.

**Name of the Vulnerable Software and Affected Versions** The Social Sharing Plugin - Social Warfare plugin for WordPress versions up to, and including, 4.4.3 **Description** The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'social warfare' shortcode, allowing authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 4.4.3, update to a version that addresses the insufficient input sanitization and output escaping issue in the 'social warfare' shortcode. As a temporary workaround, consider restricting access to the 'social warfare' shortcode for users with contributor-level and above permissions until a patch is available.

**Name of the Vulnerable Software and Affected Versions** QR Code Tag plugin for WordPress versions up to, and including, 1.0 **Description** The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'qrcodetag' shortcode, allowing authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page. **Recommendations** For QR Code Tag plugin for WordPress versions up to, and including, 1.0, consider disabling the 'qrcodetag' shortcode until a patch is available to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** ImageMapper plugin for WordPress versions up to, and including, 1.2.6 **Description** The issue allows authenticated attackers with subscriber-level permissions and above to delete arbitrary posts and pages due to a missing capability check on the `imgmap delete area ajax` function. **Recommendations** For versions up to, and including, 1.2.6, update to a version that includes a fix for the missing capability check in the `imgmap delete area ajax` function to prevent unauthorized data loss.

**Name of the Vulnerable Software and Affected Versions** ImageMapper plugin for WordPress versions up to, and including, 1.2.6 **Description** The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'imagemap' shortcode, allowing authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages. This enables the execution of injected scripts whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 1.2.6, update to a version that addresses the insufficient input sanitization and output escaping issue in the 'imagemap' shortcode.

**Name of the Vulnerable Software and Affected Versions** Ziteboard Online Whiteboard plugin for WordPress versions up to, and including, 2.9.9 **Description** The issue arises from insufficient input sanitization and output escaping in the `ziteboard` shortcode, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages. This enables the execution of injected scripts whenever a user accesses an injected page. **Recommendations** For Ziteboard Online Whiteboard plugin for WordPress versions up to, and including, 2.9.9, update to a version that addresses the insufficient input sanitization and output escaping in the `ziteboard` shortcode. At the moment, there is no information about a newer version that contains a fix for this vulnerability.