Sawyer

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof settings[woof stat][server options]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password stored in woof settings[woof stat][server options] from the inline woof tm data script object on any public frontend filter page. This is only exploitable when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode — all supported, documented plugin configurations.

The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email address' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail rows belonging to other users — including recipient addresses, message subjects, full message bodies, and any URLs contained therein — whose addresses happen to match the wildcard. Exploitation requires an administrator to process a personal-data export request for the attacker's email address via the standard WordPress privacy workflow, and the attacker's address must contain a LIKE wildcard character (such as an underscore) that matches at least one other user's address in the mail log.

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7 forms row and the process bulk action() delete handler then matching any stored key whose name contains the substring 'cfdb7 file' and passing the stored value directly to unlink() without validating that the file actually belongs to the submission being deleted or constraining the filename with basename()/realpath(). This makes it possible for unauthenticated attackers to inject a crafted multipart field.

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post images (file info[2] = title)' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

**Name of the Vulnerable Software and Affected Versions** Blocksy Companion versions prior to 2.1.59 **Description** A privilege escalation issue exists in the `implement user registration()` AJAX handler. The handler disables the Dokan vendor-registration nonce check (a security token used to prevent cross-site request forgery) and trusts the `role` variable provided via `$ POST`. This allows unauthenticated attackers to elevate their privileges to a Dokan seller account and be automatically authenticated, granting them publishing capabilities even on sites where vendor signup is disabled. **Recommendations** Update the plugin to version 2.1.59 or later.

**Name of the Vulnerable Software and Affected Versions** Download Manager plugin for WordPress versions prior to 3.3.72 **Description** Authenticated attackers with subscriber-level access and above can cause sensitive information exposure via the `first name` parameter. This occurs when an administrator performs a Suspend action against the attacker's account, causing the plugin to synchronously compile and send a suspension email within the administrator's authenticated HTTP request. This process makes the administrator's full Cookie header, including `wordpress logged in *` session cookies, available to the template engine, allowing the attacker to extract these cookies for session hijacking and full account takeover. **Recommendations** Update the Download Manager plugin for WordPress to version 3.3.72 or later.