Sean Murphy

تتعلق المشكلة بثغرة «التنفيذ البرمجي عبر المواقع» المخزنة (Cross-Site Scripting) عبر المعلمات `block css` و`inner css`، وذلك بسبب عدم كفاية عملية تنقية المدخلات وتهريب المخرجات. وهذا يسمح للمهاجمين المصادق عليهم الذين يتمتعون بحق الوصول على مستوى «المساهم» أو أعلى بحقن نصوص برمجية ويب تعسفية في الصفحات، والتي سيتم تنفيذها كلما قام مستخدم بالوصول إلى صفحة تم حقن النص البرمجي فيها.

تنشأ المشكلة بسبب عدم وجود فحص للصلاحيات في الدالة `nitropack rml notification`، مما يسمح للمهاجمين المصادق عليهم الذين يتمتعون بحقوق وصول على مستوى المشترك أو أعلى بتحديث المتغيرات المؤقتة بشكل تعسفي. لا يمكن تحديث هذه المتغيرات المؤقتة إلا إلى أعداد صحيحة، وليس إلى قيم عشوائية.

تتعلق المشكلة بغياب التحقق من الأذونات في إجراء AJAX «nitropack dismiss notice forever». وهذا يسمح للمهاجمين المصادق عليهم الذين يتمتعون بوصول على مستوى المشترك أو أعلى بتحديث خيارات عشوائية إلى القيمة الثابتة «1»، مما قد يؤدي إلى تفعيل خيارات معينة، مثل تمكين تسجيل المستخدمين، أو تعديل الخيارات بطريقة تؤدي إلى حالة رفض الخدمة.

The MainWP Child plugin for WordPress is vulnerable to privilege escalation due to a missing authorization check on the `register site` function when a site is left in an unconfigured state. This makes it possible for unauthenticated attackers to log in as an administrator on instances where MainWP Child is not yet connected to the MainWP Dashboard. The vulnerability only affects sites that have MainWP Child installed, have not yet connected to the MainWP Dashboard, and do not have the unique security ID feature enabled.

The issue is related to a missing capability check on the `install required plugin callback` function, allowing authenticated attackers with Subscriber-level access and above to install and activate arbitrary plugins. This can potentially lead to remote code execution if another vulnerable plugin is installed and activated.

The issue is related to unauthorized arbitrary plugin installation due to a missing capability check on the `top store install and activate callback()` function. This allows authenticated attackers, with subscriber-level access and above, to install arbitrary plugins, which can contain other exploitable vulnerabilities to elevate privileges and gain remote code execution.

The Th Shop Mania theme for WordPress has a vulnerability due to a missing capability check on the `th shop mania install and activate callback()` function. This allows authenticated attackers with Subscriber-level access and above to install arbitrary plugins, which can be leveraged to exploit other vulnerabilities and achieve remote code execution and privilege escalation.

The issue allows unauthorized modification of data, potentially leading to privilege escalation, due to an insufficient capability check on the `mapster wp maps set option from js()` function. This enables authenticated attackers with contributor-level access or higher to update arbitrary options on the WordPress site, which can be used to gain administrative user access.

The Hunk Companion plugin for WordPress has a flaw allowing unauthorized plugin installation and activation. This is due to a missing capability check on the `/wp-json/hc/v1/themehunk-import` API endpoint. Unauthenticated attackers can exploit this to install and activate arbitrary plugins, potentially leading to remote code execution if another vulnerable plugin is already installed. Recent campaigns have actively targeted this and other vulnerabilities in WordPress plugins, with over 8.7 million exploitation attempts blocked by Wordfence. Attackers have been observed installing malicious plugins via platforms like GitHub. The WP Query Console plugin, which has not been updated in seven years, is also being exploited due to a code injection flaw, enabling attackers to execute commands on the target website. Approximately 90% of the 10,000 installations of Hunk Companion are still running a vulnerable version.

The issue is related to a missing capability check on the `install and activate plugin from external()` function, which is part of the install-active-plugin REST API endpoint. This allows unauthenticated attackers to install and activate arbitrary plugins or upload arbitrary files disguised as plugins.

The issue allows unauthenticated attackers to extract the HubSpot integration developer API key, making unauthorized changes to the plugin's HubSpot integration possible. This can also lead to the exposure of personally identifiable information from plugin users using the HubSpot integration. The vulnerability is related to the `class-forminator-addon-hubspot-wp-api.php` file.

The issue allows unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. This is possible when the action the attacker wishes to execute has a nonce check, and the nonce is known to the attacker. Additionally, the absence of a capability check is required for this issue to be exploited. The `check nonce` function is involved in this issue.

The issue allows unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. This is possible when the action the attacker wishes to execute has a nonce check, and the nonce is known to the attacker. Additionally, the absence of a capability check is required for this to occur. The `check nonce` function is involved in this process.

The issue allows unauthenticated attackers to extract sensitive data, including personally identifiable information (PII), due to hardcoded API keys.

The issue is related to unauthorized loss of data due to a missing capability check on the `amppb remove saved layout data` function. This allows authenticated attackers with contributor access and above to delete arbitrary posts on the site.

The issue allows unauthorized arbitrary options update due to an insufficient check that neglects to verify whether the updated option belongs to the plugin on the "instant-images/license" API endpoint. This makes it possible for authors and higher to update arbitrary options.

The issue arises from a missing capability check on the `dismissed handler` function, allowing authenticated attackers with subscriber access or higher to update arbitrary transients to true.

The ColorMag theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the `plugin action callback()` function. This makes it possible for authenticated attackers, with subscriber-level access and above, to install and activate arbitrary plugins. Approximately 8,904 devices are potentially affected, mainly distributed in the United States, Germany, and other countries.

The issue is related to Stored Cross-Site Scripting via the `device` header due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to a flaw in the protection mechanism of the EWWW Image Optimizer plugin for WordPress, which can be exploited by a remote attacker to execute arbitrary code. This is because the plugin relies on a protection mechanism involving `boolval`, which is not available in PHP versions before 5.5.