Sebastian Albrecht

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has enabled user listing submission, and the script executes in the victim's browser at the moment of successful login via the embedded form on the attacker's listing page.

**اسم البرنامج المصاب والإصدارات المتأثرة** SimpleForm الإصدارات السابقة لـ 3.10.1 **الوصف** توجد ثغرة تسمح للمهاجمين غير المصرح لهم بإنشاء حساب جديد بصلاحيات مدير (Administrator). يحدث هذا لأن إجراء AJAX `wp ajax nopriv simpleform wp register` يفتقر إلى التحقق من الصلاحيات عند تعيين الأدوار. علاوة على ذلك، تستخدم الدالة `save custom fields to user meta()` قائمة استبعاد تغفل عن `wp capabilities` ، بينما تعيد الدالة `get form settings()` مصفوفة قيم افتراضية تسمح بالكتابة في البيانات الوصفية (meta writing) بغض النظر عن `form id` المقدم. يمكن للمهاجمين استغلال ذلك عن طريق إرسال `wp capabilities[administrator]=1` أثناء عملية التسجيل. كما أن الـ nonce المطلوب متاح علنًا في كائن JavaScript `front end data` في جميع صفحات الواجهة الأمامية عبر `wp enqueue scripts`. **التوصيات** التحديث إلى إصدار أحدث من 3.10.0.

**Name of the Vulnerable Software and Affected Versions** WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) versions prior to 44.2 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. By submitting a crafted request with a forged `id token` parameter, where the base64url-decoded `unique name` or `iss` claims contain malicious HTML, an attacker can store a payload in the `wpo365 errors` transient for up to three days. The script executes when an administrator visits the WPO365 wizard page. **Recommendations** Update WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) to version 44.2 or later.

**Name of the Vulnerable Software and Affected Versions** WPC Product Options for WooCommerce versions prior to 4.0.6 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. The issue occurs when a malicious payload is embedded in a multipart Content-Disposition field name starting with `wpcpo-`. Because PHP's RFC1867 parser preserves these field names byte-for-byte, the payload is stored in order item meta. This can be exploited during guest checkout, enabling the execution of arbitrary web scripts when a user accesses the affected page. **Recommendations** Update WPC Product Options for WooCommerce to version 4.0.6 or later.

**Name of the Vulnerable Software and Affected Versions** Product Designer App plugin for WordPress versions prior to 1.1.4 **Description** A Directory Traversal issue exists where unauthenticated attackers can read arbitrary files from the server, potentially exposing sensitive information. This is possible via the `svg` parameter. The authentication mechanism for the affected endpoint relies on a nonce and token that are exposed as JavaScript globals on any page using the [pdapp-studio-page] shortcode, allowing anonymous visitors to obtain them. **Recommendations** Update the Product Designer App plugin for WordPress to version 1.1.4 or later. As a temporary mitigation, avoid using the `svg` parameter in the affected endpoint.

**Name of the Vulnerable Software and Affected Versions** The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress versions prior to 2.10.3 **Description** Stored Cross-Site Scripting (XSS) occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages by triggering a failed login attempt using a crafted `User-Agent` header. These scripts execute automatically whenever a user accesses the affected page, requiring no further interaction from the attacker after the payload is stored. **Recommendations** Update the plugin to a version newer than 2.10.2.