Theviper17Y

The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send test mail() function, which allows user-controlled PHP code to be written to executable files in the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary PHP code on the server, leading to full site compromise.

The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 8.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated visitors can also exploit this vulnerability when the 'Parse Vimeo and YouTube links' (parse comments) setting is enabled, as this causes the plugin to process shortcodes within comment text.

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' (parse comments) option to be enabled and the liststyle attribute set to "season" for the vulnerable code path to be reached.

**Name of the Vulnerable Software and Affected Versions** LazyLoad Plugin – Lazy Load Images, Videos, and Iframes versions prior to 2.4.1 **Description** Stored Cross-Site Scripting occurs via the `comment content` parameter, which is rendered inline into the page HTML. This issue stems from insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses the affected page. The vulnerability bypasses the WordPress core `wp kses data` allow-list because the payload uses permitted tags and attributes, hiding the event handler within a broken attribute region. The plugin's render-time `str replace()` function then promotes this to a real DOM attribute. Execution of the payload requires a site administrator to approve the crafted comment. **Recommendations** Update to a version newer than 2.4.0. As a temporary workaround, restrict the ability for unauthenticated users to submit comments or ensure strict manual review of all comment content before approval.

**Name of the Vulnerable Software and Affected Versions** Download Manager versions prior to 3.3.59 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the `not found` parameter, which execute when a user accesses the affected page. **Recommendations** Update to a version newer than 3.3.58. Avoid using the `not found` parameter until the update is applied.

The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.4.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered via the comment author name field, which must clear WordPress's comment moderation workflow before being displayed, though this represents a display prerequisite rather than any sanitization control.

**Name of the Vulnerable Software and Affected Versions** Transliterator – Multilingual and Multi-script Text Conversion versions prior to 2.5.9 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) via comment content. This is achieved by using a predictable `{rstr keep}` placeholder, enabling the injection of arbitrary web scripts that execute when a user views the affected page. The payload bypasses standard WordPress comment sanitization because the used tags and attributes, such as `a[title]` and `code`, are permitted by the core comment kses allow-list, and the plugin's shortcode markers and placeholder tokens are not removed. **Recommendations** Update to version 2.5.9 or later.

**Name of the Vulnerable Software and Affected Versions** DoFollow Case by Case versions prior to 3.6.1 **Description** The DoFollow Case by Case plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts through comment content. While comment moderation may delay the process, the payload executes in the browser of any visitor who accesses the affected post once an administrator approves the comment. **Recommendations** Update DoFollow Case by Case to a version newer than 3.6.0.

**Name of the Vulnerable Software and Affected Versions** Autoptimize versions prior to 3.1.15.2 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. Successful exploitation requires the 'Lazy-load images?' option to be enabled, the `w3-total-cache/w3-total-cache.php` file to be present on disk while the plugin is disabled, a `Minify HTML` class to be loaded into scope by another plugin, and the malicious comment to be approved by a moderator. **Recommendations** Update Autoptimize to version 3.1.15.2 or later.

**Name of the Vulnerable Software and Affected Versions** GSpeech TTS – WordPress Text To Speech Plugin versions prior to 3.22.1 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting via comment content. This is achieved through an mXSS-style transform, where the payload is stored using tags and attributes allowed by WordPress comment kses sanitization. The malicious event handlers and style fragments are activated when the plugin's output-buffer callback rewrites the rendered HTML during the request. This allows the execution of arbitrary web scripts whenever a user accesses the affected page. **Recommendations** Update GSpeech TTS – WordPress Text To Speech Plugin to version 3.22.1 or later.

**Name of the Vulnerable Software and Affected Versions** W3 Total Cache versions prior to 2.10.7 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages via comment content. This issue is triggered by an Output-Buffer Regex Rewrite and is only exploitable when the 'Remove query strings from static resources' option is enabled. In this configuration, the `mutate url()` function strips the '?' delimiter and subsequent characters, which can break the attribute boundary and allow script execution when a user accesses the affected page. **Recommendations** Update W3 Total Cache to a version newer than 2.10.6. Disable the 'Remove query strings from static resources' option to mitigate the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Real Estate Manager – Property Listing and Agent Management versions prior to 7.4 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts into pages. This is possible because the `wp ajax rem create pro ajax` handler lacks capability, nonce, or ownership checks. Additionally, since the value is persisted via `update post meta` instead of `post content`, the `wp kses` filtering—a function used to sanitize HTML—tied to the `unfiltered html` capability is not applied. The issue is triggered via the `before price text` parameter. **Recommendations** Update the plugin to version 7.4 or later. As a temporary mitigation, restrict access to the `before price text` parameter in the `wp ajax rem create pro ajax` handler.

**Name of the Vulnerable Software and Affected Versions** Bold Page Builder versions prior to 5.7.3 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts via the `title` attribute of the `bt bb service` shortcode. These scripts execute whenever a user accesses the affected page. **Recommendations** Update Bold Page Builder to version 5.7.3 or later. As a temporary mitigation, restrict the ability of users with Contributor-level access to edit pages or use the `bt bb service` shortcode.

**Name of the Vulnerable Software and Affected Versions** Complianz GDPR/CCPA Cookie Consent Banner versions prior to 7.5.5 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) via comment content. This occurs through the Elementor Cookie Blocker Regex, enabling the injection of arbitrary web scripts that execute when a user visits the affected page. Successful exploitation requires an administrator to approve the malicious comment, the installation of the Elementor plugin, and the configuration of Complianz with the Twitter or Facebook cookie/script blocker enabled. **Recommendations** Update to a version newer than 7.5.4. As a temporary mitigation, disable the Twitter or Facebook cookie/script blocker in the Complianz configuration.

**Name of the Vulnerable Software and Affected Versions** Aruba HiSpeed Cache plugin for WordPress versions prior to 3.0.15 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the Post Content, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users. **Recommendations** Update the plugin to version 3.0.15 or later.

**Name of the Vulnerable Software and Affected Versions** Spam protection, Honeypot, Anti-Spam by CleanTalk for WordPress versions prior to 6.87 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with custom-level access and above to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the Comment Content `aria-label` placeholder. While the payload can be delivered through unauthenticated comment submissions, it executes only for non-logged-in visitors. If comment moderation is active, a moderator must publish the comment before the script is triggered for other users. **Recommendations** Update the plugin to version 6.87 or later.

**Name of the Vulnerable Software and Affected Versions** W3 Total Cache versions prior to 2.10.6 **Description** Insufficient input sanitization and output escaping in the LazyLoad Background Mutator allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). This occurs when malicious web scripts are injected via comment content and subsequently execute when a user accesses the affected page. This issue requires the Lazy Load Images feature with Process background images enabled and requires a moderator to approve the malicious comment before the script is triggered. **Recommendations** Update W3 Total Cache to version 2.10.6 or later. As a temporary mitigation, disable the Lazy Load Images feature or the Process background images option.

**Name of the Vulnerable Software and Affected Versions** WP Recipe Maker Premium versions prior to 10.5.1 **Description** Stored Cross-Site Scripting occurs via the 'wprm-call-to-action' shortcode due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages, which execute when a user accesses the affected page. **Recommendations** Update WP Recipe Maker Premium to version 10.5.1 or later.

**Name of the Vulnerable Software and Affected Versions** Affiliate Super Assistent versions prior to 1.10.3 **Description** Insufficient input sanitization and output escaping in the `doCommentShortcode()` function allow unauthenticated attackers to perform Stored Cross-Site Scripting. This enables the injection of arbitrary web scripts into pages, which execute when a user accesses the affected page. **Recommendations** Update the plugin to a version later than 1.10.2. As a temporary workaround, consider disabling the `doCommentShortcode()` function until the update is applied.