Wcraft

يفشل المكون الإضافي Creative Mail لـ WordPress في تنقية المعلمة وتفاديها قبل دمجها في عبارة SQL. تسمح هذه الثغرة لمستخدم غير مصدق به بتنفيذ حقن SQL عندما يتم إدارة ميزة البريد الإلكتروني الخاص بعربة التسوق المهجورة بواسطة المكون الإضافي.

لا يقوم المكون الإضافي «Comments» لـ WordPress بالتحقق بشكل صحيح من هوية المستخدم عند استخدام مزود الخدمة disqus.com. وهذا يسمح للمهاجم بتسجيل الدخول باسم أي مستخدم، بمجرد معرفة عنوان بريده الإلكتروني، حتى لو لم يكن لدى المستخدم حساب على disqus.com.

يتأثر المكون الإضافي W3 Total Cache الخاص بـ WordPress بمشكلة حقن الأوامر عبر الدالة ` parse dynamic mfunc`. وهذا يسمح للمستخدمين غير المصادق عليهم بتنفيذ أوامر PHP عشوائية عن طريق إرسال تعليق يحتوي على حمولة خبيثة إلى إحدى المنشورات. تشير التقديرات إلى أن أكثر من مليون موقع WordPress قد يتأثر بهذه الثغرة. ويتم استغلالها عن طريق إرسال تعليق مُعد خصيصًا، مما يسمح للمهاجمين بحقن وتنفيذ كود PHP، مما قد يؤدي إلى الاستيلاء الكامل على الموقع. وتقوم الدالة ` parse dynamic mfunc` بمعالجة استدعاءات الدوال الديناميكية المضمنة في المحتوى المخزن مؤقتًا. وتسمح هذه الثغرة للمهاجمين بتجاوز المصادقة وتنفيذ الأوامر على الخادم. وقد تم نشر استغلال لإثبات صحة المفهوم.

المكون الإضافي Ninja Forms لـ WordPress معرض لخطر «حقن كائنات PHP» بسبب عملية إزالة التسلسل عن البيانات التي يقدمها المستخدم عبر حقول النموذج. وهذا يتيح للمستخدمين غير المصادق عليهم إمكانية تنفيذ أحمال ضارة.

The MainWP Child plugin for WordPress is vulnerable to privilege escalation due to a missing authorization check on the `register site` function when a site is left in an unconfigured state. This makes it possible for unauthenticated attackers to log in as an administrator on instances where MainWP Child is not yet connected to the MainWP Dashboard. The vulnerability only affects sites that have MainWP Child installed, have not yet connected to the MainWP Dashboard, and do not have the unique security ID feature enabled.

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor Page Builder Lite versions through 5.6.14 Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This means that an attacker could potentially inject malicious scripts into the webpage, affecting users who interact with the page. Recommendations: For versions through 5.6.14, update to a version later than 5.6.14 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this vulnerability.

Name of the Vulnerable Software and Affected Versions: WP Royal Royal Elementor Addons versions 1.3.980 and earlier Description: The issue is related to an Improper Restriction of XML External Entity Reference vulnerability, which allows XML Injection. This vulnerability affects WP Royal Royal Elementor Addons. Recommendations: For WP Royal Royal Elementor Addons versions 1.3.980 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to improper neutralization of input during web page generation, which allows Stored Cross-site Scripting (XSS). This means that an attacker can inject malicious scripts into the website, potentially leading to unauthorized access or data theft. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks.

The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for DOM-Based XSS, which can be exploited.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This is a type of security vulnerability that can allow an attacker to inject malicious scripts into a website, potentially leading to unauthorized access or control.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks.

The issue is related to Stored Cross-Site Scripting via the `render` function due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via svg upload due to insufficient input sanitization and output escaping. This allows authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure revslider can be extended to authors.

The issue is related to Stored Cross-Site Scripting via the `button link` parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting in the Icon Widget due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages via the `fl builder data[node preview][link]` and `fl builder data[settings][link target]` parameters. These scripts will execute whenever a user accesses an injected page.