Karthik Ramakrishnan

The Photo Gallery by 10Web WordPress plugin before 1.8.49 does not escape a shortcode attribute that sets a gallery watermark image before rendering it into an HTML image attribute, and decodes percent-encoded characters in the value, allowing users with Contributor-level access and above to perform Stored Cross-Site Scripting that executes in the browser of any user, including an administrator, who views the published gallery.

The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout decisions actually originates from a trusted source, trusting a user-supplied value by default, allowing unauthenticated attackers to spoof their IP address and evade IP-based protections such as login lockout and IP banning, impersonate an allowlisted address, and poison the Defender Security WordPress plugin before 6.4.1's activity logs.

The Defender Security WordPress plugin before 6.4.1 does not limit the number of failed two-factor authentication attempts in its default configuration, allowing an attacker who already knows a victim's password to brute-force the one-time code and defeat the second authentication factor.

The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans that grant a user role.

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable before returning its approved comments through the review feature, allowing unauthenticated attackers to read approved comments on private, draft and password-protected posts, and to retrieve approved comments site-wide.

The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthenticated users to add a product to the cart and complete an order while skipping the required option's surcharge and paying only the base product price.

The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management capabilities reserved to the Super Admin.

The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities.

The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of password-protected videos, such as unlisted YouTube or Vimeo links and external file URLs.

The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX action that carries out a site-wide content rewrite, so any authenticated user, including subscriber-level, can trigger a bulk modification of posts they should not be able to edit.

The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account.

The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as low as Subscriber to perform Stored Cross-Site Scripting attacks against administrators.

The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on standard front-end page views, allowing unauthenticated users to read the full contents of restricted posts and pages through other routes that render the same content.

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the affected page.

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's connected cloud storage accounts.

Existe um problema onde o plugin não sanitiza adequadamente a pasta de destino de staging fornecida ao manipulador `staging-start`. Enquanto o manipulador `writability-check` utiliza um sanitizador de nome de arquivo correto, o manipulador `staging-start` aplica apenas um filtro de texto genérico. Isso permite que um administrador autenticado utilize sequências de path traversal—uma técnica usada para acessar arquivos e diretórios fora da pasta pretendida—para gravar arquivos do site copiados fora do diretório de instalação do WordPress.

A validação insuficiente de caminhos fornecidos pelo usuário permite que usuários autenticados com acesso de nível de administrador realizem path traversal. Isso ocorre quando o plugin não valida adequadamente o caminho do diretório de armazenamento de backup antes de usá-lo para criar diretórios e gravar arquivos, permitindo a criação de arquivos e diretórios fora do local de backup pretendido.

Existe um problema onde o plugin não verifica se um identificador de snapshot enviado corresponde a um snapshot criado pelo plugin antes de usá-lo como um prefixo de nome de tabela de banco de dados em consultas DROP TABLE. Um administrador autenticado pode explorar isso fornecendo o prefixo de tabela do site ou qualquer outra string, permitindo a exclusão de tabelas arbitrárias do banco de dados, incluindo as tabelas principais do WordPress, resultando na destruição completa do site.

A sanitização insuficiente de entrada e a falta de escape de saída em um atributo de shortcode permitem que usuários autenticados com a função de Colaborador ou superior realizem ataques de Cross-Site Scripting (XSS) Armazenado. Isso ocorre quando o plugin não escapa um atributo de shortcode antes de exibi-lo nos atributos de links gerados, permitindo a injeção de scripts web arbitrários que são executados sempre que um usuário acessa a página afetada.

Existe um problema onde o plugin não verifica se o usuário solicitante tem as permissões necessárias para visualizar uma postagem antes de divulgar seus termos de taxonomia atribuídos. Isso ocorre devido a uma verificação de capacidade ausente em uma função, permitindo que qualquer usuário autenticado, incluindo aqueles com acesso de nível de assinante, descubra as atribuições de termos de postagens e anexos privados.