0X34Rth

The Extended Random Number Generator plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin settings. Insufficient input sanitization and output escaping allow authenticated attackers with administrator-level access to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. This issue specifically impacts multi-site installations and those where unfiltered html has been disabled.

The WP Content Permission plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping in the `ohmem-message` parameter. An authenticated attacker with Administrator-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. The API endpoint involved is not explicitly mentioned. The vulnerable parameter is `ohmem-message`.

The All push notification for WP plugin for WordPress is susceptible to time-based SQL Injection via the `delete id` parameter. This is due to inadequate escaping of user-supplied input and insufficient preparation of the existing SQL query. Successful exploitation allows authenticated attackers with administrator-level access or higher to inject additional SQL queries into existing queries, potentially enabling the extraction of sensitive information from the database.