Abu Hurayra

**Name of the Vulnerable Software and Affected Versions** Kirki versions prior to 6.0.15 **Description** The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress contains an Insecure Direct Object Reference (IDOR) flaw. This occurs due to missing validation on a user-controlled key within the `context` parameter. Unauthenticated attackers can exploit this by providing an arbitrary post ID via the `context` parameter and an attacker-controlled block template to read the full title, content, and excerpt of any WordPress post, including drafts, pending, privately published, password-protected, and trashed posts, regardless of the author. **Recommendations** Update the plugin to a version newer than 6.0.14. As a temporary mitigation, restrict or filter the use of the `context` parameter to prevent unauthorized access to post data.

**Name of the Vulnerable Software and Affected Versions** Slim SEO versions prior to 4.9.9 **Description** An issue exists in the `/wp-json/slim-seo/meta-tags/ai` REST API endpoint. The `permission callback` only verifies a top-level `edit posts` capability and fails to check if the user has read access to the specific post identified by the `object.ID` parameter. Consequently, the `generate()` function passes the attacker-controlled post ID to `Data::get post content()`, which utilizes `get post()` to retrieve content regardless of its status or ownership. This allows authenticated users with Contributor-level access or higher to obtain AI-generated summaries of unauthorized content, including private posts, drafts, pending, future, and password-protected posts authored by other users. **Recommendations** Update Slim SEO to version 4.9.9 or later. As a temporary mitigation, restrict access to the `/wp-json/slim-seo/meta-tags/ai` endpoint for users with Contributor-level permissions.

**Name of the Vulnerable Software and Affected Versions** Slim SEO versions prior to 4.6.3 **Description** The Slim SEO plugin for WordPress contains a broken access control flaw caused by a missing capability check in a function. This allows authenticated users with contributor-level permissions or higher to perform unauthorized actions. **Recommendations** Update to a version newer than 4.6.2.

**Name of the Vulnerable Software and Affected Versions** GenerateBlocks versions prior to 2.1.1 **Description** An issue in the GenerateBlocks plugin for WordPress allows authenticated attackers with Contributor-level access and above to retrieve embedded sensitive user or configuration data through the insertion of sensitive information into sent data. **Recommendations** Update GenerateBlocks to version 2.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Noor Alam Magical Addons For Elementor versions through 1.4.1 **Description** A flaw exists in Noor Alam Magical Addons For Elementor that allows for Stored Cross-site Scripting (XSS). This issue is due to improper neutralization of input during web page generation. The vulnerability could allow an attacker to inject malicious scripts into web pages viewed by other users. The vulnerable component is `magical-addons-for-elementor`. **Recommendations** Versions prior to 1.4.1 should be updated.

**Name of the Vulnerable Software and Affected Versions** IdeaBox Creations PowerPack Addons for Elementor versions through 2.9.9 **Description** The software contains a flaw related to improper input handling during web page generation, specifically a cross-site scripting issue. This allows for stored cross-site scripting (XSS) attacks. The vulnerable component is `powerpack-lite-for-elementor`. **Recommendations** Versions prior to and including 2.9.9 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WPVibes Elementor Addon Elements versions through 1.14.4 **Description** A flaw exists in WPVibes Elementor Addon Elements that allows retrieval of embedded sensitive data due to insertion of sensitive information into sent data. **Recommendations** Update WPVibes Elementor Addon Elements to a version later than 1.14.4.

**Name of the Vulnerable Software and Affected Versions** X Addons for Elementor versions through 1.0.23 **Description** An issue exists in X Addons for Elementor where incorrectly configured access control security levels can be exploited, leading to a missing authorization condition. The vulnerability allows unauthorized access. **Recommendations** Update X Addons for Elementor to a version later than 1.0.23.

**Name of the Vulnerable Software and Affected Versions** Phlox Theme Plugin for WordPress versions prior to 2.17.14 **Description** The Shortcodes and extra features for Phlox theme plugin for WordPress is susceptible to Stored Cross-Site Scripting. This occurs due to insufficient input sanitization and output escaping when handling the `tag` and `title tag` parameters. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. **Recommendations** Update the Phlox Theme Plugin for WordPress to version 2.17.14 or later.

**Name of the Vulnerable Software and Affected Versions** pencilwp X Addons for Elementor versions through 1.0.23 **Description** An issue exists in pencilwp X Addons for Elementor that allows for DOM-Based Cross-site Scripting (XSS). This is due to improper neutralization of input during web page generation. The issue allows an attacker to inject malicious scripts into web pages, potentially compromising user data or system security. The vulnerable component allows for the execution of arbitrary JavaScript code within the context of the user's browser. **Recommendations** Update pencilwp X Addons for Elementor to a version later than 1.0.23.

**Name of the Vulnerable Software and Affected Versions** Colibri Page Builder plugin for WordPress versions prior to 1.0.346 **Description** The Colibri Page Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `colibri blog posts` shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. **Recommendations** Update the Colibri Page Builder plugin to version 1.0.346 or later.

**Name of the Vulnerable Software and Affected Versions** PickPlugins Post Grid and Gutenberg Blocks versions through 2.3.17 **Description** A missing authorization flaw exists in PickPlugins Post Grid and Gutenberg Blocks. This issue allows exploitation of incorrectly configured access control security levels. **Recommendations** Update PickPlugins Post Grid and Gutenberg Blocks to a version later than 2.3.17.

**Name of the Vulnerable Software and Affected Versions** PostX versions through 4.1.36 **Description** An authorization issue exists in WPXPO PostX ultimate-post due to incorrectly configured access control security levels. This allows exploitation of the system. **Recommendations** Update PostX to a version later than 4.1.36.

**Name of the Vulnerable Software and Affected Versions** All In One SEO Pack versions through 4.8.6.1 **Description** The All In One SEO Pack software contains a flaw that allows the retrieval of embedded sensitive data due to insertion of sensitive information into sent data. **Recommendations** Update All In One SEO Pack to a version later than 4.8.6.1.

**Name of the Vulnerable Software and Affected Versions** The Better Elementor Addons plugin for WordPress versions up to and including 1.5.4 **Description** The software is susceptible to Stored Cross-Site Scripting through the Slider widget. This is due to inadequate input sanitization and output escaping of user-provided attributes. Authenticated attackers with contributor-level access or higher can inject malicious web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update The Better Elementor Addons plugin to a version later than 1.5.4.

**Name of the Vulnerable Software and Affected Versions** Magical Posts Display plugin for WordPress versions through 1.2.54 **Description** The software is susceptible to Stored Cross-Site Scripting through the `mpac title tag` parameter in the Magical Posts Accordion widget. Insufficient input sanitization and output escaping of user-supplied HTML tag names allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. **Recommendations** Update the Magical Posts Display plugin to a version later than 1.2.54.

**Name of the Vulnerable Software and Affected Versions** Magical Products Display plugin for WordPress versions up to and including 1.1.29 **Description** The Magical Products Display plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping of user-supplied HTML tag names in the `mpdpr title tag` and `mpdpr subtitle tag` parameters within the MPD Pricing Table widget. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. **Recommendations** Update the Magical Products Display plugin to a version later than 1.1.29.

**Name of the Vulnerable Software and Affected Versions** HT Mega – Absolute Addons For Elementor plugin for WordPress versions prior to 3.0.0 **Description** The HT Mega – Absolute Addons For Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting through its Gutenberg blocks. This is caused by inadequate input validation of user-provided HTML tag names, specifically a missing tag name whitelist. Dangerous tags such as `script`, `iframe`, and `object` can be injected despite the use of `tag escape()` for sanitization. While some blocks utilize `esc html()` for content, this can be circumvented using JavaScript encoding techniques like unquoted strings, backticks, and `String.fromCharCode()`. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which will execute when a user accesses the affected page. **Recommendations** Update the HT Mega – Absolute Addons For Elementor plugin to version 3.0.0 or later.

**Name of the Vulnerable Software and Affected Versions** aThemes Addons for Elementor plugin for WordPress versions through 1.1.5 **Description** The aThemes Addons for Elementor plugin for WordPress has a flaw that allows for the injection of malicious web scripts. This is due to inadequate handling of user-provided data within the Call To Action widget. Authenticated attackers with contributor-level permissions or higher can exploit this to insert arbitrary web scripts into pages. These scripts will then execute when any user visits the affected page. The issue stems from insufficient input sanitization and output escaping of user-supplied values. **Recommendations** Update aThemes Addons for Elementor plugin for WordPress to a version later than 1.1.5.

**Name of the Vulnerable Software and Affected Versions** PickPlugins Accordion versions through 2.3.14 **Description** A missing authorization issue exists in PickPlugins Accordion accordions, allowing exploitation of incorrectly configured access control security levels. **Recommendations** Versions prior to 2.3.14 are affected.