Abu Hurayra

Stored Cross-Site Scripting occurs via the Type Out widget due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages, which execute when a user accesses the affected page.

An open redirect issue exists in the Mediawiki - Collection extension, which allows an attacker to redirect users to an untrusted site and fake the source of data.

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress contains an Insecure Direct Object Reference (IDOR) flaw. This occurs due to missing validation on a user-controlled key within the `context` parameter. Unauthenticated attackers can exploit this by providing an arbitrary post ID via the `context` parameter and an attacker-controlled block template to read the full title, content, and excerpt of any WordPress post, including drafts, pending, privately published, password-protected, and trashed posts, regardless of the author.

An issue exists in the `/wp-json/slim-seo/meta-tags/ai` REST API endpoint. The `permission callback` only verifies a top-level `edit posts` capability and fails to check if the user has read access to the specific post identified by the `object.ID` parameter. Consequently, the `generate()` function passes the attacker-controlled post ID to `Data::get post content()`, which utilizes `get post()` to retrieve content regardless of its status or ownership. This allows authenticated users with Contributor-level access or higher to obtain AI-generated summaries of unauthorized content, including private posts, drafts, pending, future, and password-protected posts authored by other users.

The Slim SEO plugin for WordPress contains a broken access control flaw caused by a missing capability check in a function. This allows authenticated users with contributor-level permissions or higher to perform unauthorized actions.

An issue in the GenerateBlocks plugin for WordPress allows authenticated attackers with Contributor-level access and above to retrieve embedded sensitive user or configuration data through the insertion of sensitive information into sent data.

The software contains a flaw related to improper input handling during web page generation, specifically a cross-site scripting issue. This allows for stored cross-site scripting (XSS) attacks. The vulnerable component is `powerpack-lite-for-elementor`.

A flaw exists in Noor Alam Magical Addons For Elementor that allows for Stored Cross-site Scripting (XSS). This issue is due to improper neutralization of input during web page generation. The vulnerability could allow an attacker to inject malicious scripts into web pages viewed by other users. The vulnerable component is `magical-addons-for-elementor`.

An issue exists in X Addons for Elementor where incorrectly configured access control security levels can be exploited, leading to a missing authorization condition. The vulnerability allows unauthorized access.

The Shortcodes and extra features for Phlox theme plugin for WordPress is susceptible to Stored Cross-Site Scripting. This occurs due to insufficient input sanitization and output escaping when handling the `tag` and `title tag` parameters. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

An issue exists in pencilwp X Addons for Elementor that allows for DOM-Based Cross-site Scripting (XSS). This is due to improper neutralization of input during web page generation. The issue allows an attacker to inject malicious scripts into web pages, potentially compromising user data or system security. The vulnerable component allows for the execution of arbitrary JavaScript code within the context of the user's browser.

The Colibri Page Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `colibri blog posts` shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

The software is susceptible to Stored Cross-Site Scripting through the Slider widget. This is due to inadequate input sanitization and output escaping of user-provided attributes. Authenticated attackers with contributor-level access or higher can inject malicious web scripts into pages. These scripts will execute when a user accesses the affected page.

The software is susceptible to Stored Cross-Site Scripting through the `mpac title tag` parameter in the Magical Posts Accordion widget. Insufficient input sanitization and output escaping of user-supplied HTML tag names allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

The All In One SEO Pack software contains a flaw that allows the retrieval of embedded sensitive data due to insertion of sensitive information into sent data.

The Magical Products Display plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping of user-supplied HTML tag names in the `mpdpr title tag` and `mpdpr subtitle tag` parameters within the MPD Pricing Table widget. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

The HT Mega – Absolute Addons For Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting through its Gutenberg blocks. This is caused by inadequate input validation of user-provided HTML tag names, specifically a missing tag name whitelist. Dangerous tags such as `script`, `iframe`, and `object` can be injected despite the use of `tag escape()` for sanitization. While some blocks utilize `esc html()` for content, this can be circumvented using JavaScript encoding techniques like unquoted strings, backticks, and `String.fromCharCode()`. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which will execute when a user accesses the affected page.

The aThemes Addons for Elementor plugin for WordPress has a flaw that allows for the injection of malicious web scripts. This is due to inadequate handling of user-provided data within the Call To Action widget. Authenticated attackers with contributor-level permissions or higher can exploit this to insert arbitrary web scripts into pages. These scripts will then execute when any user visits the affected page. The issue stems from insufficient input sanitization and output escaping of user-supplied values.

A flaw exists in Blockspare that allows retrieval of embedded sensitive data due to insertion of sensitive information into sent data. The number of potentially affected devices worldwide is not specified. There are no reports of real-world incidents where this issue was exploited. No specific API endpoints, vulnerable parameters, or function names are mentioned in the provided information.

The SureForms – Drag and Drop Form Builder for WordPress plugin contains a flaw in access control. Specifically, the '/wp-json/sureforms/v1/srfm-global-settings' API endpoint does not properly restrict access. This allows authenticated attackers with contributor-level access or higher to obtain sensitive information. This information includes API keys for Google reCAPTCHA, Cloudflare Turnstile, and hCaptcha, as well as admin email addresses and security-related form settings.