Adrien Brunner

The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img alt attribute inside .wp-caption container' parameter in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users when bbPress is installed, as its bbp filter kses filter chain permits img and pre tags while preserving numeric character references inside attribute values, allowing encoded payloads to bypass save-time sanitization and reach the vulnerable sink fully intact. Exploitation by attackers with subscriber-level access and above requires that bbPress 2.6.20 is installed, a public forum exists, and either the first topic has already been approved or subsequent topics clear moderation. On a default installation, where that is not configured, the vulnerability requires attackers with contributor-level access and above.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. This occurs when an administrator saves a SQL report that selects an attacker-controllable database column, such as `HTTP USER AGENT` or `wp comments.comment agent`. The injected scripts execute whenever a user accesses the affected page.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the `browser` parameter when sending an unauthenticated HTTP request to the public visitor tracking endpoint 'wmcAction=wmcTrack'. The injected script executes in the browser of an authenticated administrator when the bundled jqPlot PieRenderer inserts the HTML-decoded series label directly as HTML.

Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored DOM-Based Cross-Site Scripting. This occurs via the `img.alt` parameter, enabling the injection of arbitrary web scripts that execute when a user visits the affected page. For subscriber-level users to exploit this, a front-end content plugin like bbPress must be active to provide the `bbp participant` capability. Attackers with contributor-level access or higher can exploit this if the site allows them to submit image HTML in post content. In default installations where this is not configured, custom-level access or higher is required.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. By manipulating the `HTTP USER AGENT` parameter, an attacker can inject arbitrary web scripts into pages that execute when accessed by an administrator.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. This issue is exploitable when the "Enable social group creation by all members" setting is active, allowing subscriber-level users to create groups.

Stored Cross-Site Scripting occurs via the user profile Website `user url` field. The issue stems from insufficient output escaping in the `ctdb filter comment author name()` callback hooked to `get comment author link`, which inserts the raw `user url` value into a single-quoted href attribute without using `esc url()` or `esc attr()`. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts that execute when a user views a Discussion Board topic containing the attacker's reply.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts via the `degreetitle` parameter. These scripts execute when a user accesses the affected page. Because the self-registration flow allows any visitor to create a Subscriber-backed Employer account, the issue is exploitable by any user capable of registering on the site.

Stored Cross-Site Scripting occurs when the plugin extracts HTML meta descriptions from remotely-fetched articles using the `parse meta()` function in `WPCP Readability`. This value is processed through article template substitution and `html entity decode()` in `WPCP Module::insert post()`, then saved via `wp insert post()`. Because the process switches the current user to a campaign author with `unfiltered html` capabilities, the `wp kses post` sanitization is bypassed. Unauthenticated attackers who control the content of an RSS source used in a campaign can inject arbitrary web scripts that execute when a user views the affected page.

Stored Cross-Site Scripting occurs via syndicated RSS/Atom feed content. The `SyndicatedPost::sanitize content()` function fails to strip `style` and `on[a-z]+` event-handler attributes. Additionally, the `SyndicatedPost::insert post()` function removes the `wp filter kses` and `wp filter post kses` filters from `content save pre` before persisting imported feed items. This allows unauthenticated attackers controlling an external feed to inject arbitrary web scripts that execute when a user accesses the affected page.

Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs via the `bbp reply content` parameter, enabling the injection of arbitrary web scripts that execute when a user visits the affected page. Exploitation is possible if an administrator has enabled Viewport Images (VPI) and configured a VPI filename that matches an image the attacker can embed in user-generated content, such as bbPress topics where participants can post replies containing raw img tags.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the `media:thumbnail@url` parameter. An attacker can inject arbitrary web scripts into pages that execute when a user accesses them, provided the attacker controls an external RSS feed already configured for import by the target site.

An issue exists where authenticated users with Instructor-level access or higher can perform Local File Inclusion. This occurs because the `llms get template()` function uses `extract()` on the attributes of the `[lifterlms checkout]` shortcode before resolving the template path. By manipulating the `template name` and `default path` attributes, an attacker can overwrite local parameters and control the path passed to a PHP include. This can lead to the execution of arbitrary files on the server, bypassing access controls, leaking sensitive data, or achieving remote code execution if files containing malicious content are uploaded.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts via the `post title` parameter. These scripts execute whenever a user accesses the affected page.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. By exploiting the `wcpr image upload id` parameter, an attacker can inject arbitrary web scripts into comment meta, which is not processed by `wp kses` (a WordPress function used to sanitize HTML). The attack is facilitated by the publicly available `wcpr image upload` nonce on product review forms, as the system fails to perform capability, authentication, or attachment ownership checks. The injected scripts execute when a user views the affected review on the frontend.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS) via the `#response` URL fragment. This occurs when the `getErrorMessage()` function returns a raw Stripe error string instead of a safe mapped message, which happens if the 'Generic Errors' setting is unchecked. This allows the injection of arbitrary web scripts that execute when a user visits the affected page.

The HivePress – Business Directory, Listings & Classified Ads Plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages via a custom user attribute field name parameter. These scripts execute when a user accesses the affected page. This occurs when an administrator configures a text-type custom user attribute where the `%value%` is placed inside an HTML attribute context and front-end user profiles are enabled.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the `user email` parameter. On WordPress Multisite installations with public registration enabled, attackers can use email addresses containing numeric HTML character references. While the plugin's validator rejects these, the attacker-controlled address is persisted verbatim to the email log through the failed-send exception message, executing the script when a user accesses the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts via the `name` parameter. These scripts execute when a user accesses the affected page. This issue is exploitable when the 'Register user if not exists' setting is disabled, which is the default configuration.

An issue exists where insufficient escaping of user-supplied parameters and lack of preparation in SQL queries allow authenticated attackers to perform time-based SQL Injection. This occurs via the `sort by` parameter, enabling attackers with custom-level access and above to append additional SQL queries to extract sensitive information from the database. Successful exploitation requires the attacker to possess a Subscriber-level (or higher) WordPress role and a SupportCandy Agent account with the 'Assign Agents' permission configured.