Adrien Brunner

The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query Parameter Name in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

**Name of the Vulnerable Software and Affected Versions** Broken Link Checker versions prior to 2.4.14 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. An attacker can submit a link via the WordPress comment author URL field; if an administrator performs the standard dismiss-and-recheck workflow, the attacker's server can issue a redirect to a URL containing an HTML/JavaScript payload. This payload is stored verbatim in the link log and executes whenever a user accesses the affected page. **Recommendations** Update to a version newer than 2.4.13.

The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Polylang or Polylang Pro plugin to be active and the Combine JS option to be enabled, as these conditions trigger the vulnerable Host-header-to-URL code path that writes attacker-controlled script src values into the shared page-cache file served to all subsequent visitors.

**Name of the Vulnerable Software and Affected Versions** Forminator Forms – Contact Form, Payment Form & Custom Form Builder versions prior to 1.58.0 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform DOM-Based Reflected Cross-Site Scripting. This occurs when arbitrary web scripts are injected into pages, which then execute upon user access. The issue is specifically triggerable on pages hosting a form configured to use the Stripe Checkout Sessions payment API via the `error description` parameter. **Recommendations** Update to a version newer than 1.57.0. Avoid using the `error description` parameter in the Stripe Checkout Sessions payment API configuration until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Fluent Forms versions prior to 6.2.12 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. This occurs via Notification Smartcode Values, enabling the execution of arbitrary web scripts in the browser of an administrator or any user with entry-viewing capabilities when accessing the Submission Logs in the WordPress admin dashboard. Exploitation is possible if an administrator or manager has configured an email notification where the subject or the static Send To value references an attacker-influenced Smartcode, such as `input password`, `cookie`, or `submission.response`. **Recommendations** Update to version 6.2.12 or later.

**Name of the Vulnerable Software and Affected Versions** Typemill versions 2.19.1 and below **Description** Typemill is a flat-file, Markdown-based CMS for informational documentation websites. A reflected Cross-Site Scripting (XSS) issue exists in the login error view template `login.twig`. The `username` value is echoed back without proper encoding when authentication fails, allowing an attacker to execute script in the login page context. **Recommendations** Update to version 2.19.2 or later.