Alex Tselevich

A flaw in the global protection checks allows unauthenticated users to bypass the security protections by using crafted URLs.

An issue exists where input is not handled properly in an AJAX action, which allows unauthenticated users to retrieve the value of password protected content.

The software allows unauthenticated users to execute the `update responsive woo free shipping left shortcode` AJAX action without proper validation of the `content rech data` parameter. This can lead to arbitrary shortcode execution. The vulnerable action processes the `content rech data` parameter as a shortcode.

Name of the Vulnerable Software and Affected Versions YML for Yandex Market WordPress plugin versions prior to 5.0.26 Description The YML for Yandex Market WordPress plugin is susceptible to Remote Code Execution through its feed generation process. Recommendations Update to version 5.0.26 or later.

The User Activity Log WordPress plugin does not correctly manage unsuccessful login attempts. This allows individuals without authorization to modify plugin settings, such as enabling User Registration even when it is disabled.

The Team WordPress plugin does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action. This allows unauthenticated users to potentially execute SQL injection attacks. The issue is related to insufficient input validation before utilizing data within a SQL query. The vulnerable action is accessible through an AJAX request. A specific parameter is not adequately sanitized, leading to the potential for malicious code execution.

The software does not properly validate and escape slider options before displaying them in the dashboard. This could allow users with contributor access or higher to perform Stored Cross-Site Scripting attacks.

The YaMaps for WordPress Plugin does not properly validate and escape shortcode attributes before displaying them on a page or post. This could allow users with contributor roles or higher to execute Stored Cross-Site Scripting attacks. The issue involves improper handling of user-supplied data within shortcode attributes, potentially leading to malicious script injection.

The Plugin Organizer WordPress plugin does not properly sanitize and escape a parameter before using it in a SQL statement. This allows subscribers to potentially execute SQL injection attacks.

The Ocean Modal Window WordPress plugin is affected by a Remote Code Execution issue. The issue is related to the modal display logic, where user-controlled conditions set by Editors and Administrators (with `edit pages` capability) are executed as part of an `eval` statement on every site page. This can lead to remote code execution.

The HandL UTM Grabber / Tracker WordPress plugin does not properly sanitize and escape a parameter before displaying it, resulting in a Reflected Cross-Site Scripting issue. This could potentially be exploited against users with high privileges, such as administrators.

The HandL UTM Grabber / Tracker WordPress plugin is susceptible to a Reflected Cross-Site Scripting issue. This occurs because a parameter is not properly sanitized and escaped before being displayed on the page. Successful exploitation could potentially target users with high privileges, such as administrators. The issue involves improper handling of user-supplied input, allowing malicious scripts to be injected and executed within the context of a legitimate user's session.

The WPeMatico RSS Feed Fetcher WordPress plugin does not properly sanitize and escape certain settings. This could allow users with high privileges, such as contributors, to carry out Stored Cross-Site Scripting (XSS) attacks. Stored XSS occurs when malicious scripts are persistently stored on the target server, and then delivered to other users.