Arkadiusz Hydzik

**Name of the Vulnerable Software and Affected Versions** Save as PDF Plugin for WordPress versions prior to 4.5.6 **Description** The Save as PDF Plugin for WordPress is susceptible to Reflected Cross-Site Scripting through the `options` parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. Successful exploitation requires a user to perform an action, such as clicking a link. Exploitation is also dependent on the PDFCrowd API key being blank (demo mode, the default installation state) or known. **Recommendations** Update the Save as PDF Plugin for WordPress to version 4.5.6 or later.

**Name of the Vulnerable Software and Affected Versions** Timeline Event History plugin for WordPress versions through 3.2 **Description** The Timeline Event History plugin for WordPress is susceptible to Reflected Cross-Site Scripting through the `id` parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. Successful exploitation requires tricking a user into performing an action, such as clicking a link. The vulnerable parameter is `id`. **Recommendations** Update the Timeline Event History plugin to a version later than 3.2.

**Name of the Vulnerable Software and Affected Versions** LearnPress – WordPress LMS Plugin versions prior to 4.3.2 **Description** The LearnPress – WordPress LMS Plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. This allows authenticated attackers with Subscriber-level access or higher to inject malicious web scripts into pages. These scripts will execute when a user accesses the compromised page. **Recommendations** Update LearnPress – WordPress LMS Plugin to version 4.3.2 or later.

**Name of the Vulnerable Software and Affected Versions** Directorist versions up to and including 8.4.8 **Description** The Directorist plugin for WordPress is susceptible to arbitrary file move due to inadequate file path validation within the `add listing action` AJAX action. This allows unauthenticated attackers to move arbitrary files on the server. Successful exploitation, such as moving files like `wp-config.php`, can lead to remote code execution. **Recommendations** Update to version 8.4.9 or later.

**Name of the Vulnerable Software and Affected Versions** Podlove Podcast Publisher versions up to and including 4.2.6 **Description** The Podlove Podcast Publisher plugin for WordPress is susceptible to arbitrary file uploads because of a lack of file type validation in the `move as original file` function. This allows unauthenticated attackers to upload arbitrary files to the affected server, potentially leading to remote code execution. **Recommendations** Update Podlove Podcast Publisher to a version newer than 4.2.6.

**Name of the Vulnerable Software and Affected Versions** WP Import – Ultimate CSV XML Importer for WordPress plugin versions prior to 7.28 **Description** The WP Import – Ultimate CSV XML Importer for WordPress plugin is susceptible to arbitrary file deletion due to inadequate file path validation within the `upload function()` function. This allows authenticated attackers with Subscriber-level access or higher to delete arbitrary files on the server. Deletion of specific files, such as `wp-config.php`, could lead to remote code execution. **Recommendations** Update to version 7.28 or later.

**Name of the Vulnerable Software and Affected Versions** WP Import – Ultimate CSV XML Importer for WordPress plugin versions prior to 7.29 **Description** The WP Import – Ultimate CSV XML Importer for WordPress plugin is susceptible to Remote Code Execution due to the `write to customfile()` function writing unfiltered PHP code to a file. Authenticated attackers with Subscriber-level access or higher can inject PHP code into the `customFunction.php` file, leading to potential remote code execution. **Recommendations** Update the WP Import – Ultimate CSV XML Importer for WordPress plugin to version 7.29 or later.

**Name of the Vulnerable Software and Affected Versions** My WP Translate plugin for WordPress versions up to and including 1.1 **Description** The My WP Translate plugin for WordPress is susceptible to unauthorized data modification, potentially leading to privilege escalation. A missing capability check within the `ajax import strings()` function allows authenticated attackers with Subscriber-level access or higher to modify arbitrary options on a WordPress site. This can be exploited to elevate user privileges, such as changing the default registration role to administrator and enabling user registration for malicious purposes, ultimately granting attackers administrative access. **Recommendations** Versions prior to 1.1: Update to a version beyond 1.1 to address the issue. Version 1.1: Update to a version beyond 1.1 to address the issue.

Name of the Vulnerable Software and Affected Versions: WP Import – Ultimate CSV XML Importer for WordPress plugin versions prior to 7.28 Description: The WP Import – Ultimate CSV XML Importer for WordPress plugin is susceptible to unauthorized data access. This is due to the absence of a capability check on the `get ftp details` API endpoint, allowing authenticated attackers with Subscriber-level access or higher to retrieve configured SFTP/FTP credentials. Recommendations: Update the WP Import – Ultimate CSV XML Importer for WordPress plugin to version 7.28 or later.

**Name of the Vulnerable Software and Affected Versions** My WP Translate versions prior to 1.2 **Description** Unauthorized modification of data is possible due to a missing capability check in the `mtswpt remove plugin()` and `ajax update export code()` functions. Authenticated attackers with Subscriber-level access or higher can read and delete arbitrary WordPress options, potentially leading to a denial of service. **Recommendations** Update My WP Translate to version 1.2 or later. As a temporary mitigation, restrict access to the `mtswpt remove plugin()` and `ajax update export code()` functions.

Name of the Vulnerable Software and Affected Versions: WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress versions up to and including 1.8.47 Description: The WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress is susceptible to authentication bypass due to inadequate empty value checking within the `lwp ajax register` function. This allows unauthenticated attackers to circumvent OTP verification and potentially gain administrative access to user accounts with a configured phone number. The issue arises from improper Firebase API error handling when the Firebase API key is not configured. Recommendations: Update the WooCommerce OTP Login With Phone Number, OTP Verification plugin to a version later than 1.8.47.

**Name of the Vulnerable Software and Affected Versions** Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress versions prior to 16.9 **Description** The Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary File Read due to a missing capability check in the `wpmr inspect file()` function. This allows authenticated attackers with subscriber-level access or above to read the contents of arbitrary files on the server, potentially exposing sensitive information. **Recommendations** Update to version 16.9 or later. As a temporary workaround, restrict access for users with subscriber-level access and above.

**Name of the Vulnerable Software and Affected Versions** Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress versions through 16.8 **Description** The Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary File Deletion due to a missing capability check on the `wpmr delete file()` function. This allows authenticated attackers with Subscriber-level access or above to delete arbitrary files, potentially leading to remote code execution. This is only exploitable when advanced mode is enabled on the site. **Recommendations** Versions prior to 16.9: Ensure a capability check is implemented within the `wpmr delete file()` function to restrict file deletion access to authorized users only. Versions prior to 16.9: Disable advanced mode on the site to prevent exploitation of the vulnerability.

**Name of the Vulnerable Software and Affected Versions** Active Products Tables for WooCommerce plugin versions 1.0.6.7 and earlier **Description** The issue arises from insufficient restrictions on the `get smth()` function, allowing unauthenticated attackers to invoke arbitrary WordPress filters with a single parameter. This enables attackers to make unauthorized filter calls. **Recommendations** For versions 1.0.6.7 and earlier, as a temporary workaround, consider disabling the `get smth()` function until a patch is available. Restrict access to the plugin's functionality to minimize the risk of exploitation. Update to a version later than 1.0.6.7 when available.

**Name of the Vulnerable Software and Affected Versions** Jobs for WordPress versions prior to 2.7.12 **Description** The issue allows authenticated attackers with Subscriber-level access or higher to read the contents of arbitrary files on the server through the `job postings get file` parameter. This can potentially expose sensitive information. **Recommendations** For versions prior to 2.7.12, update to version 2.7.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the `job postings get file` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Newsletters plugin for WordPress versions up to, and including, 4.9.9.7 **Description** The issue is related to Reflected Cross-Site Scripting via the `to` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an admin user into performing an action such as clicking on a link. **Recommendations** For versions up to, and including, 4.9.9.7, avoid using the `to` parameter in affected API endpoints until the issue is resolved. As a temporary workaround, consider restricting access to the Newsletters plugin to minimize the risk of exploitation. Update to a version that includes the necessary input sanitization and output escaping fixes to prevent Reflected Cross-Site Scripting attacks.

**Name of the Vulnerable Software and Affected Versions** WPCS – WordPress Currency Switcher Professional plugin versions up to, and including, 1.2.0.4 **Description** The issue allows unauthenticated attackers to execute arbitrary shortcodes due to the software not properly validating a value before running do shortcode. This enables the execution of an action that can lead to arbitrary shortcode execution. **Recommendations** For versions up to, and including, 1.2.0.4, update to a version that fixes this issue to prevent arbitrary shortcode execution.

**Name of the Vulnerable Software and Affected Versions** Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress versions 3.0.9.4 and earlier **Description** The issue is related to missing file type and path validation in the 'format' method of the EVF Form Fields Upload class, allowing unauthenticated attackers to upload, read, and delete arbitrary files on the affected site's server. This may lead to remote code execution, sensitive information disclosure, or a site takeover. Over 100,000 WordPress sites are potentially affected. **Recommendations** For versions 3.0.9.4 and earlier, update to a version later than 3.0.9.4 to resolve the issue. As a temporary workaround, consider disabling the `EVF Form Fields Upload` class or restricting access to the vulnerable `format` method until a patch is available. Avoid using the `EVF Form Fields Upload` class in the affected API endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Bit Assist plugin for WordPress versions up to, and including, 1.5.2 **Description** The issue allows authenticated attackers with Subscriber-level access and above to read the contents of arbitrary files on the server, which can contain sensitive information, via the `fileID` Parameter. This is a Path Traversal issue. **Recommendations** For versions up to, and including, 1.5.2, consider restricting access to the `fileID` Parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the `fileID` Parameter in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Bit Assist plugin for WordPress versions up to, and including, 1.5.2 **Description** The issue allows authenticated attackers, with Subscriber-level access and above, to extract sensitive information from the database via time-based SQL Injection. This is possible due to insufficient escaping on the user-supplied `id` parameter and lack of sufficient preparation on the existing SQL query, enabling attackers to append additional SQL queries into already existing queries. **Recommendations** For versions up to, and including, 1.5.2, update to a version that fixes the SQL Injection issue to prevent exploitation. As a temporary workaround, consider restricting access to the `id` parameter in the affected plugin to minimize the risk of exploitation.