Athiwat Tiprasaharn

The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'iq tree tree chart template' Widget Setting in all versions up to, and including, 3.1.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

**Name of the Vulnerable Software and Affected Versions** GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor versions prior to 2.4.5 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts through the `postBodyCss` parameter. These scripts execute whenever a user accesses an affected page. **Recommendations** Update the plugin to version 2.4.5 or later. As a temporary mitigation, restrict access to the `postBodyCss` parameter for users with Contributor-level permissions.

**Name of the Vulnerable Software and Affected Versions** Greenshift versions prior to 12.9.0 **Description** The Greenshift – animation and page builder blocks plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the `customapi` action handler does not sufficiently sanitize API responses before they are output using `innerHTML`. Consequently, authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page. **Recommendations** Update the plugin to a version newer than 12.8.9.

**Name of the Vulnerable Software and Affected Versions** WS Form LITE – Drag & Drop Contact Form Builder versions prior to 1.10.81 **Description** The plugin is susceptible to PHP Object Injection, a condition where untrusted input is deserialized, allowing an attacker to inject PHP objects. This occurs through the processing of form submission meta values. While the software itself does not contain a known POP chain (Property-Oriented Programming, a technique used to execute arbitrary code by leveraging existing classes in the application), the issue becomes critical if another installed plugin or theme provides one. In such cases, an unauthenticated attacker could potentially delete arbitrary files, retrieve sensitive data, or execute code. **Recommendations** Update the plugin to a version newer than 1.10.80.

**Name of the Vulnerable Software and Affected Versions** Image Photo Gallery Final Tiles Grid versions prior to 3.6.13 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the `delay` shortcode attribute, which then execute when a user visits the affected page. **Recommendations** Update Image Photo Gallery Final Tiles Grid to a version newer than 3.6.12. Avoid using the `delay` shortcode attribute until the update is applied.

**Name of the Vulnerable Software and Affected Versions** PPWP: Password Protect Pages, Posts & Full or Partial Content versions prior to 1.9.16 **Description** An improper capability check in the `can access()` function allows authenticated attackers with Contributor-level access or higher to retrieve a master-password. This flaw enables unauthorized access to any password-protected content within the system. **Recommendations** Update the plugin to a version newer than 1.9.15.

**Name of the Vulnerable Software and Affected Versions** LightSync Pro versions prior to 2.1.7 **Description** The LightSync Pro plugin for WordPress allows authenticated attackers with Author-level access or higher to upload arbitrary files to the server. This issue occurs because the `rest replace media()` function fails to validate file types, which could lead to remote code execution. **Recommendations** Update the plugin to a version later than 2.1.6. As a temporary workaround, restrict access to the `rest replace media()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** TableOn – WordPress Posts Table Filterable versions prior to 1.0.5.2 **Description** Unauthenticated attackers can perform blind SQL Injection through the `filter data[comment count]` parameter of the public `tableon get table data` AJAX action. The issue occurs because user-supplied input is split on a colon and interpolated directly into a `posts where` SQL clause without using `intval()` casting or `$wpdb->prepare()`. This allows the execution of additional SQL queries to extract sensitive data from the database, such as database names, usernames, and passwords. **Recommendations** Update to a version newer than 1.0.5.1. As a temporary workaround, restrict access to the `tableon get table data` AJAX action to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Content Egg – Affiliate Product Importer & Price Comparison versions prior to 11.3.1 **Description** An arbitrary file deletion issue exists due to path traversal, where an attacker can use special character sequences to access and delete files outside the intended directory. The flaw occurs because the `img file` field within the `cegg data` post metadata is not properly validated, as the `wp strip all tags()` function fails to remove path traversal sequences. This value is stored in post meta and subsequently concatenated into a filesystem path within the `getFullImgPath()` function before being processed by the PHP `unlink()` function. Authenticated users with author-level access or higher can exploit this to delete arbitrary files on the server, which may lead to remote code execution. **Recommendations** Update to a version newer than 11.3.0. As a temporary mitigation, restrict user permissions to prevent users with author-level access from modifying post metadata associated with the `img file` field.

**Name of the Vulnerable Software and Affected Versions** Logo Slider – Logo Carousel, Client Logo Slider & Brand Showcase for WordPress versions prior to 5.6 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the `lgx tooltip position` parameter. These scripts execute automatically when a user visits the affected page. **Recommendations** Update the plugin to a version newer than 5.5. Restrict the use of the `lgx tooltip position` parameter for users with contributor-level access until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Customer Reviews for WooCommerce versions prior to 5.113.1 **Description** Insufficient input sanitization and output escaping in the Customer Reviews for WooCommerce plugin allow authenticated attackers with contributor-level access or higher to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the `color` shortcode attribute, which then execute when a user visits the affected page. **Recommendations** Update the plugin to version 5.113.1 or later.

**Name of the Vulnerable Software and Affected Versions** Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder versions prior to 3.1.2 **Description** Insufficient file path validation in the `deleteFiles()` function allows authenticated attackers with subscriber-level access and above to delete arbitrary files on the server. This action can lead to remote code execution if critical files, such as `wp-config`, are deleted. **Recommendations** Update the plugin to version 3.1.2 or later.

**Name of the Vulnerable Software and Affected Versions** Insert Pages versions prior to 3.11.5 **Description** Stored Cross-Site Scripting occurs when an inserted page is rendered using the `[insert page='ID' display='all']` shortcode. The issue stems from insufficient output escaping within the `the meta()` function, where the custom field key `key` is interpolated into the HTML and echoed without escaping, although the field value is sanitized. This allows authenticated attackers with author-level access or higher to inject arbitrary web scripts into pages that execute when accessed by other users. **Recommendations** Update to a version newer than 3.11.4.

**Name of the Vulnerable Software and Affected Versions** My Calendar – Accessible Event Manager versions prior to 3.7.15 **Description** An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user-controlled key. Unauthenticated attackers can enumerate occurrence IDs via the `vcal` parameter to access the full iCalendar export of personal, draft, trashed, and non-public calendar events. This leads to the disclosure of sensitive metadata, including titles, descriptions, dates, locations, permalinks, and details regarding the organizer and host. **Recommendations** Update My Calendar – Accessible Event Manager to version 3.7.15 or later. As a temporary mitigation, restrict access to the `vcal` parameter to prevent unauthorized event enumeration.

**Name of the Vulnerable Software and Affected Versions** JetWidgets For Elementor versions prior to 1.0.22 **Description** Stored Cross-Site Scripting occurs due to insufficient output escaping and missing server-side validation of the `animation effect` setting within the Animated Box widget before it is rendered inside an HTML class attribute. Authenticated attackers with author-level access or higher can inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update JetWidgets For Elementor to version 1.0.22 or later. As a temporary mitigation, restrict access to the Animated Box widget for users with author-level permissions.

**Name of the Vulnerable Software and Affected Versions** Appointment Booking Calendar versions prior to 1.4.5 **Description** The Appointment Booking Calendar plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping in custom booking field labels. Authenticated attackers with Author-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page. **Recommendations** Update to a version later than 1.4.4.

**Name of the Vulnerable Software and Affected Versions** Slideshow Gallery LITE versions prior to 1.8.6 **Description** The Slideshow Gallery LITE plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping of user-supplied attributes, specifically within the `alwaysauto` shortcode attribute. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page. **Recommendations** Update the plugin to a version later than 1.8.5. As a temporary workaround, restrict the use of the `alwaysauto` shortcode attribute by users with Contributor-level access until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress versions prior to 2.1.0 **Description** Insufficient input sanitization and output escaping in the Anchor block allow authenticated attackers with contributor-level access or higher to perform Stored Cross-Site Scripting. This enables the injection of arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update the plugin to a version later than 2.0.9.

**Name of the Vulnerable Software and Affected Versions** Recipe Card Blocks Lite versions prior to 3.4.14 **Description** The Recipe Card Blocks Lite plugin for WordPress contains a Stored Cross-Site Scripting issue. The `WPZOOM Helpers::deserialize block attributes()` function converts unicode-encoded sequences back into HTML characters after sanitization is performed. This allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts through the `summary` and `notes` attributes of the recipe block. These scripts execute when a user views the published post or the print view of the affected recipe. **Recommendations** Update the plugin to a version later than 3.4.13.

**Name of the Vulnerable Software and Affected Versions** Master Addons For Elementor versions prior to 3.1.1 **Description** The plugin is subject to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access or higher can inject arbitrary web scripts into pages. This is achieved by bypassing UI-level restrictions and sending a crafted POST request to the endpoint "admin-ajax.php?action=elementor ajax" to manipulate the `jtlma custom js` page setting. The scripts execute whenever a user visits the affected page. **Recommendations** Update the plugin to a version later than 3.1.0. As a temporary mitigation, restrict author-level users from making POST requests to the "admin-ajax.php?action=elementor ajax" endpoint.