Athiwat Tiprasaharn

Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the `icon light` attribute of a shortcode, which then execute when a user visits the affected page.

Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the post content, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users.

Insufficient input sanitization and output escaping allow authenticated attackers with author-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the `other attributes` block parameter, which then execute when a user visits the affected page.

Stored Cross-Site Scripting occurs via the `pbwp raw shortcode` shortcode. The shortcode handler decodes Base64-encoded content and outputs it directly without sanitization or escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. Because the payload is Base64 encoded, it bypasses KSES (a WordPress content filtering system) during the save process as the encoded string lacks harmful HTML characters. The scripts execute whenever a user visits the affected page.

This issue is a Server-Side Request Forgery, a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. Authenticated users with Contributor-level access and above can exploit this by providing malicious input through the 'Changelog File' setting, which is passed to the `wp remote get()` function without proper validation or sanitization of the URL. This allows attackers to make web requests to arbitrary locations from the web application to query or modify information from internal services.

Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs via the `vkExUnit cta img position` Post Meta. The `sanitize text field` callback fails to strip double-quote characters or `on*` event-handler attributes during the save process. Additionally, the `Vk Call To Action::safe kses post()` function only rewrites disallowed iframe elements and returns other content verbatim, allowing injected web scripts to execute when a user accesses the affected page.

The plugin is subject to sensitive information exposure because the `ysleadgen get captured data` AJAX action is accessible to unauthenticated users. This allows an attacker to retrieve all captured form submission data, including personally identifiable information (PII) such as names, email addresses, and message content.

An authorization bypass and Stored Cross-Site Scripting (XSS) issue exists due to missing capability checks on popup management actions. Authenticated users with Subscriber-level access or higher can exploit multiple AJAX endpoints to create arbitrary popups and inject malicious JavaScript. This script executes when the popup is displayed to other users. Stored XSS is a type of vulnerability where a malicious script is permanently stored on the target server.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages via the `rootAttributes` parameter. These scripts execute automatically whenever a user visits the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Author-level access or higher can inject arbitrary web scripts via the `profile fields user email value prefix` parameter. These scripts execute when a user clicks on a link.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts through the `iq tree tree chart template` Widget Setting. These scripts execute whenever a user accesses the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts through the `postBodyCss` parameter. These scripts execute whenever a user accesses an affected page.

The Greenshift – animation and page builder blocks plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the `customapi` action handler does not sufficiently sanitize API responses before they are output using `innerHTML`. Consequently, authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the `delay` shortcode attribute, which then execute when a user visits the affected page.

The plugin is susceptible to PHP Object Injection, a condition where untrusted input is deserialized, allowing an attacker to inject PHP objects. This occurs through the processing of form submission meta values. While the software itself does not contain a known POP chain (Property-Oriented Programming, a technique used to execute arbitrary code by leveraging existing classes in the application), the issue becomes critical if another installed plugin or theme provides one. In such cases, an unauthenticated attacker could potentially delete arbitrary files, retrieve sensitive data, or execute code.

An improper capability check in the `can access()` function allows authenticated attackers with Contributor-level access or higher to retrieve a master-password. This flaw enables unauthorized access to any password-protected content within the system.

Unauthenticated attackers can perform blind SQL Injection through the `filter data[comment count]` parameter of the public `tableon get table data` AJAX action. The issue occurs because user-supplied input is split on a colon and interpolated directly into a `posts where` SQL clause without using `intval()` casting or `$wpdb->prepare()`. This allows the execution of additional SQL queries to extract sensitive data from the database, such as database names, usernames, and passwords.

The LightSync Pro plugin for WordPress allows authenticated attackers with Author-level access or higher to upload arbitrary files to the server. This issue occurs because the `rest replace media()` function fails to validate file types, which could lead to remote code execution.

An arbitrary file deletion issue exists due to path traversal, where an attacker can use special character sequences to access and delete files outside the intended directory. The flaw occurs because the `img file` field within the `cegg data` post metadata is not properly validated, as the `wp strip all tags()` function fails to remove path traversal sequences. This value is stored in post meta and subsequently concatenated into a filesystem path within the `getFullImgPath()` function before being processed by the PHP `unlink()` function. Authenticated users with author-level access or higher can exploit this to delete arbitrary files on the server, which may lead to remote code execution.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the `lgx tooltip position` parameter. These scripts execute automatically when a user visits the affected page.