Austin Ginder

The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'no results message' node preview Parameter in all versions up to, and including, 2.11.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

**Name of the Vulnerable Software and Affected Versions** WPMU DEV Dashboard versions prior to 5.0.1 **Description** An authentication bypass exists on sites not yet connected to the WPMU DEV Hub. Because the site API key used for the WDP-AUTH request signature is empty by default, the signature verified by the `validate hash()` function can be easily forged. Additionally, the `validate nonce()` function lacks a replay check, and the remote handler is bound to the public `init` hook without a capability check. This allows unauthenticated attackers to perform privileged Hub actions, such as logging in as an administrator via SSO, upgrading WordPress core, deleting themes and plugins, or installing and activating a plugin from a remote URL, which can lead to remote code execution. **Recommendations** Update the plugin to a version later than 5.0.0. Connect the site to a WPMU DEV account to ensure a non-empty 64-character API key is present.

**Name of the Vulnerable Software and Affected Versions** Meta Box AIO versions prior to 3.8.1 **Description** The MB Frontend Submission extension contains a missing authorization flaw within the `template redirect` dispatcher. The `handle request()` function routes the `mbfs delete` action without verifying user capabilities or ownership. Additionally, nonce verification in `check ajax()` is only performed if `is ajax()` is true, which is not the case for `template redirect` requests, allowing the check to be bypassed. Consequently, unauthenticated attackers can delete arbitrary posts and pages by providing a specific post ID through the `rwmb frontend field object id` GET parameter on any page hosting a frontend submission form, even if the `allow delete` setting is disabled. **Recommendations** Update to a version newer than 3.8.0. Restrict access to the `rwmb frontend field object id` parameter in the affected API endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** JetReviews versions prior to 3.0.0.2 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts into pages, which execute when a user accesses the affected page. **Recommendations** Update JetReviews to a version newer than 3.0.0.1.

**Name of the Vulnerable Software and Affected Versions** Link Whisper Premium versions prior to 2.9.1 **Description** The Link Whisper Premium plugin for WordPress contains a broken access control issue. A missing capability check in a function allows authenticated users with subscriber-level permissions or higher to perform unauthorized actions. **Recommendations** Update Link Whisper Premium to version 2.9.1 or later.

**Name of the Vulnerable Software and Affected Versions** GravityView versions prior to 3.0.1 **Description** The GravityView plugin for WordPress contains an Insecure Direct Object Reference (IDOR) flaw. This occurs due to missing validation on a user-controlled key, allowing unauthenticated attackers to perform unauthorized actions. **Recommendations** Update GravityView to a version newer than 3.0.0.

**Name of the Vulnerable Software and Affected Versions** Blocksy Companion Pro versions prior to 2.1.47 **Description** An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user-controlled key. This allows unauthenticated attackers to perform unauthorized actions. IDOR is a type of access control flaw where an application provides direct access to objects based on user-supplied input. **Recommendations** Update Blocksy Companion Pro to version 2.1.47 or later.

**Name of the Vulnerable Software and Affected Versions** Abandoned Cart Pro for WooCommerce versions prior to 10.4.1 **Description** The Abandoned Cart Pro for WooCommerce plugin for WordPress allows authenticated attackers with Subscriber-level access or higher to elevate their privileges to those of an administrator. **Recommendations** Update the plugin to a version later than 10.4.0.

**Name of the Vulnerable Software and Affected Versions** JetSmartFilters versions prior to 3.8.2 **Description** An unauthenticated SQL Injection allows an attacker to interfere with the queries that an application makes to its database. This occurs in the JetSmartFilters WordPress plugin. **Recommendations** Update to version 3.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** JetBlog versions prior to 2.4.9 **Description** The JetBlog plugin for WordPress allows unauthenticated attackers to extract sensitive user or configuration data due to a sensitive information exposure issue. **Recommendations** Update JetBlog to a version newer than 2.4.8.

**Name of the Vulnerable Software and Affected Versions** WooCommerce Anti-Fraud versions prior to 7.2.7 **Description** The WooCommerce Anti-Fraud plugin for WordPress contains a broken access control issue. This is caused by a missing capability check within a function, allowing unauthenticated attackers to perform unauthorized actions. **Recommendations** Update to a version newer than 7.2.6.