Azril Fathoni

**Name of the Vulnerable Software and Affected Versions** VikBooking Hotel Booking Engine & PMS versions prior to 1.8.9 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. This occurs via the `special requests` parameter, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page. **Recommendations** Update VikBooking Hotel Booking Engine & PMS to version 1.8.9 or later. As a temporary mitigation, restrict or disable the use of the `special requests` parameter.

**Name of the Vulnerable Software and Affected Versions** Custom Payment Gateways for WooCommerce versions prior to 2.1.1 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. An unauthenticated guest user can inject arbitrary web scripts by submitting a crafted checkout POST request using the `alg wc cpg input fields` parameter. These scripts execute whenever a user accesses the affected page. **Recommendations** Update Custom Payment Gateways for WooCommerce to version 2.1.1 or later. As a temporary mitigation, disable the plugin until the update is applied.

**Name of the Vulnerable Software and Affected Versions** HT Contact Form – Drag & Drop Form Builder for WordPress versions prior to 2.8.3 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the `file upload` parameter. Exploitation is possible when the 'Store Submissions' setting is enabled, allowing unsanitized values to be saved to the database and later rendered using `dangerouslySetInnerHTML` in the admin entry viewer, executing the scripts when a user accesses the affected page. **Recommendations** Update to a version newer than 2.8.2. Disable the 'Store Submissions' setting as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress versions prior to 10.8.3 **Description** The plugin fails to properly verify if a user is authorized to perform specific actions. This allows authenticated attackers with subscriber-level access or higher to modify privileged configuration settings and export subscriber secret keys. If a target administrator's email address is known, these actions can be chained to achieve a full administrator account takeover. The issue is associated with the `acymailing router` endpoint. **Recommendations** Update the plugin to a version later than 10.8.2.

Name of the Vulnerable Software and Affected Versions Contact Form by Supsystic plugin for WordPress versions up to and including 1.7.36 Description The Contact Form by Supsystic plugin for WordPress is susceptible to Server-Side Template Injection (SSTI), which can lead to Remote Code Execution (RCE). This occurs because the plugin utilizes the Twig `Twig Loader String` template engine without proper sandboxing. The `cfsPreFill` functionality allows unauthenticated users to inject arbitrary Twig expressions into form field values through GET parameters. Attackers can exploit the `registerUndefinedFilterCallback()` method within Twig to register arbitrary PHP callbacks, ultimately enabling the execution of PHP functions and operating system commands on the server. Recommendations Update the Contact Form by Supsystic plugin to a version newer than 1.7.36.