Benedictus Jovan

**Name of the Vulnerable Software and Affected Versions** Invoice123 versions prior to 1.7.1 **Description** An authorization bypass exists because the software fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can exploit this to overwrite the API key stored in `wp options`, modify plugin settings, and alter WooCommerce tax rate data within the `wp woocommerce tax rates` table. This is achieved through the AJAX actions `s123 submit api key()` and `s123 submit invoice settings()`. **Recommendations** Update Invoice123 to a version later than 1.7.0. As a temporary mitigation, restrict access to the `s123 submit api key()` and `s123 submit invoice settings()` AJAX actions.

**Name of the Vulnerable Software and Affected Versions** Library Management System versions prior to 3.5.8 **Description** An unauthenticated SQL Injection exists in the system, allowing an attacker to execute arbitrary SQL commands without providing credentials. **Recommendations** Update to a version newer than 3.5.7.

**Name of the Vulnerable Software and Affected Versions** Reviews and Rating – Docplanner plugin for WordPress versions prior to 1.1.5 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can trigger outbound scraping of external websites and write the resulting data into the `wp dp reviews` database table. Additionally, this flaw allows attackers to send feature-request emails using the site administrator's email address. **Recommendations** Update the plugin to a version newer than 1.1.4.

**Name of the Vulnerable Software and Affected Versions** WhatsOrder – Instant Checkout for WooCommerce versions prior to 1.0.2 **Description** The plugin is susceptible to sensitive information exposure through the `yapacdev generate order pdf` function. Unauthenticated attackers can extract personally identifiable information (PII) and order details—such as full names, email addresses, phone numbers, billing addresses, ordered items, quantities, prices, coupons, shipping methods, and order totals—by enumerating sequential order IDs. This occurs because invoice HTML files are stored in the publicly accessible `wp-content/uploads/whatsorder invoices/` directory without an `.htaccess` deny rule or `index.php` guard, allowing direct downloads over HTTP without authentication. **Recommendations** Update the plugin to a version newer than 1.0.1. Restrict access to the `wp-content/uploads/whatsorder invoices/` directory to prevent unauthorized downloads of invoice files.

**Name of the Vulnerable Software and Affected Versions** Generate Security.txt plugin for WordPress versions prior to 1.0.13 **Description** The plugin fails to properly verify user authorization for specific actions. This allows authenticated attackers with subscriber-level access or higher to delete the site's security.txt file from the server filesystem or create the .well-known directory. This is achieved by directly invoking the AJAX actions `delete securitytxt` and `create wellknown folder`. **Recommendations** Update the plugin to version 1.0.13 or later. As a temporary workaround, restrict access to the `delete securitytxt` and `create wellknown folder` AJAX actions for users with low-level privileges.

**Name of the Vulnerable Software and Affected Versions** Cargo Shipping Location for WooCommerce versions prior to 5.6 **Description** Improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. This occurs when the application fails to properly sanitize user-supplied data before including it in a database query, enabling an attacker to infer information from the database by observing the application's response to specific queries. **Recommendations** Update to version 5.6 or later.

**Name of the Vulnerable Software and Affected Versions** PeachPay — Payments & Express Checkout for WooCommerce versions prior to 1.120.47 **Description** Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the `peachpay stripe handle admin actions()` function. A nonce is a unique token used to prevent the replay of requests. This flaw allows unauthenticated attackers to permanently delete stored Stripe credentials from the WordPress database, including secret keys, publishable keys, webhook secrets, and Apple Pay configuration, by tricking a site administrator into clicking a malicious link. This action effectively disables Stripe payment processing for the store. **Recommendations** Update PeachPay — Payments & Express Checkout for WooCommerce to version 1.120.47 or later.

**Name of the Vulnerable Software and Affected Versions** WP To Do plugin for WordPress versions up to, and including, 1.3.0 **Description** The issue is a Stored Cross-Site Scripting problem due to insufficient input sanitization and output escaping, allowing authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages. This affects multi-site installations and installations where unfiltered html has been disabled. **Recommendations** For WP To Do plugin for WordPress versions up to, and including, 1.3.0, update to a version later than 1.3.0 to resolve the issue. As a temporary workaround, consider restricting access to the comment functionality to minimize the risk of exploitation. Additionally, ensure that unfiltered html is enabled, if possible, to reduce the vulnerability's impact.

**Name of the Vulnerable Software and Affected Versions** Pricing Table plugin for WordPress versions up to, and including, 2.0.1 **Description** The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `ajax()` function. This allows unauthenticated attackers to perform various actions related to managing pricing tables by tricking a site administrator into performing an action, such as clicking on a link. **Recommendations** For versions up to, and including, 2.0.1, update to a version that includes the fix for the missing or incorrect nonce validation on the `ajax()` function. As a temporary workaround, consider restricting access to the `ajax()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Pricing Table plugin for WordPress versions up to, and including, 2.0.1 **Description** The issue arises from a missing capability check on the `ajax()` function, allowing authenticated attackers with subscriber-level access and above to perform unauthorized actions, such as editing pricing tables. **Recommendations** For versions up to, and including, 2.0.1, update to a version higher than 2.0.1 to resolve the issue. As a temporary workaround, consider restricting access to the `ajax()` function to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Snippet Shortcodes plugin for WordPress versions up to, and including, 4.1.4 Description: The issue is due to missing or incorrect nonce validation when adding or editing shortcodes, making it possible for unauthenticated attackers to modify shortcodes via a forged request. This can be achieved if an attacker can trick a site administrator into performing an action, such as clicking on a link. Recommendations: For versions up to, and including, 4.1.4, update to a version higher than 4.1.4 to resolve the issue. As a temporary workaround, consider restricting access to shortcode editing and addition functionality to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Custom Product List Table plugin for WordPress versions up to, and including, 3.0.0 Description: The issue is due to missing or incorrect nonce validation when modifying products, making it possible for unauthenticated attackers to add, delete, bulk edit, approve, or cancel products via a forged request. This can happen if an attacker can trick a site administrator into performing an action, such as clicking on a link. Recommendations: For versions up to, and including, 3.0.0, update to a version that includes proper nonce validation to prevent Cross-Site Request Forgery attacks. As a temporary workaround, consider restricting access to product modification features to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress versions up to, and including, 1.9.2 **Description** The issue allows authenticated attackers with subscriber access or above to modify the plugin's settings due to a missing capability check on the `disable fe assets` function. Additionally, the lack of a nonce check results in a CSRF vulnerability, enabling attackers to change the plugin's settings without proper validation. **Recommendations** For versions up to, and including, 1.9.2, update to a version that includes a fix for the missing capability check on the `disable fe assets` function and implements a nonce check to prevent CSRF attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Fluid Notification Bar plugin for WordPress versions up to, and including, 3.2.3 **Description** The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue only affects multi-site installations and installations where unfiltered html has been disabled. **Recommendations** For versions up to, and including, 3.2.3, update to a version later than 3.2.3 to resolve the issue. As a temporary workaround, consider restricting access to admin settings to minimize the risk of exploitation. Additionally, ensure that unfiltered html is enabled, if possible, to reduce the vulnerability's impact.

**Name of the Vulnerable Software and Affected Versions** Nafeza Prayer Time plugin for WordPress versions up to, and including, 1.2.9 **Description** The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue only affects multi-site installations and installations where unfiltered html has been disabled. **Recommendations** For versions up to, and including, 1.2.9, update to a version that addresses the insufficient input sanitization and output escaping issue. As a temporary workaround, consider restricting access to admin settings to minimize the risk of exploitation. Additionally, ensure that unfiltered html is enabled, if possible, to reduce the attack surface.

**Name of the Vulnerable Software and Affected Versions** AffiEasy plugin for WordPress versions up to, and including, 1.1.7 **Description** The issue is related to Cross-Site Request Forgery. This occurs because the plugin improperly releases the tagged and patched version, using the vulnerable version as core files, while the patched version is included in a 'trunk' folder. This allows unauthenticated attackers to perform various actions via a forged request if they can trick a site administrator into performing an action, such as clicking on a link. **Recommendations** For versions up to, and including, 1.1.7, update to a version later than 1.1.7 to resolve the issue. As a temporary workaround, consider restricting access to administrative functions to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Comparison Slider plugin for WordPress versions up to, and including, 1.0.5 **Description** The issue allows authenticated attackers with subscriber access or above to modify data due to a missing capability check on several AJAX actions. This enables them to change plugin settings and perform other actions, such as deleting sliders. **Recommendations** For versions up to, and including, 1.0.5, update to a version that includes a fix for the missing capability check on AJAX actions to prevent unauthorized modification of data.

**Name of the Vulnerable Software and Affected Versions** Comparison Slider plugin for WordPress versions up to, and including, 1.0.5 **Description** The issue is related to Stored Cross-Site Scripting via the `slider title` parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers, with subscriber access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 1.0.5, update to a version that addresses the insufficient input sanitization and output escaping issue. As a temporary workaround, consider restricting access to the slider title parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WP To Do plugin for WordPress versions up to, and including, 1.3.0 **Description** The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `wptodo settings()` function. This allows unauthenticated attackers to modify the plugin's settings via a forged request if they can trick a site administrator into performing an action, such as clicking on a link. **Recommendations** For versions up to, and including, 1.3.0, consider disabling the `wptodo settings()` function until a patch is available to prevent modification of the plugin's settings via forged requests. Restrict access to the plugin's settings to minimize the risk of exploitation. Avoid using the plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Comparison Slider plugin for WordPress versions up to, and including, 1.0.5 **Description** The issue is due to missing or incorrect nonce validation on several functions hooked to AJAX actions, making it possible for unauthenticated attackers to change slider titles, delete sliders, and modify plugin settings via a forged request. This can be achieved if an attacker can trick a site administrator into performing an action, such as clicking on a link. **Recommendations** For versions up to, and including, 1.0.5, update to a version that includes proper nonce validation to prevent Cross-Site Request Forgery attacks. As a temporary workaround, consider restricting access to the AJAX actions hooked to the vulnerable functions until a patch is available.