Bhumividh Treloges

The Mandatory Field plugin for WordPress is susceptible to Stored Cross-Site Scripting through admin settings. Insufficient input sanitization and output escaping allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages. These scripts execute when a user accesses the injected page. This issue specifically impacts multi-site installations and those where unfiltered html has been disabled.

The Survey plugin for WordPress is susceptible to Stored Cross-Site Scripting through admin settings. Insufficient input sanitization and output escaping allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. This issue only impacts multi-site installations and those where unfiltered html has been disabled.

The WP App Bar plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `app-bar-features` parameter. This is a result of inadequate input sanitization and output escaping, coupled with a missing authorization check within the `App Bar Settings` class constructor. This allows unauthenticated attackers to inject arbitrary web scripts into multiple plugin settings, which will then execute when a user accesses the admin settings page.

The software is susceptible to Stored Cross-Site Scripting through admin settings due to inadequate input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. This issue only impacts multi-site installations and those where unfiltered html has been disabled.

The Tennis Court Bookings plugin for WordPress is susceptible to Stored Cross-Site Scripting through admin settings. Insufficient input sanitization and output escaping allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. This issue only impacts multi-site installations and those where unfiltered html has been disabled.

The salavat counter Plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `image url` parameter. Insufficient input sanitization and output escaping allow authenticated attackers with administrator-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

The PostmarkApp Email Integrator plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is caused by inadequate input sanitization and output escaping of the `pma api key` and `pma sender address` parameters within the plugin settings. An authenticated attacker with Administrator-level access or higher can inject malicious web scripts that execute when users access the settings page.

The TalkJS plugin for WordPress is susceptible to Stored Cross-Site Scripting through admin settings. Insufficient input sanitization and output escaping allow authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts. These scripts execute when a user accesses an injected page. This issue specifically impacts multi-site installations and those where unfiltered html has been disabled.

The User Language Switch plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `tab color picker language switch` parameter. Insufficient input sanitization and output escaping allow authenticated attackers with administrator-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. This issue only impacts multi-site installations and installations where unfiltered html has been disabled.

The User Language Switch plugin for WordPress is susceptible to Server-Side Request Forgery due to insufficient URL validation within the `download language()` function. This allows authenticated attackers with Administrator-level access or higher to initiate web requests to arbitrary locations from the web application. This could potentially allow querying and modification of information from internal services.

The Super Simple Contact Form plugin for WordPress is susceptible to Reflected Cross-Site Scripting. This is due to inadequate input sanitization and output escaping of the `sscf name` parameter. An unauthenticated attacker can inject arbitrary web scripts into pages, which will execute if a user is tricked into performing an action, such as clicking a link.

The WPlyr Media Block plugin for WordPress has a Stored Cross-Site Scripting issue. This is due to inadequate input sanitization and output escaping of user-provided attributes. Specifically, the ` wplyr accent color` parameter is vulnerable. Authenticated attackers with Administrator-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page.

The software is susceptible to Stored Cross-Site Scripting through the `tag-image` parameter. Insufficient input sanitization and output escaping allow authenticated attackers with Editor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

The iONE360 Configurator plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to inadequate input sanitization and output escaping in the Contact Form Parameters. An unauthenticated attacker can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

The Extended Random Number Generator plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin settings. Insufficient input sanitization and output escaping allow authenticated attackers with administrator-level access to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. This issue specifically impacts multi-site installations and those where unfiltered html has been disabled.

The WebPurify Profanity Filter plugin for WordPress has a flaw that allows unauthorized modification of data. This is due to a missing capability check on the `webpurify save options` function. Unauthenticated attackers can exploit this to change plugin settings.

The WP Content Permission plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping in the `ohmem-message` parameter. An authenticated attacker with Administrator-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. The API endpoint involved is not explicitly mentioned. The vulnerable parameter is `ohmem-message`.

The Code Explorer plugin for WordPress has a flaw that allows authorized users with Administrator-level access or higher to read arbitrary files on the server. This is possible through the `file` parameter, potentially exposing sensitive information.

The All push notification for WP plugin for WordPress is susceptible to time-based SQL Injection via the `delete id` parameter. This is due to inadequate escaping of user-supplied input and insufficient preparation of the existing SQL query. Successful exploitation allows authenticated attackers with administrator-level access or higher to inject additional SQL queries into existing queries, potentially enabling the extraction of sensitive information from the database.

The JavaScript Notifier plugin for WordPress is susceptible to Stored Cross-Site Scripting through plugin settings. This is caused by inadequate input sanitization and output escaping of user-supplied attributes within the `wp footer` action. An authenticated attacker with administrator privileges can inject arbitrary web scripts into pages, which will then execute when a user accesses the affected page.