Bob Matyas

**Name of the Vulnerable Software and Affected Versions** Nexter Blocks versions prior to 5.0.2 **Description** Stored Cross-Site Scripting occurs because the plugin fails to sanitize uploaded SVG files. Users with file upload permissions, such as the Author role by default, can upload an SVG file containing malicious JavaScript. This script executes when the file is accessed. **Recommendations** Update Nexter Blocks to version 5.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** Court Reservation WordPress plugin versions prior to 1.10.9 **Description** The Court Reservation WordPress plugin does not include a Cross-Site Request Forgery (CSRF) check when deleting events. This could allow an attacker to make a logged-in administrator delete events through a CSRF attack. The affected functionality involves event deletion. **Recommendations** Update the Court Reservation WordPress plugin to version 1.10.9 or later.

**Name of the Vulnerable Software and Affected Versions** WP eCommerce versions through 3.15.1 **Description** The WP eCommerce WordPress plugin does not implement Cross-Site Request Forgery (CSRF) checks when deleting coupons. This allows an attacker to potentially make a logged-in administrator remove coupons through a CSRF attack. **Recommendations** Update WP eCommerce to a version beyond 3.15.1.

**Name of the Vulnerable Software and Affected Versions** Conditional CAPTCHA WordPress plugin versions through 4.0.0 **Description** The software does not properly validate a parameter before redirecting a user, which can lead to an Open Redirect issue. The `redirect url` parameter is susceptible to manipulation, allowing an attacker to redirect users to a malicious website. **Recommendations** Versions prior to 4.0.0 should be updated.

**Name of the Vulnerable Software and Affected Versions** Five Star Restaurant Reservations WordPress plugin versions prior to 2.7.9 **Description** The plugin lacks CSRF checks in certain bulk actions. This could allow attackers to make logged-in administrators perform unintended actions, such as deleting bookings, through Cross-Site Request Forgery attacks. The affected actions involve bulk operations performed by administrators. **Recommendations** Update the Five Star Restaurant Reservations WordPress plugin to version 2.7.9 or later.

**Name of the Vulnerable Software and Affected Versions** WPS Visitor Counter Plugin versions through 1.4.8 **Description** The plugin does not properly handle the `$ SERVER['REQUEST URI']` parameter before displaying it, potentially allowing for Reflected Cross-Site Scripting (XSS) in older web browsers. The vulnerable parameter is used in an attribute without proper escaping. **Recommendations** Update WPS Visitor Counter Plugin to a version later than 1.4.8.

**Name of the Vulnerable Software and Affected Versions** Guest posting / Frontend Posting / Front Editor WordPress plugin versions prior to 5.0.0 **Description** The software does not properly check user-supplied data before redirecting the user, which can lead to an open redirection. This means a malicious actor could potentially redirect users to a website of their choosing. The vulnerable parameter is used in a redirect operation without validation. **Recommendations** Update to version 5.0.0 or later.

**Name of the Vulnerable Software and Affected Versions** NS Maintenance Mode for WP WordPress plugin versions through 1.3.1 **Description** The plugin does not properly sanitize and escape certain settings, potentially allowing users with high privileges, such as administrators, to carry out Stored Cross-Site Scripting (XSS) attacks. This can occur even when the `unfiltered html` capability is not permitted, for example, in a multisite configuration. The issue involves insufficient input validation, which could allow malicious scripts to be stored and executed within the application. **Recommendations** Update NS Maintenance Mode for WP WordPress plugin to a version later than 1.3.1.

**Name of the Vulnerable Software and Affected Versions** Etsy Shop WordPress plugin versions prior to 3.0.7 **Description** The plugin does not properly sanitize the `$ SERVER['REQUEST URI']` parameter before using it in an attribute, potentially allowing for Reflected Cross-Site Scripting in older web browsers. The `$ SERVER['REQUEST URI']` parameter is used without escaping, which could allow an attacker to inject malicious scripts. **Recommendations** Update to Etsy Shop WordPress plugin version 3.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** Markup Markdown WordPress plugin versions prior to 3.20.10 **Description** The plugin allows links to contain JavaScript, potentially enabling users with contributor or higher roles to carry out Stored Cross-Site Scripting attacks. **Recommendations** Update the Markup Markdown WordPress plugin to version 3.20.10 or later.

Name of the Vulnerable Software and Affected Versions: Contact Form 7 reCAPTCHA WordPress plugin versions through 1.2.0 Description: The plugin does not escape the `$ SERVER['REQUEST URI']` parameter before outputting it, potentially leading to Reflected Cross-Site Scripting in older web browsers. Recommendations: Update to a version beyond 1.2.0.

Name of the Vulnerable Software and Affected Versions: Wp Edit Password Protected WordPress plugin versions prior to 1.3.5 Description: The Wp Edit Password Protected WordPress plugin does not validate a parameter before redirecting the user to its value, resulting in an Open Redirect issue. Recommendations: Update the Wp Edit Password Protected WordPress plugin to version 1.3.5 or later.

Name of the Vulnerable Software and Affected Versions: The Ebook Store WordPress plugin versions prior to 5.8015 Description: The Ebook Store WordPress plugin does not escape the `$ SERVER['REQUEST URI']` parameter before outputting it, potentially leading to Reflected Cross-Site Scripting in older web browsers. Recommendations: Update The Ebook Store WordPress plugin to version 5.8015 or later.

Name of the Vulnerable Software and Affected Versions: WP Shopify WordPress plugin versions prior to 1.5.4 Description: The WP Shopify WordPress plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue. This could be used against high privilege users, such as administrators. Recommendations: Update the WP Shopify WordPress plugin to version 1.5.4 or later.

Name of the Vulnerable Software and Affected Versions: Injection Guard WordPress plugin versions prior to 1.2.8 Description: The Injection Guard WordPress plugin does not properly escape the `$ SERVER['REQUEST URI']` parameter before displaying it within an attribute. This could lead to Reflected Cross-Site Scripting (XSS) in older web browsers. Recommendations: Update to Injection Guard WordPress plugin version 1.2.8 or later.

Name of the Vulnerable Software and Affected Versions: CBX Restaurant Booking WordPress plugin versions through 1.2.1 Description: The plugin lacks CSRF (Cross-Site Request Forgery) protection when updating settings. This could allow attackers to make a logged-in administrator change settings via a CSRF attack. Recommendations: Update the CBX Restaurant Booking WordPress plugin to a version later than 1.2.1.

**Name of the Vulnerable Software and Affected Versions:** Hostel WordPress plugin versions prior to 1.1.5.9 **Description:** The Hostel WordPress plugin does not properly sanitize and escape certain settings. This could allow users with high privileges, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks, even when the `unfiltered html` capability is disabled, for example, in a multi-site setup. Stored XSS attacks involve injecting malicious scripts into a website that are then stored and executed when other users visit the affected page. **Recommendations:** Update the Hostel WordPress plugin to version 1.1.5.9 or later.

**Name of the Vulnerable Software and Affected Versions** File Provider versions 1.2.3 and earlier **Description** The issue is related to the lack of a CSRF check when updating settings in the File Provider WordPress plugin. This could allow attackers to make a logged-in admin change the settings via a CSRF attack. **Recommendations** For versions 1.2.3 and earlier, consider disabling the settings update functionality until a patch is available. Restrict access to the settings update module to minimize the risk of exploitation. Avoid using the plugin's settings update feature until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Ninja Forms WordPress plugin versions prior to 3.10.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for example in a multisite setup. The problem arises because some settings are not properly sanitised and escaped. Recommendations: For versions prior to 3.10.1, update to version 3.10.1 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin versions 2.0.8 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised and escaped, making it vulnerable even when the unfiltered html capability is disallowed, for example in multisite setups. Recommendations: For Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin versions 2.0.8 and earlier, update to a version that properly sanitises and escapes its settings to prevent Stored Cross-Site Scripting attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.