Bob Matyas

Stored Cross-Site Scripting occurs because the plugin fails to sanitize uploaded SVG files. Users with file upload permissions, such as the Author role by default, can upload an SVG file containing malicious JavaScript. This script executes when the file is accessed.

The Court Reservation WordPress plugin does not include a Cross-Site Request Forgery (CSRF) check when deleting events. This could allow an attacker to make a logged-in administrator delete events through a CSRF attack. The affected functionality involves event deletion.

The WP eCommerce WordPress plugin does not implement Cross-Site Request Forgery (CSRF) checks when deleting coupons. This allows an attacker to potentially make a logged-in administrator remove coupons through a CSRF attack.

The plugin lacks CSRF checks in certain bulk actions. This could allow attackers to make logged-in administrators perform unintended actions, such as deleting bookings, through Cross-Site Request Forgery attacks. The affected actions involve bulk operations performed by administrators.

The software does not properly validate a parameter before redirecting a user, which can lead to an Open Redirect issue. The `redirect url` parameter is susceptible to manipulation, allowing an attacker to redirect users to a malicious website.

The plugin does not properly handle the `$ SERVER['REQUEST URI']` parameter before displaying it, potentially allowing for Reflected Cross-Site Scripting (XSS) in older web browsers. The vulnerable parameter is used in an attribute without proper escaping.

The software does not properly check user-supplied data before redirecting the user, which can lead to an open redirection. This means a malicious actor could potentially redirect users to a website of their choosing. The vulnerable parameter is used in a redirect operation without validation.

The plugin does not properly sanitize and escape certain settings, potentially allowing users with high privileges, such as administrators, to carry out Stored Cross-Site Scripting (XSS) attacks. This can occur even when the `unfiltered html` capability is not permitted, for example, in a multisite configuration. The issue involves insufficient input validation, which could allow malicious scripts to be stored and executed within the application.

The plugin allows links to contain JavaScript, potentially enabling users with contributor or higher roles to carry out Stored Cross-Site Scripting attacks.

The plugin does not properly sanitize the `$ SERVER['REQUEST URI']` parameter before using it in an attribute, potentially allowing for Reflected Cross-Site Scripting in older web browsers. The `$ SERVER['REQUEST URI']` parameter is used without escaping, which could allow an attacker to inject malicious scripts.

Name of the Vulnerable Software and Affected Versions: Contact Form 7 reCAPTCHA WordPress plugin versions through 1.2.0 Description: The plugin does not escape the `$ SERVER['REQUEST URI']` parameter before outputting it, potentially leading to Reflected Cross-Site Scripting in older web browsers. Recommendations: Update to a version beyond 1.2.0.

Name of the Vulnerable Software and Affected Versions: Wp Edit Password Protected WordPress plugin versions prior to 1.3.5 Description: The Wp Edit Password Protected WordPress plugin does not validate a parameter before redirecting the user to its value, resulting in an Open Redirect issue. Recommendations: Update the Wp Edit Password Protected WordPress plugin to version 1.3.5 or later.

Name of the Vulnerable Software and Affected Versions: The Ebook Store WordPress plugin versions prior to 5.8015 Description: The Ebook Store WordPress plugin does not escape the `$ SERVER['REQUEST URI']` parameter before outputting it, potentially leading to Reflected Cross-Site Scripting in older web browsers. Recommendations: Update The Ebook Store WordPress plugin to version 5.8015 or later.

Name of the Vulnerable Software and Affected Versions: WP Shopify WordPress plugin versions prior to 1.5.4 Description: The WP Shopify WordPress plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue. This could be used against high privilege users, such as administrators. Recommendations: Update the WP Shopify WordPress plugin to version 1.5.4 or later.

Name of the Vulnerable Software and Affected Versions: Injection Guard WordPress plugin versions prior to 1.2.8 Description: The Injection Guard WordPress plugin does not properly escape the `$ SERVER['REQUEST URI']` parameter before displaying it within an attribute. This could lead to Reflected Cross-Site Scripting (XSS) in older web browsers. Recommendations: Update to Injection Guard WordPress plugin version 1.2.8 or later.

Name of the Vulnerable Software and Affected Versions: CBX Restaurant Booking WordPress plugin versions through 1.2.1 Description: The plugin lacks CSRF (Cross-Site Request Forgery) protection when updating settings. This could allow attackers to make a logged-in administrator change settings via a CSRF attack. Recommendations: Update the CBX Restaurant Booking WordPress plugin to a version later than 1.2.1.

The Hostel WordPress plugin does not properly sanitize and escape certain settings. This could allow users with high privileges, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks, even when the `unfiltered html` capability is disabled, for example, in a multi-site setup. Stored XSS attacks involve injecting malicious scripts into a website that are then stored and executed when other users visit the affected page.

Name of the Vulnerable Software and Affected Versions: AVIF Uploader versions prior to 1.1.1 Description: The issue concerns the AVIF Uploader WordPress plugin, where uploaded SVG files are not properly sanitized. This could allow users with a role as low as Author to upload malicious SVG files containing XSS payloads. Recommendations: For versions prior to 1.1.1, update to version 1.1.1 or later to resolve the issue.

The issue is related to the lack of a CSRF check when updating settings in the File Provider WordPress plugin. This could allow attackers to make a logged-in admin change the settings via a CSRF attack.

Name of the Vulnerable Software and Affected Versions: Ninja Forms WordPress plugin versions prior to 3.10.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for example in a multisite setup. The problem arises because some settings are not properly sanitised and escaped. Recommendations: For versions prior to 3.10.1, update to version 3.10.1 or later to resolve the issue.