Catalin Oancea

**Name of the Vulnerable Software and Affected Versions** bbp Style Pack versions prior to 6.4.6 **Description** The bbp Style Pack plugin for WordPress contains a Stored Cross-Site Scripting issue within the Topic Form Additional Fields feature. The flaw exists because the `bsp topic fields form save()` function fails to sanitize the `bsp topic fields label{n}` parameter from the `$ POST` array before saving it to post meta using `update post meta()`. Additionally, the `bsp topic content append topic fields()` function does not escape the stored meta value when echoing it into an HTML `<span>` element. Authenticated users with Subscriber-level access or higher who can create bbPress topics can inject arbitrary web scripts that execute when any user, including unauthenticated visitors, views the affected page. **Recommendations** Update bbp Style Pack to version 6.4.6 or later. As a temporary mitigation, restrict the ability of Subscriber-level users to create topics or disable the Topic Form Additional Fields feature.

**Name of the Vulnerable Software and Affected Versions** Taskbuilder – Project Management & Task Management Tool With Kanban Board versions prior to 5.0.9 **Description** An issue exists where authenticated users with subscriber-level access and above can perform a SQL Injection. This occurs because the `wppm proj filter` parameter is not sufficiently escaped and the SQL query is not properly prepared. Attackers can append additional SQL queries to extract sensitive information from the database. The vulnerability is reachable via the `wp ajax wppm view project tasks` handler, which lacks nonce verification (a security token used to prevent cross-site request forgery). **Recommendations** Update to a version newer than 5.0.8. Avoid using the `wppm proj filter` parameter in the `wp ajax wppm view project tasks` handler until the update is applied.

**Name of the Vulnerable Software and Affected Versions** ClearSale Total versions prior to 3.4.3 **Description** An issue exists in the `clearsale total push` AJAX action where the `pagseguro[metodo]` POST parameter is not properly sanitized. The handler is accessible to unauthenticated users via `wp ajax nopriv clearsale total push`. Although a nonce check is present, the failure mechanism is disabled, allowing execution to continue. On servers running PHP versions earlier than 8.0, loose type juggling allows a string to be treated as an integer during a comparison in a `switch` statement, enabling an attacker to inject malicious SQL into an `UPDATE` query. This allows unauthenticated attackers to append additional queries to extract sensitive information from the database. **Recommendations** Update ClearSale Total to version 3.4.3 or later. As a temporary mitigation, ensure the server is running PHP 8.0 or newer to prevent the type juggling behavior.