Chiao-Lin Yu

**Name of the Vulnerable Software and Affected Versions** Persian Elementor (المنتور فارسی) versions prior to 2.8.2 **Description** This issue involves price manipulation where the plugin trusts a user-supplied payment amount without server-side validation against the configured ZarinPal widget price. This allows unauthenticated attackers to submit arbitrary payment amounts to the ZarinPal gateway using the `amount` parameter. **Recommendations** Update the plugin to version 2.8.2 or later. Avoid using the `amount` parameter in the ZarinPal gateway integration until the update is applied.

**Name of the Vulnerable Software and Affected Versions** SpeedyCache versions prior to 1.3.9 **Description** An Arbitrary File Read issue exists due to Path Traversal, which occurs when a mismatch between CSS URL validation and path resolution allows query strings to bypass checks. Because the system does not verify if the resolved file is actually a CSS file, authenticated attackers with Administrator-level access can inject crafted `<link>` tags into page content. This process allows the reading of sensitive server files, such as `wp-config.php` and `/etc/passwd`, by writing their contents into publicly accessible cache files. **Recommendations** Update SpeedyCache to version 1.3.9 or later.

**Name of the Vulnerable Software and Affected Versions** Enable jQuery Migrate Helper versions prior to 1.4.2 **Description** The plugin allows unauthorized modification of data because the `downgrade jquery version()` function fails to perform a capability check, verifying only a nonce. This allows authenticated users with Subscriber-level access or higher to downgrade the site-wide jQuery version from 3.7.1 to the legacy 1.12.4-wp release, which contains known security flaws. **Recommendations** Update the plugin to version 1.4.2 or later. As a temporary mitigation, restrict access to the `downgrade jquery version()` function for users with low-level privileges.

**Name of the Vulnerable Software and Affected Versions** HTTP Headers plugin for WordPress versions prior to 1.19.3 **Description** Insufficient validation of the file path stored in the `hh htpasswd path` option and lack of sanitization on the `hh www authenticate user` option value allow authenticated attackers with Administrator-level access and above to achieve Remote Code Execution. The plugin permits setting an arbitrary file path for the htpasswd file without restricting it to safe extensions. The `apache auth credentials()` function constructs file content using an unsanitized username via `sprintf()`, and the `update auth credentials()` function writes this content to the attacker-controlled path using `file put contents()`, enabling the writing of arbitrary content, such as PHP code, to the server. **Recommendations** Update the plugin to a version newer than 1.19.2.

**Name of the Vulnerable Software and Affected Versions** WebStack versions prior to 1.2025 **Description** The WebStack theme for WordPress allows unauthenticated attackers to upload arbitrary files to the server. This is caused by a lack of file type validation within the `io img upload()` function, which could lead to remote code execution. **Recommendations** Update to a version later than 1.2024. As a temporary workaround, consider disabling the `io img upload()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** The Germanized for WooCommerce plugin for WordPress versions prior to 3.20.6 **Description** The software allows unauthenticated attackers to execute arbitrary shortcodes. This occurs because the application fails to properly validate a value before running the `do shortcode()` function via the `account holder` parameter. **Recommendations** Update the plugin to a version later than 3.20.5. As a temporary workaround, restrict access to the `account holder` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** HT Mega Addons for Elementor versions prior to 3.0.7 **Description** An unauthenticated AJAX action allows the exposure of personally identifiable information (PII), including full name, city, state, and country, of customers who have placed orders within the last 7 days. **Recommendations** Update to version 3.0.7 or later.

Name of the Vulnerable Software and Affected Versions YITH WooCommerce Wishlist WordPress plugin versions prior to 4.13.0 Description The YITH WooCommerce Wishlist WordPress plugin does not properly validate wishlist ownership in the `save title()` AJAX handler when renaming wishlists. The function only verifies a nonce, which is publicly available, allowing unauthenticated attackers to rename any user's wishlist. Recommendations Update to version 4.13.0 or later.

Name of the Vulnerable Software and Affected Versions Spam Protect for Contact Form 7 WordPress plugin versions prior to 1.2.10 Description The Spam Protect for Contact Form 7 WordPress plugin before version 1.2.10 allows logging to a PHP file. This could allow an attacker with editor access to achieve Remote Code Execution by using a crafted header. Recommendations Update the Spam Protect for Contact Form 7 WordPress plugin to version 1.2.10 or later.

**Name of the Vulnerable Software and Affected Versions** WP Maps – Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters plugin for WordPress versions up to and including 4.9.1 **Description** The WP Maps plugin for WordPress is susceptible to time-based SQL Injection. This is due to inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries, specifically through the `orderby` parameter. This allows unauthenticated attackers to inject additional SQL queries into existing database queries, potentially extracting sensitive information. **Recommendations** Update the WP Maps – Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters plugin to a version later than 4.9.1.

**Name of the Vulnerable Software and Affected Versions** EmailKit – Email Customizer for WooCommerce & WP versions prior to 1.6.4 **Description** The EmailKit plugin for WordPress is susceptible to unauthorized file access through a path traversal flaw. This occurs because the `action()` function within the TemplateData class directly uses user-provided input from the 'emailkit-editor-template' REST API parameter with the `file get contents()` function, lacking proper path validation, sanitization, or directory restrictions. Authenticated attackers possessing Administrator privileges can exploit this to read arbitrary files on the server, such as /etc/passwd or wp-config.php, by providing a crafted traversal path. The retrieved file contents are then stored as post meta and can be accessed through the `fetch-data` API endpoint. **Recommendations** Update EmailKit – Email Customizer for WooCommerce & WP to version 1.6.4 or later.

**Name of the Vulnerable Software and Affected Versions** The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress versions up to and including 1.4.7 **Description** The plugin is susceptible to PHP Object Injection due to deserialization of untrusted input within the `download csv` function. This allows unauthenticated attackers to inject a PHP Object. The impact of this issue is limited unless another plugin or theme containing a PHP Object Payload (POP) chain is installed on the same site. If a POP chain is present, an attacker may be able to perform actions such as deleting arbitrary files, retrieving sensitive data, or executing code. **Recommendations** Versions prior to 1.4.7 should be updated. As a temporary workaround, consider restricting access to the `download csv` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Email Subscribers by Icegram Express plugin for WordPress versions up to and including 5.9.16 **Description** The Email Subscribers by Icegram Express plugin for WordPress is susceptible to SQL Injection through the `workflow ids` parameter. Insufficient input validation and query preparation allow authenticated attackers with administrator-level access or higher to inject additional SQL queries into existing database queries. This could lead to the extraction of sensitive information from the database. The API endpoint involved is not explicitly mentioned. **Recommendations** Update the Email Subscribers by Icegram Express plugin to a version later than 5.9.16.

**Name of the Vulnerable Software and Affected Versions** LatePoint – Calendar Booking Plugin for Appointments and Events versions up to and including 5.2.7 **Description** The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is susceptible to SQL Injection through the JSON Import functionality. Insufficient validation of user-supplied JSON data allows authenticated attackers with Administrator-level access or higher to execute arbitrary SQL queries. This could lead to information extraction using time-based techniques, data modification, or table deletion. The vulnerability resides in how the plugin handles the JSON import process. The `JSON` data is not properly sanitized before being used in database queries. **Recommendations** Update LatePoint – Calendar Booking Plugin for Appointments and Events to a version later than 5.2.7.

**Name of the Vulnerable Software and Affected Versions** EmailKit – Email Customizer for WooCommerce & WP versions prior to 1.6.3 **Description** The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress has a flaw that allows unauthorized data modification. This is due to a missing capability check within the `update template data()` function. Authenticated attackers with Subscriber-level access or higher can modify the title of any post, page, or custom post type on the site. **Recommendations** Update EmailKit – Email Customizer for WooCommerce & WP to version 1.6.3 or later.

**Name of the Vulnerable Software and Affected Versions** Element Pack Addons for Elementor versions prior to 8.3.18 **Description** The Element Pack Addons for Elementor plugin for WordPress contains a flaw that allows authenticated attackers with contributor-level access or higher to read arbitrary files on the server. This is possible due to insufficient file validation within the `render svg` function when using the SVG widget. The issue could expose sensitive information contained in these files. **Recommendations** Update Element Pack Addons for Elementor to version 8.3.18 or later.

**Name of the Vulnerable Software and Affected Versions** LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.2.7 **Description** The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check within the `load step()` function. An unauthenticated attacker can view booking information, including customer names, email addresses, phone numbers, appointment times, and service details. **Recommendations** Update to version 5.2.7 or later.

Name of the Vulnerable Software and Affected Versions: DASAN GPON ONU H660WM versions H660WMR210825 Description: The DASAN GPON ONU H660WM device contains insecure default credentials in the modem’s control panel. Recommendations: Change the default credentials of the modem’s control panel.

Name of the Vulnerable Software and Affected Versions: D-Link DSL-7740C versions DSL7740C.V6.TR069.20211230 Description: An incorrect access control issue exists in the Maintenance module. Authenticated attackers with low-level privileges can arbitrarily change high-privileged account passwords and escalate privileges. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: D-Link DSL-7740C versions DSL7740C.V6.TR069.20211230 Description: The D-Link DSL-7740C device with firmware DSL7740C.V6.TR069.20211230 contains a command injection issue via the `ping6` function. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.