Daroo

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload file remove() AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $ POST when no real $ FILES upload is provided (process account() calls uwp validate fields() and array merges the result with the empty output of UsersWP Files::validate uploads()). At storage time the value is only checked with validate file(), which passes any string that does not contain a literal '../'. When the value is later processed by upload file remove(), it is again gated with validate file() and then normalized through uwp get file relative url(); that helper performs a global str replace() of the uploads base URL against the stored URL, allowing a crafted URL containing embedded '..<uploads-baseurl>' tokens to collapse into '../../' traversal sequences after the last validation. The transformed value is then appended to the uploads base directory and passed to wp delete file() without any canonical containment check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the affected site's server (including wp-config.

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the `user[name]` Parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires "Embed images" option in AcyMailing configuration being enabled.

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit works by embedding KSES-allowed markup such as abbr title attributes and HTML comments in a submitted comment so that the global strtr() substitution strips substrings from an inert tag, mutating it into an executable element such as an img onerror handler that runs in the WordPress origin for any visitor, including logged-in administrators.

**Name of the Vulnerable Software and Affected Versions** Welcart e-Commerce plugin for WordPress versions prior to 2.12.2 **Description** PHP Object Injection occurs due to the deserialization of untrusted input within the Telecom EDY payment callback `usces action acting transaction()`. Unauthenticated attackers can store arbitrary `reserve` key/value pairs as order metadata during a public checkout. By invoking the callback with a specific `option` parameter, the attacker can trigger the unserialization of this metadata without provider signatures, source-address, transaction-identity, or ownership checks. A POP (Property Oriented Programming) chain—a technique used to execute code by leveraging existing classes in the application—is present in the bundled TCPDF library. This allows attackers to delete arbitrary files on the server, such as `wp-config.php`, potentially leading to remote code execution if the WordPress installer is re-run against a database controlled by the attacker. Successful exploitation requires an administrator to print an invoice to trigger the file deletion. **Recommendations** Update the Welcart e-Commerce plugin for WordPress to version 2.12.2 or later.

The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives save-time sanitization because wp kses post allows the required HTML tags and attributes, and the client-side tooltip script re-parses the browser-decoded aria-label value as innerHTML while only stripping script elements, leaving onerror and other event-handler attributes fully intact and executable.

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The plugin accepts review submissions from unauthenticated users through the 'cr local forms submit' AJAX action without sanitizing HTML content before storing it via wp insert comment(), and later renders this stored content on product pages through comment text() without proper escaping. This makes it possible for unauthenticated attackers with a valid review form URL (obtainable through review reminder emails sent to customers who placed orders) to inject arbitrary web scripts in pages that will execute whenever a user accesses the affected product page.

**Name of the Vulnerable Software and Affected Versions** TranslatePress – Translate Multilingual sites with AI Translation versions prior to 3.3.4 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This is possible because the WordPress comment KSES allowlist permits a specific payload structure consisting of an anchor tag with `href` and `title` attributes and a `code` tag. This allows malicious comments to be stored in the database and subsequently processed by the vulnerable HTML parser during page translation. **Recommendations** Update to version 3.3.4 or later.

**Name of the Vulnerable Software and Affected Versions** GiveWP – Donation Plugin and Fundraising Platform versions prior to 4.14.5 **Description** Stored Cross-Site Scripting (XSS) occurs via the 'give form' shortcode. The issue stems from insufficient input sanitization and output escaping of the `continue button title` and `display style` shortcode attributes. Although these attributes are processed by the `sanitize text field()` function, they are not properly escaped when rendered in HTML data attributes. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update to version 4.14.5 or later. Restrict the use of the `continue button title` and `display style` attributes within the 'give form' shortcode until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Forminator Forms – Contact Form, Payment Form & Custom Form Builder versions prior to 1.57.0.2 **Description** Insufficient input sanitization and output escaping in the Rich-Text Textarea Field allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. This allows the injection of arbitrary web scripts into pages that execute when a user accesses them. Exploitation is possible only if the targeted Textarea field has the Rich-Text editor option enabled. **Recommendations** Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to version 1.57.0.2 or later. As a temporary mitigation, disable the Rich-Text editor option for all Textarea fields.

**Name of the Vulnerable Software and Affected Versions** Like Button Rating versions prior to 2.6.62 **Description** An SQL Injection issue exists that allows users with subscriber privileges to execute unauthorized database queries. **Recommendations** Update Like Button Rating to version 2.6.62 or later.

**Name of the Vulnerable Software and Affected Versions** Booking and Rental Manager versions prior to 2.7.6 **Description** An issue exists that allows for PHP Object Injection, a technique where an attacker leverages the deserialization of untrusted data to instantiate arbitrary objects and execute malicious code within the application. **Recommendations** Update to a version newer than 2.7.5.

**Name of the Vulnerable Software and Affected Versions** Music Player for WooCommerce versions prior to 1.9.0 **Description** Unauthenticated Cross Site Scripting (XSS) allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. **Recommendations** Update Music Player for WooCommerce to version 1.9.0 or later.

**Name of the Vulnerable Software and Affected Versions** Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More versions prior to 6.33.2 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. By forging the `frm user id` parameter to match an administrator's user ID, which can be obtained via the public WordPress REST API, the attacker ensures that `wp kses post()` acts as the sole output filter. This allows the injected payload to remain structurally intact, which the plugin's admin JavaScript then decodes and executes automatically upon page load. **Recommendations** Update to version 6.33.2 or later. As a temporary mitigation, restrict access to the `frm user id` parameter to prevent unauthorized manipulation.

The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. This is due to flawed HMAC generation in the mbw get hash key() function that uses the current user's identity instead of the cookie username parameter when a WordPress user is logged in, combined with insufficient validation in mbw validate auth cookie(). This makes it possible for authenticated attackers, with subscriber-level access and above, to forge administrator authentication cookies and change administrator passwords to achieve complete site takeover.

**Name of the Vulnerable Software and Affected Versions** Forminator Forms – Contact Form, Payment Form & Custom Form Builder versions prior to 1.57.0.3 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue exists because the Save-and-Continue draft submission AJAX endpoint is registered as `nopriv`, enabling attackers to bypass radio field option-membership validation. This allows the persistence of a crafted payload that executes automatically via the bundled Inputmask library's data-attribute callback binding when the Submissions admin page is accessed. **Recommendations** Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to version 1.57.0.3 or later.

**Name of the Vulnerable Software and Affected Versions** WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels versions prior to 4.9.9 **Description** An issue exists in the `get image src in base64()` function that allows authenticated users with subscriber-level access or higher to perform Directory Traversal. This enables the reading of arbitrary files from the server, potentially exposing sensitive information. The process involves the `customer note` parameter, where base64-encoded file contents are embedded into cached invoice HTML and delivered through the plugin's Print/Download invoice endpoints using a valid nonce and access key. **Recommendations** Update to a version newer than 4.9.8. As a temporary mitigation, restrict access to the `get image src in base64()` function or the `customer note` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** WPForms Pro versions prior to 2.0.0.3 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). This occurs when arbitrary web scripts are injected via Single Line Text and Paragraph Text Field values, which then execute when a user accesses the affected page. The issue stems from the `wp kses allowed html` filter expanding the 'post' allowlist to permit `iframe` elements with a `data-src` attribute. Because `data-src` is not on the standard WordPress URI-attribute sanitization list, a `javascript:` URI can bypass processing and be converted into a live `src` attribute by the `view-entry.min.js` admin script. **Recommendations** Update to a version newer than 2.0.0.2.