Daroo

The Ninja Forms - File Uploads add-on for WordPress allows unauthenticated attackers to delete arbitrary files on the server or perform arbitrary file reads via exfiltration to S3, Dropbox, or Google Drive. The issue exists in the `NF FU Fields Upload::process()` function within `includes/fields/upload.php` and the `NF FU External Abstracts Service::process upload()` function within `includes/external/abstracts/service.php`. By omitting the `upload id` variable, an attacker can ensure that the `data[file path]` variable persists in the Background Upload queue. This value is subsequently used by the `upload file to s3()` function as the `SourceFile` and by the `maybe delete server file()` function's `unlink()` call in `includes/external/abstracts/backgroundupload.php` without proper canonicalization or directory containment checks. Deleting critical files such as `wp-config.php` can force the application into its setup screen, potentially leading to full site takeover and remote code execution.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. This occurs via the Form Notification Dynamic-Data `action hook` through a Media Upload Chain involving ID3 Metadata and `html attributes`. An attacker can inject arbitrary web scripts into pages that execute when accessed by a user. Successful exploitation requires a Fusion Form to be embedded on a page authored by an administrator and a Post Cards element configured to display attachment post types to be present on a publicly accessible page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an affected page. Exploitation happens when an administrator opens the Submissions screen and clicks the Show-on-Map link of a poisoned entry, causing the `field id` value to be echoed unescaped into a JavaScript string within the `FormMakerEditCountryinPopup` popup. This process bypasses security checks using the administrator's session and the `fm ajax nonce` embedded in the link. The issue involves the `wdform <n> element<id>` parameter used in hidden input fields.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the `comment` parameter. Exploitation requires the site to have both comment indexing and comment highlighting options enabled. The injected script executes when a visitor accesses a singular page through a Relevanssi search-result permalink that includes the `highlight` query parameter.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. The `nf ajax submit` endpoint issues a valid nonce to any requester upon failure, which neutralizes the nonce check and allows exploitation via a single unauthenticated request using the `formData.extra` parameter.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. This occurs because Post Excerpt, Post Custom Field, and Rich-Text-Editor-enabled Paragraph Text fields permit raw HTML submissions through the `allow html()` function. An entity-encoded payload stored in a `data-dialog-confirm` attribute can bypass `wp kses post()` during the save process and is subsequently decoded into executable markup by the browser when the admin JavaScript utilizes the `insertAdjacentHTML()` function. This enables the execution of arbitrary web scripts when a user accesses an affected page.

Stored Cross-Site Scripting occurs via the bundled Freemius SDK purchase-completion handler due to insufficient input sanitization and output escaping. When the Freemius opt-in is active, the handler processes the `purchased plan` request parameter on any wp-admin request from an authenticated user without requiring specific capabilities, nonces, or purchase validation. The input is stored in a persistent, site-wide administrative notice, allowing authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts. These scripts execute automatically when an administrator views a standard admin page, such as the Profile page.

An authentication bypass exists in the Twitter/X Social Login handler. The issue occurs within the `verify twitter callback()` function where the handler fails to call `setOauthToken()` after exchanging the `oauth verifier` for an access token. Consequently, the `account/verify credentials` API call is signed using the site operator's stored Access Token and Access Token Secret instead of the visitor's token. This leads the X API to return the profile of the application owner, which the plugin then uses to authenticate a WordPress account via `wp set auth cookie()` based on the owner's email address. This allows unauthenticated attackers to gain access to the account associated with the X app owner, typically the site administrator.

Privilege escalation is possible through PHP Object Injection, which occurs when untrusted input is deserialized. This issue exists in the 'get-single-symbol' branch of the `kirki post apis()` AJAX dispatcher due to a missing capability check. Authenticated users with Subscriber-level access or higher can inject a PHP Object. By utilizing a POP chain (a sequence of gadgets used to execute arbitrary code during deserialization), an attacker can overwrite an administrator's password to gain full administrative access.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the `user email` parameter. Exploitation requires user registration to be enabled on the site. The injected script executes when an Administrator performs a user-spam scan and views the Non-checkable users or Spam users tab.

Insufficient input sanitization and output escaping allow for Stored Cross-Site Scripting. This occurs via the `quantity` parameter in the REST API and the `order comments` parameter during checkout. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses the affected page. If guest checkout is enabled, the attack is fully unauthenticated; otherwise, users with Subscriber-level privileges can exploit these vectors through their own checkout process.

An unauthenticated attacker can achieve privilege escalation by exploiting the `/my-calendar/` page. The issue occurs because the `mcs` GET parameter is reflected into post content without sanitization before the `do shortcode` filter is applied. This allows the injection of a nested `[my calendar above=...]` shortcode. The `mc generate calendar nav()` function then processes the `above` attribute and executes elements via `call user func()` without authentication or authorization checks. By invoking arbitrary PHP functions, an attacker can pass the `$params` array to `edit user()`, which PHP coerces to integer `1` for the `$user id` argument. This process overwrites the credentials of the primary Administrator account, granting the attacker full administrative access to the WordPress dashboard.

Backuply is subject to a second-order SQL Injection that allows authenticated users with subscriber-level access and above to escalate privileges and take full control of a site. The issue occurs when a user places a crafted string in the Biographical Info field of their profile. While the plugin exports this value into a backup SQL dump, the flaw triggers during the restoration process. Specifically, the plugin uses an unanchored regular expression to identify table prefixes that does not skip quoted values. If the Biographical Info contains the string `backuply version`, the crafted payload is executed within an `UPDATE` query with full database privileges. This primitive allows attackers to modify database records, such as updating the `default role` option in `wp options` to administrator and enabling open user registration. Consequently, any subsequently registered account is automatically granted the Administrator role. This issue affects over 600,000 active installations.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) via comment content. This occurs through a mutation XSS (mXSS) technique involving Simple HTML DOM Parser Noise-Key Restoration. The attack requires the Script Blocking feature to be enabled and involves submitting two coordinated comments: one containing event-handler syntax within a `<code>` element and another containing a deterministic ` noise ` restoration key within an `<abbr title="">` attribute. The key offset can be verified using an unauthenticated request to the `wpconsent debug=1` parameter. This allows the injection of arbitrary web scripts that execute when a user visits the affected page.

Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs via the `purchased plan` parameter when accessing the '/wp-admin/profile.php' endpoint. Exploitation is possible if the site owner has completed the standard Freemius opt-in flow, enabling the attacker to inject arbitrary web scripts that execute when a user visits the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts through the `comment` parameter. These scripts execute when a user accesses the affected page. Successful exploitation requires the site to allow unmoderated comment submission on at least one post and have a secondary language configured.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. The issue is triggered via the `author` parameter, where a comment author name containing ` src=` and an event-handler payload can bypass the `sanitize text field` function. The plugin's `str replace()` function then injects a single quote that allows the payload to break out of the attribute context within the alt attribute.

Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages by tricking a user into clicking a link. The issue exists because the `lang` parameter is processed through the `set active language()` function in `Fusion Multilingual` and concatenated into a URL by the `get setting link()` function in `Fusion Settings` without applying `urlencode()`, `esc url()`, or `esc attr()` before being echoed into a double-quoted href attribute in the post editor metabox.

The Download Manager plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated users with subscriber-level access or higher can inject arbitrary web scripts through the display name field. This exploitation is possible when the `[wpdm edit profile]` shortcode is present on a front-end page accessible to these users, allowing them to bypass sanitization using a multiply entity-encoded payload. The injected scripts execute whenever a user visits the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts via the `comment` parameter. These scripts execute automatically whenever a user accesses the affected page.