Dmitry Ignatyev

The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site.

The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch checkout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product id parameter independently of the price id parameter in the Stripe checkout URL.

The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks.

**Name of the Vulnerable Software and Affected Versions** The Ultimate Before After Image Slider & Gallery versions prior to 4.7.19 **Description** The plugin fails to properly escape the `before-label` value of the slider. This allows users with the Author role or higher to store a malicious payload that is subsequently re-injected into the Document Object Model (DOM) by a bundled client-side script. This results in the execution of the payload in the browser of any user, including administrators, who views the slider. **Recommendations** Update The Ultimate Before After Image Slider & Gallery to version 4.7.19 or later.

**Name of the Vulnerable Software and Affected Versions** Xpro Addons versions prior to 1.7.4 **Description** The plugin fails to properly escape settings for several widgets before they are rendered within HTML attributes. This flaw allows users with the Contributor role or higher to execute Stored Cross-Site Scripting (XSS) attacks, which occur when a malicious script is permanently stored on the target server and served to other users. **Recommendations** Update to version 1.7.4 or later.

**Name of the Vulnerable Software and Affected Versions** Smart Slider 3 versions prior to 3.5.1.39 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the `slider` block attribute. The scripts execute when a user, specifically Editors or Administrators, opens the affected post within the WordPress block editor. **Recommendations** Update Smart Slider 3 to version 3.5.1.39 or later.

**Name of the Vulnerable Software and Affected Versions** The Events Manager – Calendar, Bookings, Tickets, and more! versions prior to 7.4.1 **Description** An issue exists where authenticated attackers with contributor-level access and above can perform a second-order SQL injection. This occurs when an attacker first stores SQL metacharacters in a custom meta key through the standard add-meta flow. The injection is then triggered by invoking the `event duplicate` or `location duplicate` actions, which retrieve the stored meta keys via the `get post meta()` function and unsafely concatenate them into an INSERT query. This flaw is caused by insufficient escaping of the `meta key` parameter and a lack of proper preparation of the SQL query, allowing the extraction of sensitive information from the database. **Recommendations** Update to version 7.4.1 or later.

**Name of the Vulnerable Software and Affected Versions** PPWP – Password Protect WordPress versions prior to 1.9.22 **Description** Stored Cross-Site Scripting occurs via the `ppwp` shortcode due to insufficient input sanitization and output escaping on user supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages, which execute when a user accesses the affected page. **Recommendations** Update to a version newer than 1.9.21.

**Name of the Vulnerable Software and Affected Versions** NextScripts: Social Networks Auto-Poster WordPress plugin versions prior to 4.4.8 **Description** Reflected Cross-Site Scripting (XSS) occurs when an application includes untrusted data in a web page without proper validation or escaping. The plugin fails to escape certain query-string parameters reflected on an admin page, which allows attackers to execute malicious scripts in the browser of logged-in users, such as administrators, if they are tricked into clicking a crafted link. **Recommendations** Update NextScripts: Social Networks Auto-Poster WordPress plugin to version 4.4.8 or later.

**Name of the Vulnerable Software and Affected Versions** Bookly versions prior to 27.8 **Description** The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts through the `bookly speed up update addons` AJAX action. The payload is stored in the `bookly log.details` column when a request is submitted without a valid signature. The script executes when an administrator views the Diagnostics → Logs page. **Recommendations** Update the plugin to a version newer than 27.7. As a temporary mitigation, restrict access to the Diagnostics → Logs page to minimize the risk of script execution.

**Name of the Vulnerable Software and Affected Versions** PPWP – Password Protect WordPress versions prior to 1.9.21 **Description** An Insecure Direct Object Reference (IDOR) exists in the `ppw free set password` AJAX action. This issue occurs because of missing validation on a user-controlled key, allowing authenticated attackers with Contributor-level access or higher to update the password of any password-protected post and gain unauthorized access to its content. **Recommendations** Update to a version newer than 1.9.20.

**Name of the Vulnerable Software and Affected Versions** Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! versions prior to 3.7.2 **Description** Authenticated attackers with contributor-level access and above can achieve remote code execution via the `fetch remote file()` function. The issue stems from a filename validation and destination mismatch where file type validation is performed against the attacker-controlled Content-Disposition filename instead of the destination filename derived from the URL path. This allows a GIF+PHP polyglot file (a file that is valid as both a GIF image and a PHP script) to bypass the `unfiltered upload` capability gate by appearing as an image while being saved with a `.php` extension. The affected API endpoints are '/templately/v1/clouds/upload', '/templately/v1/insert', and '/templately/v1/login'. The latter allows contributors to overwrite the global cloud connection by setting `global signin` to true. These endpoints are accessible due to an insufficient authorization check that only requires the `delete posts` capability rather than administrator-level permissions. **Recommendations** Update the plugin to version 3.7.2 or later. Correct the `fetch remote file()` function to validate file types against the actual destination filename instead of the Content-Disposition header and stop deriving the write path from the request URL. Restrict state-changing REST routes to administrator-level capabilities.

**Name of the Vulnerable Software and Affected Versions** Royal Addons for Elementor versions prior to 1.7.1065 **Description** Insufficient validation of a widget setting used to construct an HTML tag allows users with the Contributor role and above to execute Stored Cross-Site Scripting (XSS) attacks. This issue occurs within the Icon Box Widget. **Recommendations** Update Royal Addons for Elementor to version 1.7.1065 or later.

**Name of the Vulnerable Software and Affected Versions** Accelerate versions prior to 1.5.4 **Description** The Accelerate theme for WordPress allows unauthorized modification of data because the `enqueue scripts()` function lacks a proper capability check. This flaw enables authenticated users with Subscriber-level permissions or higher to install and activate the ThemeGrill Demo Importer plugin. **Recommendations** Update the theme to a version later than 1.5.3.

**Name of the Vulnerable Software and Affected Versions** Exclusive Addons for Elementor versions prior to 2.7.9.9 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts into pages via the `exad infobox image` parameter. These scripts execute whenever a user accesses the affected page. **Recommendations** Update Exclusive Addons for Elementor to version 2.7.9.9 or later. As a temporary mitigation, restrict access to the `exad infobox image` parameter for users with Contributor-level permissions.

**Name of the Vulnerable Software and Affected Versions** Bit Form WordPress plugin versions prior to 3.1.4 **Description** Stored Cross-Site Scripting (XSS) occurs because the plugin fails to sanitize a conversational-form display setting before rendering it on the public-facing form. This allows high-privilege users, such as administrators without the `unfiltered html` capability on multisite installations, to inject JavaScript that executes in the browser of any visitor viewing the form. **Recommendations** Update Bit Form WordPress plugin to version 3.1.4 or later.

**Name of the Vulnerable Software and Affected Versions** SureForms versions prior to 2.8.2 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts through the `headingWrapper` parameter. These scripts execute whenever a user accesses the affected page. **Recommendations** Update SureForms to version 2.8.2 or later. As a temporary mitigation, restrict access to the `headingWrapper` parameter for users with contributor-level permissions.

**Name of the Vulnerable Software and Affected Versions** Jeg Kit for Elementor versions prior to 3.1.2 **Description** The plugin exposes sensitive information through the `enqueue scripts()` function in `class/dashboard/class-dashboard.php`. It injects a `JkitDashboardOption` JavaScript object as an inline script on the `post.php` admin page. This object contains the full plugin inventory, system environment details such as WordPress and PHP versions, site URLs, server capabilities, and potentially third-party API credentials via the `jkit user data` variable. Since the data is output without sufficient capability checks, any authenticated user with Contributor-level access or higher can extract this configuration data by inspecting the page source. **Recommendations** Update the plugin to version 3.1.2 or later.

**Name of the Vulnerable Software and Affected Versions** Yoast SEO versions prior to 28.1 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access or higher can inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. The exploit requires pretty permalinks to be enabled, as it relies on the `get permalink()` function embedding the stored percent-encoded `post name` variable in the generated URL. **Recommendations** Update to a version newer than 28.0.