Dmitry Ignatyev

Insufficient sanitization and escaping of certain settings before they are displayed on front-end pages allows high-privilege users, such as Administrators, to execute Stored Cross-Site Scripting (XSS) attacks. This occurs specifically when the `unfiltered html` capability is disabled, which is common in multisite network environments. Stored XSS is a type of attack where malicious scripts are permanently stored on the target server.

Insufficient sanitization and escaping of a parameter before it is reflected on administrative pages allows for Reflected Cross-Site Scripting (XSS). This occurs when a logged-in administrator is tricked into clicking a crafted link, enabling the execution of arbitrary web scripts within the administrator's session.

Insufficient input sanitization and output escaping in the Classic lightbox allow authenticated users with Contributor roles or higher to perform Stored Cross-Site Scripting attacks. This occurs because the plugin fails to escape the URL of links before inserting them into the page as HTML, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page.

Stored Cross-Site Scripting (XSS) occurs because the plugin fails to sanitize or escape submitted form data stored as lead entries before displaying it in the lead debug metabox. This allows unauthenticated attackers to store malicious scripts that execute when a logged-in user views the entry while debug mode is enabled.

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress contains a Reflected Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping when handling the `title` parameter. Unauthenticated attackers can exploit this by tricking a user into clicking a malicious link, allowing the execution of arbitrary web scripts in the user's browser.

The plugin fails to remove the reCAPTCHA secret key from the giveaway settings embedded in public giveaway pages. This allows unauthenticated visitors to retrieve the secret key of any active giveaway that has reCAPTCHA configured.

Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the `offset` shortcode attribute, which execute when a user visits the affected page.

Insufficient sanitization and escaping of a widget setting before it is output in the editor preview allows users with contributor-level access and above to perform a stored cross-site scripting attack. This occurs when a higher-privileged user opens the affected content in the editor, causing the injected arbitrary web scripts to execute within their session.

Insufficient sanitization and escaping of a block attribute before it is output on a page allows users with the contributor role and above to execute Stored Cross-Site Scripting attacks. Stored Cross-Site Scripting is a type of attack where malicious scripts are permanently stored on the target server.

Insufficient escaping of attributes within YouTube embed blocks occurs during the rendering process when they are outputted into an HTML attribute. This flaw allows users with contributor-level permissions to execute Stored Cross-Site Scripting (XSS) attacks, a technique where malicious scripts are permanently stored on the target server and served to other users.

The plugin fails to perform capability or ownership checks on several AJAX actions, relying solely on a nonce. This allows users who have been granted access to posting features by an administrator to export configured social account credentials, delete arbitrary posts, and reset the plugin configuration.

The plugin fails to escape unrecognized attributes within its video-player block before rendering them onto the block's wrapper element. This allows users with the Author role or higher to inject an event-handler attribute, enabling the execution of arbitrary scripts in the browser of any user, including administrators, who views the affected post.

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress contains a Stored Cross-Site Scripting issue. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages via the `suffixMain` attribute of the Post Comment Block. This occurs because of insufficient input sanitization and output escaping. The issue persists despite WordPress core `wp kses post` sanitization because the payload is stored within a Gutenberg block delimiter comment and is only rendered as exploitable HTML during the PHP render stage.

The plugin contains an Insecure Direct Object Reference (IDOR) flaw, which occurs when an application provides direct access to objects based on user-supplied input. The issue exists in the `edit meta value` function due to missing validation on a user-controlled key. Authenticated attackers with contributor-level access or higher can delete arbitrary media attachments across the site by providing a numeric attachment ID in the `file-field` parameter along with a delete flag. This can lead to content loss and broken pages. This is possible when the attacker's post is managed by a template containing a file-type field where the `mediaRemove` option is disabled, which is the default setting.

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level access or higher can modify the title and metadata of arbitrary WordPress posts or permanently delete them. This is achieved by providing a controlled `popup id` variable. The necessary nonce is available on the edit-jltma popup admin screen, which is accessible to contributors because the `jltma popup` custom post type is registered with `capability type='post'`.

The plugin is subject to Reflected Cross-Site Scripting, a flaw where an application includes untrusted data in a web page without proper validation or escaping. This occurs because the application reads the `keyword` parameter from the `$ GET` array and applies `sanitize text field()`, which removes HTML tags but preserves double quotes. The value is then inserted into the value attribute of a search input using a PHP heredoc without the use of `esc attr()`. Unauthenticated attackers can exploit this by tricking a user with `upload files` capabilities (Author level or higher) into clicking a crafted link to the '/wp-admin/media-upload' endpoint, allowing the execution of arbitrary web scripts.

The plugin fails to validate or sanitize a widget link setting before it is stored and subsequently used in a JavaScript navigation call. This allows users with the contributor role or higher to perform a stored cross-site scripting attack by injecting JavaScript that executes in the browser of any user who interacts with the affected widget.

Insufficient validation of a configuration setting allows users with administrator privileges to store JavaScript. This script then executes within the session of any visitor to the site when the bundled front-end scripts build markup from the affected setting.

Insufficient input sanitization and output escaping in a Table widget setting allow authenticated users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. This occurs when the setting is output within an HTML attribute, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page.

An Insecure Direct Object Reference (IDOR) exists in the `watch checkout()` function due to missing validation on a user-controlled key. This allows unauthenticated attackers to obtain entitlement for a premium product while paying for a lower-cost one by manipulating the `product id` parameter independently of the `price id` parameter within the Stripe checkout URL.