Duc Manh

Sensitive information exposure occurs via the `message` parameter. Authenticated attackers with subscriber-level access or higher can extract valid administrator password-reset keys from stored email logs. This allows them to complete the password-reset process and escalate privileges to the administrator level. This issue is exploitable if the `default view role` setting is configured to a capability held by low-privileged users, such as `read`.

The FireBox Popups – Increase Sales and Grow Your Email List plugin for WordPress contains an issue allowing unauthenticated attackers to download a full CSV export of all form submissions. This exposure includes personally identifiable information submitted by users and is triggered via the `form id` parameter.

The Error Log Viewer by BestWebSoft plugin for WordPress is susceptible to Directory Traversal. This allows authenticated attackers with Administrator-level access or higher to read the contents of arbitrary files on the server, potentially exposing sensitive information. The issue resides within the `rrrlgvwr get file` function.

Name of the Vulnerable Software and Affected Versions: Tripetto plugin for WordPress versions up to, and including, 8.0.9 Description: The issue is related to Cross-Site Request Forgery due to missing nonce validation. This allows unauthenticated attackers to delete arbitrary results via a forged request if they can trick a site administrator into performing a specific action, such as clicking on a link. Recommendations: For versions up to, and including, 8.0.9, update to a version that includes nonce validation to prevent Cross-Site Request Forgery attacks. As a temporary workaround, consider restricting access to sensitive areas of the site to minimize the risk of exploitation.

The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticated attackers with Subscriber-level access and above, and granted permissions by an Administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

The issue allows unauthenticated attackers to embed untrusted input into exported CSV files. This can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

The issue allows unauthorized access to functionality due to a missing capability check on several functions. This makes it possible for unauthenticated attackers to invoke those functions.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on several functions. This allows unauthenticated attackers to invoke those functions via a forged request if they can trick a site administrator into performing an action, such as clicking on a link. These actions may result in form deletion, lead signup, and file upload.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `fnsf delete posts` function. This allows unauthenticated attackers to delete arbitrary posts via a forged request if they can trick a site administrator into performing a specific action, such as clicking on a link.

The issue allows authenticated attackers with subscriber-level permissions and above to modify data without proper authorization. This is due to a missing capability check on the `fnsf delete posts` function, enabling them to delete arbitrary posts, including those of administrators and posts unrelated to the Funnelforms Free plugin.

The issue allows authenticated attackers with subscriber-level permissions and above to create copies of arbitrary posts due to a missing capability check on the `fnsf copy posts` function.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `fnsf copy posts` function. This allows unauthenticated attackers to create copies of arbitrary posts via a forged request if they can trick a site administrator into performing an action such as clicking on a link.