Erwan Lr

Insufficient sanitization of a persisted field definition allows a user with field configuration privileges to store a payload that executes as JavaScript in the browser of any user viewing a page that renders the affected field. In multisite environments, this allows a site administrator without the `unfiltered html` capability to inject scripts into other users' sessions.

The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts.

The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.

The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.

The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 does not escape a commenter-supplied value before outputting it on an administrative spam-review screen, allowing unauthenticated users to inject arbitrary web scripts that execute in the browser of an administrator who reviews flagged comments.

The Mail Mage WordPress plugin through 0.0.25 does not properly sanitise and escape a user-supplied value before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

The plugin fails to perform capability or nonce checks before writing stored roster data. This occurs due to a missing capability check on a function, which allows unauthenticated attackers to overwrite, wipe, or restore the content of any roster.

The plugin fails to honor post password protection when rendering a listing. This allows unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password, potentially leading to the exposure of sensitive user or configuration data.

An issue exists where the plugin fails to perform capability or nonce checks on an AJAX action. This allows unauthenticated attackers to delete WordPress user accounts of roster members.

The plugin fails to neutralize shortcodes in review fields submitted via the public review form. This allows unauthenticated visitors to execute arbitrary shortcodes when the affected field is displayed, provided that user reviews and the display of that specific field are enabled.

Unauthenticated attackers can perform SQL injection attacks because the plugin fails to sanitize sort parameters used in a SQL ORDER BY clause. The issue involves the `sort by` and `sort order` variables.

An issue exists where changes to a network-wide access setting are not restricted to network administrators. This allows an administrator of a single site within a multisite network to modify this setting for the entire network.

An issue exists where a parameter is not properly sanitized and escaped before being used in a SQL statement. This allows unauthenticated attackers to perform SQL injection attacks on installations where the payment key has not been configured. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

The plugin fails to properly sanitize and escape the `orderBy` parameter before incorporating it into a SQL query. This flaw allows authenticated users to execute SQL injection attacks, which involve inserting malicious SQL code into a query to manipulate the database.

An unauthenticated endpoint fails to sanitize and escape submitted content before it is displayed on an administrative page. This leads to Stored Cross-Site Scripting (XSS), a condition where malicious scripts are permanently stored on the server and executed in the browser of high-privilege users, such as administrators.

An unauthenticated endpoint fails to sanitize and escape submitted content before it is displayed on an administrative page. This leads to Stored Cross-Site Scripting (XSS), a condition where malicious scripts are permanently stored on the server and executed in the browser of high-privilege users, such as administrators.

An unauthenticated endpoint fails to sanitize and escape submitted content before it is displayed on an administrative page. This leads to Stored Cross-Site Scripting (XSS), a condition where malicious scripts are permanently stored on the server and executed in the browser of high-privilege users, such as administrators.

An unauthenticated endpoint fails to sanitize and escape submitted content before it is displayed on an administrative page. This leads to Stored Cross-Site Scripting (XSS), a condition where malicious scripts are permanently stored on the server and executed in the browser of high-privilege users, such as administrators.

An authentication bypass exists where a logged-out checkout can be linked to and logged in as an existing WordPress account matching the submitted email address. This occurs because the duplicate-account check normalizes the email address differently than the lookup used to create the customer. An unauthenticated attacker can exploit this to log in as any existing user, including a Network Super Admin, provided they know the user's email address. This issue requires a checkout form configured without a password field (using auto-generated passwords) and a target account that lacks an existing customer record within the plugin.

The plugin fails to restrict the recipient of certain unauthenticated contact-form actions. This allows unauthenticated users to perform a mail relay, sending arbitrary emails to any specified address through the website.