Foxyyy

**Name of the Vulnerable Software and Affected Versions** MemberDash versions prior to 1.8.6 **Description** An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user-controlled key. This allows unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID via the `id` parameter during registration, leading to full account takeover without notifying the victim. **Recommendations** Update MemberDash to version 1.8.6 or later.

**Name of the Vulnerable Software and Affected Versions** WP Freeio versions prior to 1.4.29 WP Freeio versions 1.2.21 and earlier **Description** The WP Freeio plugin for WordPress is affected by a privilege escalation issue. The `process register()` function does not adequately restrict user role assignments during registration. This allows unauthenticated attackers to register with the `administrator` role, gaining administrative access to the WordPress site. The `administrator` role can be supplied during registration due to insufficient restrictions in the `process register()` function. **Recommendations** WP Freeio versions prior to 1.4.29: Update to version 1.4.29 or later. WP Freeio version 1.2.21 and earlier: Update to version 1.4.29 or later.

**Name of the Vulnerable Software and Affected Versions** Ovatheme Events Manager plugin for WordPress versions up to and including 1.8.5 **Description** The Ovatheme Events Manager plugin for WordPress is susceptible to arbitrary file uploads because of a lack of file type validation. This occurs in the `process checkout()` function. This allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution (RCE). **Recommendations** Update the Ovatheme Events Manager plugin to a version newer than 1.8.5.

**Name of the Vulnerable Software and Affected Versions** WP Real Estate Manager plugin for WordPress versions prior to 2.9 **Description** The issue is related to insufficient identity verification on the LinkedIn login request process, allowing unauthenticated attackers to bypass official authentication and log in as any user on the site, including administrators. **Recommendations** For versions up to and including 2.8, update to version 2.9 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Exertio Framework plugin for WordPress versions prior to 1.3.2 **Description** The issue allows for privilege escalation via account takeover due to improper validation of a user's identity before updating their password through the `fl forgot pass new()` function. This enables unauthenticated attackers to change arbitrary users' passwords, including administrators, and gain access to their accounts. **Recommendations** For versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue. As a temporary workaround, consider disabling the `fl forgot pass new()` function until a patch is available. Restrict access to password update functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WP Directorybox Manager plugin for WordPress versions up to, and including, 2.5 **Description** The issue is due to incorrect authentication in the `wp dp parse request` function, allowing unauthenticated attackers to log in as any existing user on the site, such as an administrator. This makes it possible for attackers to gain unauthorized access to the site. **Recommendations** For WP Directorybox Manager plugin for WordPress versions up to, and including, 2.5, consider disabling the `wp dp parse request` function until a patch is available. Restrict access to sensitive areas of the site to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WP Job Board Pro plugin for WordPress versions up to, and including, 1.2.76 **Description** The issue is related to privilege escalation due to the plugin allowing a user to supply the `role` field when registering, making it possible for unauthenticated attackers to register as an administrator on vulnerable sites. **Recommendations** For WP Job Board Pro plugin for WordPress versions up to, and including, 1.2.76, update to a version higher than 1.2.76 to resolve the issue. As a temporary workaround, consider restricting access to the user registration functionality to prevent unauthenticated attackers from exploiting the vulnerability.

**Name of the Vulnerable Software and Affected Versions** Soledad theme for WordPress versions up to, and including, 8.5.9 **Description** The Soledad theme for WordPress is vulnerable to Local File Inclusion via several functions like `penci archive more post ajax func`, `penci more post ajax func`, and `penci more featured post ajax func`. This makes it possible for unauthenticated attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. The exploitability of this is limited to Windows. **Recommendations** For Soledad theme for WordPress versions up to, and including, 8.5.9, consider disabling the `penci archive more post ajax func`, `penci more post ajax func`, and `penci more featured post ajax func` functions until a patch is available. Restrict access to sensitive PHP files to minimize the risk of exploitation. Avoid using the Soledad theme for WordPress on Windows until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Betheme theme for WordPress versions up to, and including, 27.5.6 **Description** The issue is a Stored Cross-Site Scripting vulnerability due to insufficient input sanitization and output escaping on user-supplied attributes in several of the plugin's shortcodes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 27.5.6, update to version 27.5.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the shortcodes that are vulnerable to Stored Cross-Site Scripting until a patch is applied. Additionally, limiting contributor-level access and above can help minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: The Events Calendar plugin for WordPress versions up to and including 6.6.4 Description: The issue is related to a SQL injection vulnerability in the `tribe has next event` function of the plugin. This vulnerability allows an unauthenticated attacker to extract sensitive information from the website's database by appending additional SQL queries to existing ones. The vulnerability is due to insufficient escaping on the user-supplied `order` parameter and lack of sufficient preparation on the existing SQL query. It is estimated that over 700,000 sites are potentially affected. Recommendations: For versions up to and including 6.6.4, update to version 6.6.4.1 or above to resolve the issue. As a temporary workaround, consider disabling the `tribe has next event()` function until a patch is available. Restrict access to the vulnerable `order` parameter in the `tribe has next event` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The Modern Events Calendar plugin for WordPress versions up to, and including, 7.12.1 **Description** The issue allows authenticated attackers with Subscriber-level access and above to make web requests to arbitrary locations originating from the web application. This can be used to query and modify information from internal services via the `mec fes form` AJAX function. **Recommendations** For versions up to, and including, 7.12.1, consider disabling the `mec fes form` AJAX function as a temporary workaround until a patch is available. Restrict access to internal services to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Keydatas plugin for WordPress versions up to, and including, 2.5.2 Description: The issue is related to arbitrary file uploads due to missing file type validation in the `keydatas downloadImages` function. This allows unauthenticated attackers to upload arbitrary files on the affected site's server, potentially enabling remote code execution. Recommendations: For versions up to, and including, 2.5.2, update to a version that fixes the missing file type validation issue in the `keydatas downloadImages` function to prevent arbitrary file uploads. As a temporary workaround, consider disabling the `keydatas downloadImages` function until a patch is available.

Name of the Vulnerable Software and Affected Versions: Modern Events Calendar plugin for WordPress versions up to, and including, 7.11.0 Description: The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `set featured image` function. This allows authenticated attackers with subscriber access and above to upload arbitrary files on the affected site's server, which may make remote code execution possible. The plugin also allows administrators to extend the ability to submit events to unauthenticated users, which would enable unauthenticated attackers to exploit this vulnerability. It is estimated that over 150,000 sites are at risk, and hackers are actively exploiting this flaw. Recommendations: For Modern Events Calendar plugin for WordPress versions up to, and including, 7.11.0: Upgrade to version 7.12.0 ASAP to patch the vulnerability. As a temporary workaround, consider disabling the `set featured image` function until a patch is available. Restrict access to the plugin's event submission feature to minimize the risk of exploitation. Avoid using the plugin until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** The Product Table by WBW plugin for WordPress version 2.0.1 and earlier **Description** The issue is related to Remote Code Execution due to missing authorization and lack of sanitization of appended data in the languages/customTitle.php file. This allows unauthenticated attackers to execute code on the server via the `saveCustomTitle` function. **Recommendations** For versions up to and including 2.0.1, consider disabling the `saveCustomTitle` function until a patch is available to prevent exploitation. Restrict access to the languages/customTitle.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress versions up to, and including, 1.3.13 **Description** The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the `settings` parameter, enabling the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. **Recommendations** For versions up to, and including, 1.3.13, update to a version later than 1.3.13 to resolve the issue. As a temporary workaround, consider restricting access to the `settings` parameter to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress versions up to, and including, 1.3.13 Description: The issue allows authenticated attackers with contributor access or higher to include and execute arbitrary PHP files on the server via the display function. This enables the execution of any PHP code in those files, potentially bypassing access controls, obtaining sensitive data, or achieving code execution, especially in scenarios where images and other "safe" file types can be uploaded and included. Recommendations: For versions up to, and including, 1.3.13, update to a version higher than 1.3.13 to resolve the issue. As a temporary workaround, consider restricting access to the display function to minimize the risk of exploitation. Additionally, restrict the ability to upload and include PHP files to prevent code execution.

Name of the Vulnerable Software and Affected Versions: The Minimal Coming Soon – Coming Soon Page plugin for WordPress versions up to, and including, 2.38 Description: The issue is related to unauthorized modification of data due to a missing capability check on the `validate ajax`, `deactivate ajax`, and `save ajax` functions. This allows authenticated attackers with Subscriber-level access and above to edit the license key, potentially disabling features of the plugin. Recommendations: For versions up to, and including, 2.38, update the plugin to a version that includes the necessary capability checks to prevent unauthorized data modification. As a temporary workaround, consider restricting access to the `validate ajax`, `deactivate ajax`, and `save ajax` functions until a patch is available.

**Name of the Vulnerable Software and Affected Versions** WP Reset plugin for WordPress versions up to, and including, 2.02 **Description** The issue is related to a missing capability check on the `save ajax` function, allowing authenticated attackers with subscriber-level access and above to modify the value of the `License Key` field for the `Activate Pro License` setting. This enables unauthorized modification of data. **Recommendations** For WP Reset plugin for WordPress versions up to, and including, 2.02: Update the plugin to a version that includes a fix for the missing capability check on the `save ajax` function. As a temporary workaround, consider restricting access to the `save ajax` function to prevent unauthorized modification of the `License Key` field.

Name of the Vulnerable Software and Affected Versions: WP Force SSL & HTTPS SSL Redirect plugin for WordPress versions up to, and including, 1.66 Description: The issue is related to unauthorized modification of data due to a missing capability check on the `ajax save setting` function. This allows authenticated attackers with subscriber-level permissions and above to update the plugin settings. Recommendations: For versions up to, and including, 1.66, update to a version that includes a fix for the missing capability check on the `ajax save setting` function. As a temporary workaround, consider restricting access to the `ajax save setting` function to prevent unauthorized modifications until a patch is available.

**Name of the Vulnerable Software and Affected Versions** XML Sitemap & Google News plugin for WordPress versions up to, and including, 5.4.8 **Description** The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the `feed` parameter, enabling the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. **Recommendations** For versions up to, and including, 5.4.8, consider updating to a version that contains a fix for this issue, as using the `feed` parameter can lead to arbitrary file inclusion and code execution. As a temporary workaround, restrict access to the `feed` parameter to minimize the risk of exploitation.