H0Xilo

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the user meta save() function (which only sanitizes array values, not scalar values) and improper output escaping in the Redux Slider::render() method, which outputs slider values into unquoted HTML attributes. The vulnerability also exploits the fact that the clean default() method only casts values to numeric types when they are empty or out of bounds, allowing malicious strings like '1 tabindex=0 autofocus onfocus=alert(1) x=' to pass validation through PHP's loose type comparison. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into their user profile that will execute whenever an Administrator navigates to view the attacker's profile page.

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site's Stripe merchant credentials (access tokens, publishable keys, and account ID), diverting all subsequent payment processing to the attacker's Stripe account.

The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is exploitable due to an authorization bypass where the registered authorization callback fails to execute, allowing any authenticated user regardless of role to access administrative translation functionalities.

**Name of the Vulnerable Software and Affected Versions** Divi Ajax Filter versions prior to 5.1.3 **Description** An unauthenticated Local File Inclusion issue exists when the `loop templates` parameter is set to 'custom-template'. This allows attackers to include and execute arbitrary .php files on the server via the `custom loop template` parameter, potentially leading to the execution of PHP code, bypassing access controls, or obtaining sensitive data if .php files can be uploaded. **Recommendations** Update Divi Ajax Filter to a version newer than 5.1.2. Avoid setting the `loop templates` parameter to 'custom-template' until the update is applied.

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load previous field value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$ POST` data for upload fields without domain restriction, which are then passed to `wp remote head()` in the `get local file size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering.

The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

**Name of the Vulnerable Software and Affected Versions** Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions versions prior to 3.8.2 **Description** Insufficient input sanitization and output escaping in the `[pmpro member profile edit]` shortcode allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via a readonly user field, enabling the injection of arbitrary web scripts that execute when a user visits the affected page. **Recommendations** Update Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions to version 3.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** Chaty Pro versions prior to 3.5.6 **Description** Authenticated users with subscriber-level access and above can perform a Time-Based Blind SQL Injection. This occurs because the `fetch custom field()` function in admin/class-admin-base.php retrieves the `widget id` POST parameter and concatenates it directly into a raw SQL query without using `$wpdb->prepare()` or integer casting. Furthermore, the nonce verification check is executed after the SQL query, failing to prevent the injection. This flaw allows attackers to execute arbitrary SQL commands to extract sensitive database information, such as configuration data and user credentials. **Recommendations** Update Chaty Pro to a version newer than 3.5.5. As a temporary mitigation, restrict access to the administrative functions that utilize the `fetch custom field()` function.

**Name of the Vulnerable Software and Affected Versions** Breakdance versions prior to 2.7.2 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts through the `fields` parameter, which execute when a user accesses the affected page. **Recommendations** Update Breakdance to version 2.7.2 or later. Avoid using the `fields` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Digits: WordPress Mobile Number Signup and Login versions prior to 9.1.0.6 **Description** Privilege escalation is possible for authenticated users with Subscriber-level access and above. The issue stems from missing authorization and role validation within the `dig update wpwc custom fields()` function. An attacker can elevate their privileges to Administrator by submitting a forged `digits reg userrole` value during a profile update, provided the site administrator has enabled the built-in DIGITS User Role field. **Recommendations** Update to a version newer than 9.1.0.5. As a temporary mitigation, disable the built-in DIGITS User Role field configuration.

**Name of the Vulnerable Software and Affected Versions** WP Grid Builder versions prior to 2.3.4 **Description** An issue exists where missing authorization and meta key validation in the `update()` handler for the '/wp-json/wpgb/v2/metadata' REST endpoint allows authenticated users with Subscriber-level access or higher to elevate their privileges to Administrator. This is achieved by updating the `wp capabilities` user meta using a crafted nested array payload. **Recommendations** Update WP Grid Builder to version 2.3.4 or later. Restrict access to the '/wp-json/wpgb/v2/metadata' REST endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WP Review Slider Pro versions prior to 12.7.3 **Description** An unauthenticated attacker can extract arbitrary data from the database using blind or time-based SQL injection. The issue occurs within the `wprp load more revs` AJAX action, where the `notinstring` parameter is processed. The application uses `sanitize text field()` on the input, which removes HTML and whitespace but fails to ensure SQL safety. This value is then concatenated directly into an unquoted `AND id NOT IN (...)` clause and executed via `$wpdb->get results()` without using `$wpdb->prepare()` or `intval()` casting. Because the input is placed in a numeric context, standard quote-escaping protections are ineffective. The required nonce for the `wp ajax nopriv wprp load more revs` hook is publicly accessible on any frontend page rendering the plugin shortcode. **Recommendations** Update to a version newer than 12.7.2. As a temporary mitigation, restrict access to the `wprp load more revs` AJAX action or avoid using the `notinstring` parameter.

**Name of the Vulnerable Software and Affected Versions** BookingPress Appointment Booking Pro versions prior to 5.7.2 **Description** An issue exists where unauthenticated attackers can execute additional SQL queries to extract sensitive information from the database. This occurs because user-supplied POST data is processed using the `stripslashes deep()` function and then inserted directly into a SQL LIKE clause without using `$wpdb->prepare()` or parameterization. The flaw is located within the `bpa assign staffmember to slots()` function, specifically affecting the `store service date` parameter. **Recommendations** Update BookingPress Appointment Booking Pro to version 5.7.2 or later. As a temporary mitigation, restrict access to the functionality utilizing the `bpa assign staffmember to slots()` function.

**Name of the Vulnerable Software and Affected Versions** ARMember Premium versions prior to 7.3.2 **Description** An issue exists where unauthenticated attackers can append additional SQL queries to existing ones to extract sensitive information from the database. This occurs due to insufficient escaping of the `order` and `orderby` parameters and a lack of sufficient preparation of the SQL query within the `arm get directory members()` function. The flaw is triggered via the 'order' parameter of the 'arm directory paging action' AJAX action endpoint. **Recommendations** Update the plugin to a version later than 7.3.1. As a temporary workaround, restrict access to the 'arm directory paging action' AJAX action or avoid using the `order` and `orderby` parameters until the update is applied.

**Name of the Vulnerable Software and Affected Versions** ARMember Premium versions prior to 7.3.1 **Description** The ARMember Premium plugin for WordPress contains an insecure password reset mechanism. **Recommendations** Update to version 7.3.1.

**Name of the Vulnerable Software and Affected Versions** ARMember Premium versions prior to 7.3.2 **Description** An SQL Injection issue exists in the ARMember Premium plugin for WordPress. The `get private content data` AJAX action fails to properly sanitize the `sSortDir 0` parameter, which is concatenated directly into the ORDER BY clause of an SQL query without a whitelist check. This allows authenticated attackers with Subscriber-level access or higher to append additional SQL queries to extract sensitive information from the database. This issue is only exploitable if the User Private Content addon is enabled. **Recommendations** Update to a version newer than 7.3.1. As a temporary mitigation, disable the User Private Content addon.

**Name of the Vulnerable Software and Affected Versions** WishList Member versions prior to 3.30.2 **Description** An issue exists where missing authorization allows for privilege escalation. The `ajax get screen()` function fails to perform necessary capability and nonce checks. Authenticated attackers with Subscriber-level access or higher can provide an arbitrary admin screen identifier through the `data[url]` parameter. This action causes the plugin to load and execute the administrative API configuration template without authorization, returning the plugin's plaintext REST API Secret Key within the AJAX JSON response. An attacker possessing this key can authenticate to the API, create a membership level with the administrator WordPress role, and register an administrator-level user account, leading to a complete site takeover. **Recommendations** Update to a version later than 3.30.1. As a temporary workaround, restrict access to the `ajax get screen()` function to prevent unauthorized users from triggering the administrative API configuration template.

**Name of the Vulnerable Software and Affected Versions** Wishlist Member versions prior to 3.30.2 **Description** The Wishlist Member plugin for WordPress allows unauthorized modification of data because of a missing capability check in the `generate api key()` function. Authenticated attackers with Subscriber-level access or higher can update the REST API Secret Key. This allows for the creation of a new membership level assigned the administrator WordPress role and the registration of an arbitrary administrator-level user account, leading to a complete site takeover. **Recommendations** Update to a version newer than 3.30.1. As a temporary workaround, restrict access to the `generate api key()` function to prevent unauthorized users from modifying the API Secret Key.

**Name of the Vulnerable Software and Affected Versions** Wishlist Member versions prior to 3.30.2 **Description** The Wishlist Member plugin for WordPress allows unauthorized modification of data because the `save settings()` function in `WishListMemberFeaturesTeam Accounts` lacks a capability check. Authenticated attackers with Subscriber-level access or higher can update arbitrary plugin options, including the REST API Secret Key. This can be leveraged to create a new membership level with the administrator WordPress role and register an administrator-level user account, leading to a complete site takeover. **Recommendations** Update to a version newer than 3.30.1. As a temporary workaround, restrict access to the `save settings()` function to prevent unauthorized users from modifying plugin settings.

**Name of the Vulnerable Software and Affected Versions** WishList Member versions prior to 3.30.2 **Description** Missing authorization in the `export settings()` function allows for sensitive information disclosure and privilege escalation. The function fails to perform capability checks, enabling an attacker to retrieve the REST API Secret Key via an AJAX JSON response. With this key, an attacker can authenticate to the WishList Member API, create a new membership level with the administrator WordPress role, and register an arbitrary administrator-level user account, leading to a complete site takeover. **Recommendations** Update to a version later than 3.30.1. As a temporary workaround, restrict access to the `export settings()` function to minimize the risk of exploitation.