Hao Ngo

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto prepend file directive to achieve Remote Code Execution.

The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocket beacon AJAX endpoint. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

**Name of the Vulnerable Software and Affected Versions** Avada Builder (fusion-builder) versions prior to 3.15.3 **Description** Unauthenticated remote code execution is possible via PHP Function Injection. The issue occurs because the `wp conditional tags` case in the `Fusion Builder Conditional Render Helper::get value()` function passes attacker-controlled values from a base64-decoded JSON blob directly to `call user func()` without allowlist validation. This can be exploited through the 'fusion get widget markup' AJAX endpoint, which is registered for unauthenticated users via `wp ajax nopriv fusion get widget markup`. Although the endpoint is protected by a nonce `fusion load nonce`, this value is generated for user ID 0 and is deterministically exposed in the JavaScript output of any public page containing a Post Cards (`[fusion post cards]`) or Table of Contents (`[fusion table of contents]`) element. **Recommendations** Update the plugin to a version later than 3.15.2. As a temporary workaround, restrict access to the 'fusion get widget markup' AJAX endpoint or remove Post Cards and Table of Contents elements from public-facing pages to prevent the exposure of the `fusion load nonce`.