Hung Nguyen

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. This occurs via the `hb country iso`, `hb usa state iso`, and `hb canada province iso` parameters, enabling the injection of arbitrary web scripts that execute when a user accesses the HBook Customers admin page.

Remote Code Execution is possible via the Display Logic feature. The issue arises because the plugin uses the `eval()` function on user-supplied Display Logic expressions with an insufficient blocklist/allowlist that can be bypassed using `array map` with string concatenation. Additionally, there is a lack of authorization enforcement on the `extended widget opts block` attribute. This allows authenticated attackers with Contributor-level access or higher to execute arbitrary code on the server.

An arbitrary file upload flaw exists in the Breeze Cache plugin for WordPress, affecting approximately 400,000 active installations. The issue occurs within the `fetch gravatar from remote()` function due to missing file type validation and an incorrect regular expression that allows URLs to be extracted from the `alt` attribute of image tags instead of just the `src` attribute. Unauthenticated attackers can exploit this by manipulating the display name of a comment to include a malicious URL pointing to a PHP file. When processed, the plugin downloads and saves the file to the server, potentially allowing remote code execution through the upload of PHP backdoors. This is only exploitable if the "Host Files Locally - Gravatars" setting is enabled. Real-world exploitation began immediately upon disclosure on April 22, 2026, with over 30,000 attempts blocked by security firewalls. Attackers have been observed uploading self-deleting PHP droppers to create backdoors and rogue administrator accounts.

The software contains an Insecure Direct Object Reference issue in the `executePayment()` function. Missing validation on a user-controlled key allows unauthenticated attackers to complete arbitrary pending orders. This is possible due to a mismatch between the PayPal transaction `token` and the local `order id`, potentially enabling theft of paid digital goods by exploiting a payment token from a low-cost item to finalize a high-value order.

The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is susceptible to a privilege escalation issue. This is caused by an insecure `strpos()` check within the `isDashboardOrProfileRequest()` method against the `$ SERVER['REQUEST URI']` variable, used to determine if a request targets the dashboard or profile page. The `grantVirtualCaps()` function, which is connected to the `user has cap` filter, grants elevated capabilities, including `manage options`, when this check returns true. Authenticated attackers with Subscriber-level access or higher can exploit this by adding a crafted query parameter to any admin URL, enabling them to update arbitrary WordPress options and create new Administrator accounts.

The Autoptimize plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `ao post preload` meta value. This is a result of inadequate input sanitization within the `ao metabox save()` function and a lack of output escaping when the value is rendered into a `<link>` tag in `autoptimizeImages.php`. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses an injected page, provided the "Image optimization" or "Lazy-load images" setting is enabled in the plugin configuration.

The Aimogen Pro plugin for WordPress is susceptible to an Arbitrary Function Call, potentially leading to privilege escalation. This is due to a missing capability check within the `aiomatic call ai function realtime` function. Unauthenticated attackers can exploit this to invoke arbitrary WordPress functions, such as `update option`, to modify site settings. Specifically, attackers can update the default user role for registration to administrator, enabling them to gain administrative access to a vulnerable site. The `update option` function allows modification of WordPress options, potentially impacting site security and functionality.

The WP Go Maps plugin for WordPress is susceptible to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. A missing capability check in the `admin post wpgmza save settings` hook anonymous function allows authenticated attackers with Subscriber-level access or higher to inject arbitrary web scripts into pages. These scripts will execute whenever a user accesses the injected page via the `wpgmza custom js` parameter.

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is susceptible to privilege escalation through a flaw in the password reset functionality. The issue stems from the plugin permitting users with a LatePoint Agent role, while creating new customers, to define the `wordpress user id` field. This allows authenticated attackers possessing Agent-level access or higher to obtain elevated privileges by associating a customer with an arbitrary user ID, potentially including administrators, and subsequently resetting the password. The `wordpress user id` field is used to link a customer to a WordPress user account.

The Post Duplicator plugin for WordPress is susceptible to unauthorized modification of protected post meta data. This occurs because the `duplicate post()` function utilizes `$wpdb->insert()` directly into the `wp postmeta` table, bypassing the standard `add post meta()` function and its associated `is protected meta()` check. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary protected meta keys, such as ` wp page template` and ` wp attached file`, on duplicated posts. The issue is exploitable through the `customMetaData` JSON array parameter in the `/wp-json/post-duplicator/v1/duplicate-post` API endpoint.

The Product Table and List Builder for WooCommerce Lite plugin for WordPress is susceptible to time-based SQL Injection. This is due to inadequate escaping of user-supplied input in the `search` parameter and insufficient preparation of the existing SQL query. This allows unauthenticated attackers to inject additional SQL queries into existing queries, potentially extracting sensitive information from the database.

The SiteOrigin Widgets Bundle plugin for WordPress is susceptible to unauthorized arbitrary shortcode execution. This is caused by a missing capability check within the `siteorigin widget preview widget action()` function, which is registered through the `wp ajax so widgets preview` AJAX action. The function verifies a nonce (`widgets action`) but does not confirm user capabilities, allowing authenticated attackers with Subscriber-level access or higher to execute arbitrary shortcodes. The necessary nonce is exposed on the public frontend when the Post Carousel widget is present on a page, embedded within the `data-ajax-url` HTML attribute. Attackers can invoke the `SiteOrigin Widget Editor Widget` via the preview endpoint to exploit this issue.

The issue allows unauthenticated attackers to extract sensitive data, including full draft posts and password-protected posts, as well as the password for password-protected posts, via the `get posts` REST API Endpoint.

The issue is related to Stored Cross-Site Scripting via the plugin's shortcode(s) due to insufficient input sanitization and output escaping on user supplied attributes, such as `attributes` from users. This allows authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, potentially through `API Endpoints` like `/wp-admin/admin.php`.