Huseyin Mertoglu

An issue exists where the software fails to enforce publish and post-type restrictions during an AJAX save action. This allows users with roles as low as Contributor to publish their own content and modify its post type, such as changing a post to a product, without possessing the necessary permissions. This occurs via the `ux builder save` function.

An issue exists where the software fails to perform a capability or nonce check on an AJAX action available to unauthenticated users. Additionally, it does not restrict the status of posts returned by ID, which allows unauthenticated users to disclose the content of unpublished posts, such as those in draft or pending status, via the `flatsome ajax apply shortcode` action.

The plugin fails to fully enforce hidden-login protection. An unauthenticated attacker can access the standard login page by using specific password-reset request parameters. This allows the attacker to recover the site's configured secret login slug from the resulting page, bypassing the core protection mechanism and leading to sensitive information exposure of user or configuration data.

Brave Popup Builder contains a broken access control issue. Any authenticated user, including those with Subscriber or WooCommerce Customer roles, can access and read popup content they are not authorized to view by providing a post ID within the URL.

Brave Popup Builder reflects UTM query parameters into the popup form HTML without proper escaping, leading to Reflected Cross-Site Scripting (XSS). This occurs when the application takes user-supplied input from UTM parameters and includes it in the HTML response without sanitization.

An issue exists where a capability check is not performed on an AJAX action that returns aggregated store revenue totals. This allows users with contributor-level access and above to read daily revenue figures that are normally restricted to administrators and report managers.

An AJAX action that returns post content fails to perform necessary capability or ownership checks. This allows users with contributor-level access or higher to read the content of any post, page, or custom post type on the site, including private, pending, and draft content owned by other users.