Itthidej Aramsri

Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the `icon light` attribute of a shortcode, which then execute when a user visits the affected page.

An issue exists where the scripts service endpoint constructs its URL whitelist dynamically using the `Host` HTTP header, which can be controlled by an attacker. This allows unauthenticated users to spoof the header to match a target URL, bypassing the whitelist and forcing the server to perform HTTP requests to arbitrary internal or external destinations and return the response content. This is a Server-Side Request Forgery (SSRF), a flaw where a server is tricked into making requests to an unintended location.

Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the post content, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users.

Insufficient input sanitization and output escaping allow authenticated attackers with author-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the `other attributes` block parameter, which then execute when a user visits the affected page.

Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs via the `vkExUnit cta img position` Post Meta. The `sanitize text field` callback fails to strip double-quote characters or `on*` event-handler attributes during the save process. Additionally, the `Vk Call To Action::safe kses post()` function only rewrites disallowed iframe elements and returns other content verbatim, allowing injected web scripts to execute when a user accesses the affected page.

An authorization bypass and Stored Cross-Site Scripting (XSS) issue exists due to missing capability checks on popup management actions. Authenticated users with Subscriber-level access or higher can exploit multiple AJAX endpoints to create arbitrary popups and inject malicious JavaScript. This script executes when the popup is displayed to other users. Stored XSS is a type of vulnerability where a malicious script is permanently stored on the target server.

This issue is a Server-Side Request Forgery, a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. Authenticated users with Contributor-level access and above can exploit this by providing malicious input through the 'Changelog File' setting, which is passed to the `wp remote get()` function without proper validation or sanitization of the URL. This allows attackers to make web requests to arbitrary locations from the web application to query or modify information from internal services.

Information exposure occurs due to missing authentication and authorization checks in the settings export functionality. The `download settings()` function, registered on the `plugins loaded` hook, allows execution on public pages. This enables unauthenticated attackers to retrieve all plugin configuration settings, including the `protection password` variable stored in plaintext, by accessing the '/?export-meeting-list=1' endpoint.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages via the `rootAttributes` parameter. These scripts execute automatically whenever a user visits the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts through the `iq tree tree chart template` Widget Setting. These scripts execute whenever a user accesses the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts through the `postBodyCss` parameter. These scripts execute whenever a user accesses an affected page.

The Greenshift – animation and page builder blocks plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the `customapi` action handler does not sufficiently sanitize API responses before they are output using `innerHTML`. Consequently, authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the `delay` shortcode attribute, which then execute when a user visits the affected page.

The LightSync Pro plugin for WordPress allows authenticated attackers with Author-level access or higher to upload arbitrary files to the server. This issue occurs because the `rest replace media()` function fails to validate file types, which could lead to remote code execution.

Unauthenticated attackers can perform blind SQL Injection through the `filter data[comment count]` parameter of the public `tableon get table data` AJAX action. The issue occurs because user-supplied input is split on a colon and interpolated directly into a `posts where` SQL clause without using `intval()` casting or `$wpdb->prepare()`. This allows the execution of additional SQL queries to extract sensitive data from the database, such as database names, usernames, and passwords.

An arbitrary file deletion issue exists due to path traversal, where an attacker can use special character sequences to access and delete files outside the intended directory. The flaw occurs because the `img file` field within the `cegg data` post metadata is not properly validated, as the `wp strip all tags()` function fails to remove path traversal sequences. This value is stored in post meta and subsequently concatenated into a filesystem path within the `getFullImgPath()` function before being processed by the PHP `unlink()` function. Authenticated users with author-level access or higher can exploit this to delete arbitrary files on the server, which may lead to remote code execution.

The ShopLentor plugin for WordPress allows arbitrary function execution through the 'woolentoropt/v1/custom-action' REST API endpoint. The issue occurs because the `handle action()` method passes user-supplied input to the `call user func()` function without validating it against an allowlist of permitted callbacks. Consequently, authenticated attackers with Administrator-level access or higher can execute arbitrary PHP callable functions by manipulating the `callback` parameter.

The Survey Form Block plugin for WordPress allows unauthorized data access because the `get all data()` function lacks a capability check. Authenticated users with Subscriber-level permissions or higher can exploit this to export all survey submission data and column metadata.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the `lgx tooltip position` parameter. These scripts execute automatically when a user visits the affected page.

Insufficient file path validation in the `deleteFiles()` function allows authenticated attackers with subscriber-level access and above to delete arbitrary files on the server. This action can lead to remote code execution if critical files, such as `wp-config`, are deleted.