Jack Pas

An issue exists involving Improper Neutralization of CRLF Sequences (CRLF Injection), where Carriage Return (CR) and Line Feed (LF) characters are not properly handled. This occurs because the `get reply to address()` function processes the Reply-To display name using the `'notification'` context instead of `'notification-reply-to'`, bypassing email-address validation. Additionally, the `wpforms sanitize textarea field()` function preserves CR/LF characters that are not stripped before being added to the raw `Reply-To:` mail header string. Unauthenticated attackers can exploit this by injecting arbitrary email headers, such as `Bcc:`, into outgoing notification emails to silently blind-copy messages to an attacker-controlled address. This exploitation is possible if a form notification is configured to use a Paragraph Text (textarea) field as the Reply-To display name via a Smart Tag.

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level access or higher can create and execute RSS import jobs, force-delete all posts linked to any import job, clear import error logs, and enumerate post `meta key` names and taxonomy terms. This is possible because the required nonce is leaked to any user with the `edit posts` capability through the `feedzyjs` localized script injected into the block editor.

An unauthenticated remote attacker can perform a blind SQL injection via the login endpoint. The `username` field is not properly sanitized before being incorporated into a SQL query, which allows the attacker to bypass authentication and log in as an administrator without a valid password. Additionally, attackers can recover stored password hashes one character at a time by analyzing differing login error responses.

The Media Library Assistant plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF), a type of attack where an unauthorized user tricks a victim into performing actions they did not intend to do. This occurs because of missing nonce verification—a security token used to ensure a request is legitimate—within the bulk action handlers of the settings tab. Consequently, unauthenticated attackers can deceive an administrator into executing bulk delete, edit, or purge operations on plugin settings and attachment metadata through a forged request.

An Insecure Direct Object Reference exists in the `action get event data` function due to missing validation on a user-controlled key. Authenticated attackers with contributor-level access or higher can enumerate timeslot IDs to read the full WP Post object of draft, pending, and private mp-event posts belonging to other users. This includes access to `post content`, `post excerpt`, `post status`, and `post author`, as well as associated raw timeslot descriptions.

The plugin is susceptible to unauthorized data modification because the `Live Action::reset()` function lacks a capability check. This function is linked to the WordPress `init` action and is triggered when the `post` and `action=elementor` GET parameters are provided without authentication or nonce verification. Consequently, unauthenticated attackers can overwrite the ` elementor data` content of any `elementskit widget` custom post type by accessing a specifically crafted URL, resulting in the permanent replacement of custom designs, text, and configurations with a blank template.

Stored Cross-Site Scripting is possible via the `className`, `classHook`, and `blockId` attributes in the 'Add to Cart' block ('essential-blocks/add-to-cart'). The issue occurs in the `render callback()` function due to insufficient output escaping when these attributes are placed into class and data-id HTML attributes using `sprintf()` and `implode()` without `esc attr()` escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which execute when a user visits the affected page.

The WP Editor plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to. This occurs because the `add plugins page()` and `add themes page()` functions lack nonce verification (a unique token used to prevent replay attacks). Consequently, unauthenticated attackers can overwrite arbitrary plugin and theme PHP files with malicious code by inducing a site administrator to click a forged link.

The plugin is subject to missing authorization due to a lack of capability checks on several AJAX handlers. The affected endpoints are 'wp statistics get filters', 'wp statistics getPrivacyStatus', 'wp statistics updatePrivacyStatus', and 'wp statistics dismiss notices'. These handlers verify a `wp rest` nonce but fail to enforce checks such as `current user can()` or the `User::Access()` method. Consequently, authenticated users with Subscriber-level access or higher can access sensitive analytics data, including user IDs, usernames, emails, and visitor tracking data, as well as retrieve and modify privacy audit compliance status and dismiss administrative notices.

The Loco Translate plugin for WordPress is susceptible to Reflected Cross-Site Scripting through the `update href` parameter due to inadequate input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, potentially leading to execution if a user is tricked into performing an action like clicking a malicious link. The vulnerable parameter is `update href`.

The SureForms plugin is susceptible to a Payment Amount Bypass issue. This occurs because the `create payment intent()` function relies on a user-controlled parameter for payment validation. This allows unauthenticated attackers to circumvent payment amount validation and create underpriced payment or subscription intents by setting the `form id` parameter to 0.

The Jupiter X Core plugin for WordPress is susceptible to limited file uploads because of missing authorization in the `import popup templates()` function and inadequate file type validation within the `upload files()` function. This allows attackers with Subscriber-level access or higher to upload potentially dangerous files. Successful exploitation could lead to Remote Code Execution on servers configured to execute .phar files as PHP, or Stored Cross-Site Scripting through the upload of .svg, .dfxp, or .xhtml files.

The LearnPress – WordPress LMS Plugin is susceptible to unauthorized deletion of quiz question answers. This is due to a missing capability check within the `delete question answer()` function of the `EditQuestionAjax` class. The `AbstractAjax::catch lp ajax()` dispatcher verifies a wp rest nonce but does not perform a `current user can()` check. Additionally, the `QuestionAnswerModel::delete()` method only validates minimum answer counts without verifying user capabilities. This allows authenticated attackers with Subscriber-level access or higher to delete answer options from any quiz question on the site.

The LearnPress – WordPress LMS Plugin is susceptible to unauthorized email notification triggering. This occurs because of missing capability checks in all 10 functions within the `SendEmailAjax` class. The `AbstractAjax::catch lp ajax()` dispatcher verifies a `wp rest` nonce but does not perform a `current user can()` check before dispatching to handler functions. The `wp rest` nonce is embedded in the frontend JavaScript for all authenticated users. This allows authenticated attackers with Subscriber-level access or higher to trigger arbitrary email notifications to administrators, instructors, and users. This can lead to email flooding, social engineering, and impersonation of administrative decisions regarding instructor requests.

The WordPress Download Manager plugin contains a flaw due to a hardcoded Cron key used in the `deleteExpired()` and `clearTempDataCPCron()` functions. This allows unauthenticated attackers to trigger these cron jobs, potentially leading to the deletion of expired posts and clearing of the cache.

The Event Tickets and Registration plugin for WordPress has a flaw that allows bypassing payment for tickets. The `/wp-json/tribe/tickets/v1/commerce/free/order` API endpoint does not properly verify if a ticket type should be free, enabling attackers to acquire paid tickets without payment. This impacts revenue for the target. The issue allows unauthenticated attackers to obtain access to paid tickets without paying.

The User Registration & Membership plugin for WordPress is susceptible to SQL Injection via the `s` parameter. This is due to insufficient escaping of user-supplied input and inadequate preparation of existing SQL queries. This allows authenticated attackers with administrator-level access or higher to append additional SQL queries to existing ones, potentially extracting sensitive information from the database.

Name of the Vulnerable Software and Affected Versions: Beaver Builder – WordPress Page Builder plugin versions prior to 2.9.2.1 Description: The Beaver Builder – WordPress Page Builder plugin for WordPress is susceptible to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if a user is tricked into performing an action, such as clicking a link. The vulnerability occurs via the `fl builder` parameter. Recommendations: Update Beaver Builder – WordPress Page Builder plugin to a version later than 2.9.2.1.

Name of the Vulnerable Software and Affected Versions: All-in-One WP Migration and Backup versions through 7.97 Description: The All-in-One WP Migration and Backup plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Import function. Insufficient input sanitization and output escaping allow authenticated attackers with administrator-level access to inject arbitrary web scripts into pages. This vulnerability only affects multi-site installations and installations where `unfiltered html` has been disabled. Recommendations: Update to version 7.98 or later to address the security issue.

An issue exists in the Product Image section of the VirtueMart backend, where authenticated attackers can upload files with arbitrary extensions. This could potentially lead to remote code execution or other security impacts, depending on the server configuration.