Jakub Herman

An authentication bypass allows unauthenticated attackers to take over customer accounts. The issue exists in the `OsModel::build conditions query()` function within `lib/models/model.php`, which compares WHERE-clause values against literal strings 'IS NULL' and 'IS NOT NULL' and concatenates matches directly into SQL without parameter binding. This flaw persists despite the use of `sanitize text field()` and the `is scalar()` hardening guard. Attackers can send `params[password reset token]=IS NOT NULL` to the `customer cabinet change password` AJAX endpoint to match non-null `account nonse` values, allowing them to overwrite a customer's password. If the `wp users as customers` option is enabled, this can lead to the takeover of linked WordPress subscriber or customer-role accounts. Additionally, attackers can identify target emails by sending `params[order intent key]=IS NOT NULL` to the `steps start from order intent` endpoint.

The passwordless email login feature, which is enabled by default, fails to adequately restrict the number of attempts for the short numeric code. Additionally, these failed attempts are not recorded by the internal brute-force protection system. This allows unauthenticated attackers to perform a brute-force attack on the One-Time Password (OTP) to take over any account, including those with administrator privileges.

Insufficient input sanitization and output escaping in the comment handling of stored field definitions allow unauthenticated users to perform Stored Cross-Site Scripting (XSS). An attacker can inject a payload that is emitted as an HTML attribute name and executed as JavaScript in the browser of any visitor or administrator who views a page rendering the affected field.

Insufficient sanitization and escaping of analytics tracking settings allow authenticated users with specific capabilities to perform Stored Cross-Site Scripting (XSS) attacks. This occurs when the plugin outputs these settings into an inline script on every front-end page, enabling the execution of arbitrary web scripts in the browsers of site visitors, including logged-in administrators.

Unauthenticated visitors can execute arbitrary registered shortcodes with attacker-chosen attributes. This occurs because the plugin uses the `do shortcode()` function on user-supplied input, failing to prevent request-derived values in dynamic content tags from being processed as shortcodes when a form is embedded using the block method. The severity of the impact depends on the specific shortcodes registered on the site, as some may expose sensitive data or perform unauthorized actions.

The plugin fails to properly escape content re-emitted through its bundled HTML parser due to insufficient input sanitization and output escaping. This allows unauthenticated users to perform Stored Cross-Site Scripting (XSS), where arbitrary web scripts are injected into pages and executed in the session of any visitor, including logged-in administrators.

Insufficient escaping of user-supplied parameters and lack of preparation in SQL queries allow authenticated attackers with Subscriber-level access or higher to perform SQL Injection. The issue occurs during a restore process because the plugin does not restrict database charset and collation rewrite to schema statements. This allows a value stored in a user profile to break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server that lacks one of the source's charsets or collations. This can be used to extract sensitive information from the database.

Unauthenticated users can inject a PHP object during the media replace-and-update-links routine because the software does not restrict allowed classes when deserializing stored metadata. This PHP Object Injection occurs when a user with upload access performs a routine media replacement. The issue can lead to local file inclusion of existing PHP or HTML files, potentially escalating to remote code execution if an attacker-influenced file exists on the server. If a POP chain (a sequence of gadgets used to execute arbitrary code during deserialization) is present via other installed plugins or themes, it could allow the deletion of arbitrary files or the retrieval of sensitive data.

Insufficient input sanitization and output escaping of cart item variation data in the cart slide-out allows unauthenticated users to perform Stored Cross-Site Scripting (XSS). This occurs when arbitrary web scripts are stored and subsequently executed in the session of another user, including logged-in administrators, when they access the affected page.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. This occurs via the `cmb43ex1 grp[0][txt]` parameter. The issue is exploitable when a site integrator uses the plugin's front-end form helper with a wysiwyg field inside a repeatable group on a publicly accessible page, allowing scripts to execute when a user visits the affected page.

An issue exists where the software fails to correctly bound a pattern used to rewrite dynamic-content tokens during block rendering. This flaw allows the pattern to consume the closing quote of an HTML attribute, pulling adjacent unescaped data into the markup as new attributes. Consequently, unauthenticated users can perform stored Cross-Site Scripting (XSS), which is a technique that injects malicious scripts into a webpage, executing them in the browser of any visitor who views the affected page, including logged-in administrators.

An issue exists where an HTML rewriting routine is not restricted to stylesheet content, causing the removal of a quote that terminates an attribute in the rendered page. When combined with unescaped comment author output, this allows unauthenticated users with published comments to inject attributes that execute JavaScript in the browser of any visitor, including logged-in administrators, provided the affected option is enabled.

Insufficient capability checks during post updates via front-end form actions allow unauthenticated visitors to overwrite arbitrary posts. This includes posts used to store site field definitions, which can lead to arbitrary code execution on the server. This issue occurs when a site publishes a form where the post-update action maps both the target and content to values submitted by the visitor.

The front-end Forms module fails to consistently resolve the target of the `update-user` action between the authorization stage and the execution stage. This inconsistency allows unauthenticated visitors to bypass protections for administrator accounts, leading to full account takeover and the issuance of a valid session for the site administrator. Successful exploitation requires the site to have two separate front-end form configurations where targets are mapped to values submitted by the visitor.

An HTML optimization routine fails to limit its operations to stylesheet content, which can lead to the deletion of markup that closes an attribute in the rendered page. When combined with unescaped comment author output, this allows unauthenticated users with published comments to inject event-handler attributes. This results in the execution of arbitrary JavaScript in the browser of any visitor, including logged-in administrators, when viewing front-end pages with the optimization enabled.

When a non-default image delivery mode is enabled, the bundled HTML parser fails to escape values re-emitted into element attributes. This allows unauthenticated users to submit content that is stored and subsequently executed as Cross-Site Scripting (XSS) in the browser of any user viewing the affected page, including administrators. Cross-Site Scripting is a technique where malicious scripts are injected into trusted websites.

Insufficient sanitization and escaping of a cookie value before it is printed into the page output allows unauthenticated attackers to perform stored Cross-Site Scripting (XSS) on sites utilizing a full-page cache. This enables the injection of malicious scripts into the cached page, which are subsequently served to other visitors.

The plugin fails to correctly limit the capabilities granted to user roles authorized by an administrator to manage banners. This flaw allows users with low-privileged roles to obtain full administrator capabilities, leading to privilege escalation and full site compromise.

An issue exists where the plugin fails to escape URLs when rewriting links for a translated language and reverses the previously applied encoding. This allows unauthenticated users to store a malicious payload that executes in the browser of any user viewing the page in a translated language, resulting in Stored Cross-Site Scripting (XSS), a technique where a script is permanently stored on the target server.

The Broken Link Checker plugin for WordPress allows unauthenticated attackers to execute arbitrary shortcodes. This occurs because the software fails to properly validate a value before executing the `do shortcode` function. An attacker can exploit this by submitting a comment containing a shortcode payload within an `href` or `src` attribute. Once the comment is approved through the standard moderation workflow, the shortcode is automatically executed via WP-Cron.