Johannes Skamletz

The YANewsflash plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `yanewsflash/yanewsflash.php` page. This allows unauthenticated attackers to update settings and inject malicious web scripts via a forged request if they can trick a site administrator into performing an action, such as clicking a link.

The Latest Post Accordian Slider plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `lpaccordian` page. This allows unauthenticated attackers to update settings and inject malicious web scripts via a forged request if they can trick a site administrator into performing an action, such as clicking a link.

The plugin is susceptible to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the `lsms admin` page. This allows unauthenticated attackers to update settings and inject malicious web scripts via a forged request if they can trick a site administrator into performing an action, such as clicking a link.

The Avishi WP PayPal Payment Button plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `/avishi-wp-paypal-payment-button/index.php` page. This allows unauthenticated attackers to update settings and inject malicious web scripts via a forged request if they can trick a site administrator into performing an action, such as clicking a link.

The plugin is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'zuppler-online-ordering-options' page. This allows unauthenticated attackers to update settings and inject malicious web scripts via a forged request if they can trick a site administrator into performing an action, such as clicking a link.

The Attachment Manager plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation within the `handle actions()` function. This allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution if critical files, such as `wp-config.php`, are deleted.

The Restrict File Access plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'restrict-file-access' page. This allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution if a critical file, such as `wp-config.php`, is deleted through a forged request initiated by tricking a site administrator into performing an action.

Name of the Vulnerable Software and Affected Versions: ProcessingJS for WordPress versions 1.2.2 and earlier Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the `pjs4wp` shortcode. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts in pages. These scripts will execute when a user accesses an injected page. Recommendations: For versions 1.2.2 and earlier, update to a version later than 1.2.2 to resolve the issue. As a temporary workaround, consider restricting access to the `pjs4wp` shortcode to prevent potential exploitation.

Name of the Vulnerable Software and Affected Versions: yContributors plugin for WordPress versions up to, and including, 0.5 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'yContributors' page. This allows unauthenticated attackers to update settings and inject malicious web scripts via a forged request, provided they can trick a site administrator into performing a specific action, such as clicking on a link. Recommendations: For yContributors plugin for WordPress versions up to, and including, 0.5, consider disabling the plugin until a patch is available to prevent exploitation. Restrict access to the 'yContributors' page to minimize the risk of exploitation. Avoid performing actions that could be triggered by a forged request, such as clicking on links from untrusted sources, until the issue is resolved.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'ef settings submenu' page. This allows unauthenticated attackers to update settings and inject malicious web scripts via a forged request if they can trick a site administrator into performing an action such as clicking on a link.

The issue is related to Stored Cross-Site Scripting via the plugin's 'kkytv' shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue allows authenticated attackers with Subscriber-level access and above to read the contents of arbitrary files on the server, which can contain sensitive information, via the `output()` function.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'yougler-plugin.php' page. This allows unauthenticated attackers to update the plugin's settings via a forged request if they can trick a site administrator into performing an action such as clicking on a link.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'xisearch-key-config' page. This allows unauthenticated attackers to update settings and inject malicious web scripts via a forged request, provided they can trick a site administrator into performing a specific action, such as clicking on a link.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'zen-social-sticky/zen-sticky-social.php' page. This allows unauthenticated attackers to update settings and inject malicious web scripts via a forged request, provided they can trick a site administrator into performing a specific action, such as clicking on a link.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'url shortener settings' page. This allows unauthenticated attackers to update settings and inject malicious web scripts via a forged request, provided they can trick a site administrator into performing a specific action, such as clicking on a link.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the "stats/stats.php" page. This allows unauthenticated attackers to update settings and inject malicious web scripts via a forged request, provided they can trick a site administrator into performing a specific action, such as clicking on a link.

Name of the Vulnerable Software and Affected Versions: Audio Comments Plugin versions up to, and including, 1.0.4 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'audio-comments/audior-settings.php' page. This allows unauthenticated attackers to update settings and inject malicious web scripts via a forged request, provided they can trick a site administrator into performing a specific action, such as clicking on a link. Recommendations: For versions up to, and including, 1.0.4, update to version 1.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the 'audio-comments/audior-settings.php' page to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: AlT Monitoring plugin for WordPress versions up to, and including, 1.0.3 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'ALT Monitoring edit' page. This allows unauthenticated attackers to update settings and inject malicious web scripts via a forged request, provided they can trick a site administrator into performing a specific action, such as clicking on a link. Recommendations: For versions up to, and including, 1.0.3, update to a version that includes the necessary nonce validation to prevent Cross-Site Request Forgery attacks. As a temporary workaround, consider restricting access to the 'ALT Monitoring edit' page to minimize the risk of exploitation.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'alink-tap' page. This allows unauthenticated attackers to update settings and inject malicious web scripts via a forged request, provided they can trick a site administrator into performing a specific action, such as clicking on a link.