Jude Nwadinobi

The Divi Form Builder plugin for WordPress allows unauthenticated attackers to create administrator accounts. This occurs because the plugin accepts a user-controlled `role` parameter from POST data during user registration without validating it against the configured `default user role` setting, leading to privilege escalation.

An arbitrary file upload issue exists due to missing file type validation within the `piotnetforms ajax form builder()` function. The software employs an incomplete extension blacklist that blocks only php, phpt, php5, php7, and exe extensions, while permitting dangerous extensions such as .phar or .phtml. This allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution. This issue is only exploitable if a file field has been added to the form.

The User Registration Advanced Fields plugin for WordPress allows unauthenticated attackers to upload arbitrary files to the server. This issue stems from missing file type validation within the `method upload()` function of the 'URAF AJAX' class, which could lead to remote code execution. This flaw is only exploitable if a "Profile Picture" field has been added to the registration form.

The plugin is subject to arbitrary file deletion. This occurs because the `Members::update()` method fails to validate or restrict values for file-type custom profile fields, enabling authenticated users to store arbitrary paths. Additionally, the `wpforo fix upload dir()` sanitization function within `ucf file delete()` only remaps paths matching a specific pattern before they are passed to the `unlink()` function. Authenticated attackers with subscriber-level access or higher can exploit this to delete arbitrary files on the server, which may lead to remote code execution if critical files like 'wp-config.php' are removed. This issue requires the wpForo - User Custom Fields addon plugin to be active.

Insecure token-based authentication allows unauthenticated attackers to escalate privileges to administrator. The issue stems from the plugin trusting a user-supplied Base64-encoded user ID within the `token` parameter to identify users. Additionally, valid authentication tokens are leaked through the 'barcodeScannerConfigs' action, and the 'setUserMeta' action lacks meta-key restrictions. An attacker can spoof an administrator user ID to leak their authentication token and subsequently use that token to update the `wp capabilities` meta of any user to gain full administrative access.

The Visa Acceptance Solutions plugin for WordPress allows unauthenticated attackers to log in as any existing user, including administrators. This occurs because the `express pay product page pay for order()` function logs users in based solely on a user-supplied billing email address during guest checkout for subscription products, without verifying email ownership, requiring a password, or validating a one-time token. An attacker can achieve complete account takeover and site compromise by providing the target user's email address in the `billing details` parameter.

The User Registration & Membership plugin for WordPress is affected by an authentication bypass. This is caused by incorrect authentication in the `register member` function. An unauthenticated attacker can log in as a newly registered user if that user has the `urm user just created` user meta set.

The Unlimited Elements For Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting through SVG File uploads. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages when a user accesses the SVG file. Exploitation requires a form with a file upload field created using the premium version of the plugin, but the issue remains exploitable even after deactivation or uninstallation of the premium version.

The issue arises from the use of `add query arg` without proper escaping on the URL, leading to Reflected Cross-Site Scripting. This allows unauthenticated attackers to inject arbitrary web scripts, which execute when a user performs a specific action, such as clicking a specially crafted link.

The issue is related to Reflected Cross-Site Scripting due to the use of `add query arg` without appropriate escaping on the URL. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

The issue is related to Reflected Cross-Site Scripting due to the use of `add query arg` without appropriate escaping on the URL. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action, such as clicking on a specially crafted link.

The issue is related to Reflected Cross-Site Scripting due to the use of `add query arg` without proper escaping on the URL. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into performing an action, such as clicking on a specially crafted link.