Khanh Nguyen

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GeneratePress GenerateBlocks generateblocks allows Stored XSS.This issue affects GenerateBlocks: from n/a through 2.5.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.116.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through 5.9.11.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. WpBookingly service-booking-manager allows Stored XSS.This issue affects WpBookingly: from n/a through 1.4.3.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.

Authenticated attackers with editor-level access or higher can perform blind SQL injection attacks. This occurs because the plugin fails to properly sanitize and escape an array key within a user-supplied parameter before incorporating it into a SQL query. This flaw allows attackers to append additional SQL queries to existing ones to extract sensitive information from the database.

An issue involving improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks the database true or false questions and determines the answer based on the application's response.

An issue exists where improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. This occurs due to insufficient escaping of user-supplied parameters and a lack of sufficient preparation of the SQL query. Unauthenticated attackers can append additional SQL queries to existing ones to extract sensitive information from the database.

Privilege escalation exists within the DOM: Service Workers component. Service Workers are scripts that the browser runs in the background, separate from a web page, enabling features like push notifications and offline access.

Privilege escalation exists within the Shell Integration component.

A site isolation issue exists within the WebExtensions component. Site isolation is a security mechanism that ensures web pages from different sites are run in separate processes to prevent one site from accessing data from another.

A privilege escalation issue exists within the DOM: Workers component.

A privilege escalation issue exists within the DOM Navigation component.

Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. This occurs when a user is tricked into clicking a malicious link. The issue is reachable via the unauthenticated `wp ajax nopriv r34ics ajax` AJAX action, which accepts attacker-controlled `js args` values merged over stored shortcode configuration without nonce verification (a security token used to prevent cross-site request forgery), allowing the `htmltagtitle` parameter to bypass the standard shortcode allowlist check.

An Insecure Direct Object Reference and Authorization Bypass allows authenticated attackers with Subscriber-level access or higher to delete arbitrary attachments from the Media Library. The issue occurs during the profile avatar update flow because the `save avatar()` function in `Charitable Profile Form` calls `wp delete attachment()` using an attachment ID from the user's `avatar` meta without verifying ownership. Additionally, `Charitable Data Processor::process picture()` returns the raw posted value when no file is uploaded, enabling the `avatar` user meta to be poisoned with a target attachment ID. Exploitation involves a two-request chain: first poisoning the stored avatar meta value and then triggering the deletion through a standard avatar upload.

The List category posts plugin for WordPress has a flaw where a time-based SQL Injection can occur through the `starting with` parameter of the catlist shortcode. This is due to inadequate escaping of user-provided input and insufficient preparation of the SQL query. Attackers with Contributor-level access or higher can add SQL queries to existing ones, potentially extracting sensitive information from the database.

The issue is related to insufficient input validation in the Infrastructure component of Oracle Financial Services Analytical Applications Infrastructure. This allows a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized update, insert, or delete access to some data, as well as unauthorized read access to a subset of data and the ability to cause a partial denial of service. The vulnerability may significantly impact additional products.

The issue is related to insufficient input validation in a subcomponent of the Oracle Financial Services Behavior Detection Platform, which is part of the Oracle Financial Services Applications. This can be exploited by a remote attacker with low privileges and network access via HTTP, potentially leading to unauthorized read access to a subset of accessible data.