Krugov Artyom

🚨 CVE-2025-15693 The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root. 🎖@cveNotify

🚨 CVE-2025-15694 The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered html capability is disallowed, for example in a multisite setup. 🎖@cveNotify

**Name of the Vulnerable Software and Affected Versions** The Ultimate Before After Image Slider & Gallery versions prior to 4.7.19 **Description** The plugin fails to properly escape the `after-label` value of the slider. This allows users with the Author role or higher to store a malicious payload that is subsequently re-injected into the Document Object Model (DOM) by a bundled client-side script. This can lead to the execution of arbitrary code in the browser of any user, including administrators, who views the affected slider. **Recommendations** Update The Ultimate Before After Image Slider & Gallery to version 4.7.19 or later.

**Name of the Vulnerable Software and Affected Versions** GeoDirectory WordPress plugin versions prior to 2.8.110 **Description** Insufficient sanitization and escaping of a place-category setting before it is output on an admin page allows high-privilege users, such as editors and above, to execute Stored Cross-Site Scripting (XSS) attacks. This occurs even in environments where the `unfiltered html` capability is disabled, such as multisite setups. Stored Cross-Site Scripting is a type of attack where malicious scripts are permanently stored on the target server. **Recommendations** Update GeoDirectory WordPress plugin to version 2.8.110 or later.

**Name of the Vulnerable Software and Affected Versions** Charitable WordPress plugin versions prior to 1.8.5.3 **Description** Stored Cross-Site Scripting (XSS) occurs because a campaign image text field is not properly sanitized and escaped before being output in an HTML attribute. This allows users with a high-privilege campaign-management role to execute malicious scripts on the front-end campaign page. **Recommendations** Update the Charitable WordPress plugin to version 1.8.5.3 or later.

**Name of the Vulnerable Software and Affected Versions** Ajax Load More WordPress plugin versions prior to 7.8.4 **Description** The plugin fails to properly sanitize and escape a parameter before outputting it back to the page. This leads to Reflected Cross-Site Scripting (XSS), a flaw where malicious scripts are reflected off a web application to the user's browser, which could be leveraged against high-privilege users such as administrators. **Recommendations** Update to version 7.8.4 or later.

**Name of the Vulnerable Software and Affected Versions** WP Lightbox 2 WordPress plugin versions prior to 3.0.7 **Description** The WP Lightbox 2 WordPress plugin does not properly sanitise and escape certain settings. This could allow users with high privileges, such as administrators, to carry out Stored Cross-Site Scripting (XSS) attacks. This is possible even when the `unfiltered html` capability is disabled, for example, in a multisite configuration. The issue involves insufficient input validation, potentially allowing malicious scripts to be injected and executed within the application. **Recommendations** Update WP Lightbox 2 WordPress plugin to version 3.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** Reading progressbar WordPress plugin versions prior to 1.3.1 **Description** The Reading progressbar WordPress plugin does not properly sanitise and escape certain settings. This could allow users with high privileges, such as administrators, to carry out Stored Cross-Site Scripting (XSS) attacks. This is possible even when the `unfiltered html` capability is disabled, for example, in a multisite setup. Stored XSS occurs when malicious scripts are persistently stored on the target server, allowing them to be delivered to other users who access the affected content. **Recommendations** Update the Reading progressbar WordPress plugin to version 1.3.1 or later.

**Name of the Vulnerable Software and Affected Versions** Simple SEO WordPress plugin versions prior to 2.0.32 **Description** The software does not properly sanitize and escape parameters when outputting them on the page. This could allow users with a contributor role or higher to perform Cross-Site Scripting attacks. **Recommendations** Update to version 2.0.32 or later.

Name of the Vulnerable Software and Affected Versions: AI ChatBot for WordPress plugin versions prior to 7.1.0 Description: The AI ChatBot for WordPress plugin does not sanitise and escape some of its settings. This could allow high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks, even when the `unfiltered html` capability is disallowed, for example, in a multisite setup. Recommendations: Update to version 7.1.0 or later.

**Name of the Vulnerable Software and Affected Versions** OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) versions through 1.2.0 **Description** The plugin does not validate and escape certain block options before displaying them on a page or post, potentially allowing users with contributor roles and above to execute Stored Cross-Site Scripting attacks. **Recommendations** Update OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) to a version later than 1.2.0.

Name of the Vulnerable Software and Affected Versions: Contact Form Plugin WordPress plugin versions prior to 1.1.29 Description: The issue concerns the Contact Form Plugin WordPress plugin, where some settings are not properly sanitized and escaped, potentially allowing high-privilege users, such as contributors, to perform Stored Cross-Site Scripting attacks. Recommendations: For versions prior to 1.1.29, update to version 1.1.29 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: WP Map Block versions prior to 2.0.3 Description: The issue concerns the WP Map Block WordPress plugin, which does not validate and escape some of its block options before outputting them back in a page or post where the block is embedded. This could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Recommendations: For WP Map Block versions prior to 2.0.3, update to version 2.0.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the WP Map Block plugin until a patch is applied, especially for users with the contributor role and above.

**Name of the Vulnerable Software and Affected Versions** Post Slider and Post Carousel with Post Vertical Scrolling Widget versions prior to 3.2.10 **Description** The issue concerns the WordPress plugin Post Slider and Post Carousel with Post Vertical Scrolling Widget, where certain widget options are not properly validated and escaped before being displayed on a page or post. This could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. **Recommendations** For versions prior to 3.2.10, update to version 3.2.10 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** The Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin versions prior to 5.1.6 real-cookie-banner-pro WordPress plugin versions prior to 5.1.6 **Description** The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised and escaped, and this vulnerability can be exploited even when the unfiltered html capability is disallowed, for example in a multisite setup. **Recommendations** For The Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin versions prior to 5.1.6, update to version 5.1.6 or later. For real-cookie-banner-pro WordPress plugin versions prior to 5.1.6, update to version 5.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin versions prior to 8.4.0 **Description** The issue concerns the failure to escape post titles in the dashboard, potentially allowing users with the contributor role to perform Cross-Site Scripting attacks. **Recommendations** For versions prior to 8.4.0, update to version 8.4.0 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Stylemix Cost Calculator Builder versions 3.2.74 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious scripts into the website, potentially affecting users who access the compromised page. Recommendations: For Stylemix Cost Calculator Builder versions 3.2.74 and earlier, update to a version later than 3.2.74 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Qi Blocks WordPress plugin versions prior to 1.4 Description: The issue concerns a Stored Cross-Site Scripting attack. It is caused by the Qi Blocks WordPress plugin not validating and escaping some of its Countdown block options before outputting them back in a page or post where the block is embedded. This could allow users with the contributor role and above to perform such attacks. Recommendations: For Qi Blocks WordPress plugin versions prior to 1.4, update to version 1.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Countdown block options to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Qi Blocks WordPress plugin versions prior to 1.4 Description: The issue concerns a Stored Cross-Site Scripting attack. It is caused by the plugin not validating and escaping some of its Counter block options before outputting them back in a page or post where the block is embedded. This could allow users with the contributor role and above to perform such attacks. Recommendations: For versions prior to 1.4, update to version 1.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Counter block options to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Qi Blocks WordPress plugin versions prior to 1.4 Description: The issue concerns the Qi Blocks WordPress plugin, which does not properly validate and escape some of its block options before outputting them in a page or post. This could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Recommendations: For Qi Blocks WordPress plugin versions prior to 1.4, update to version 1.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the vulnerable block options to minimize the risk of exploitation.