Kuba

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. This is due to insufficient input sanitization and output escaping in the wp load js() function, which reads filter values from the URL path via the url request extension's parse url query() and embeds them into an inline JavaScript string using json encode() without escaping single quotes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data[name]' Parameter in all versions up to, and including, 2.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The show preview AJAX action is registered for unauthenticated users and is gated only by a nonce, which an unauthenticated attacker can retrieve by loading any publicly accessible page that emits it.

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions up to, and including, 3.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires the victim to first visit the attacker-crafted URL and then click the Terms of Service link rendered on the resulting registration page.

**Name of the Vulnerable Software and Affected Versions** Hummingbird versions prior to 3.21.1 **Description** Remote Code Execution is possible via the `log msg()` function in core/modules/class-page-cache.php. The page-cache debug log is written to a web-accessible PHP file that fails to maintain a protective header due to an incorrect `class exists()` check for the `HummingbirdCoreFilesystem` class. Consequently, the `get cookies()` function writes the raw name of any cookie starting with the `wphb cache ` prefix into the log file without sanitization. This allows unauthenticated attackers to inject and execute arbitrary PHP code by sending a request and then accessing the log file directly. This issue requires the Page Caching Debug Log option to be enabled and the log file to be generated during a front-end request, which can occur during cache flushes, the Clear logs action, or daily log-rotation cron tasks. **Recommendations** Update to a version newer than 3.21.0. Disable the Page Caching Debug Log option to prevent the creation of the vulnerable log file.