Lhking

**Name of the Vulnerable Software and Affected Versions** GTM4WP – A Google Tag Manager (GTM) plugin for WordPress versions prior to 1.22.4 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages by placing a guest checkout order with a JavaScript payload in a WooCommerce billing field, such as the billing first name. This issue requires the WooCommerce order data integration option `GTM4WP OPTION INTEGRATE WCORDERDATA` to be enabled. The injected scripts execute whenever a user accesses the affected page. **Recommendations** Update to a version newer than 1.22.3. Disable the `GTM4WP OPTION INTEGRATE WCORDERDATA` option as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** WPForms Pro versions prior to 1.10.1.2 **Description** An arbitrary file upload issue exists in the `ajax chunk upload finalize()` function. The flaw occurs because file type validation is performed after the chunk metadata and file contents are written to the disk, and the assembled file is not deleted if validation fails. This allows unauthenticated attackers to upload executable files, potentially leading to remote code execution. **Recommendations** Update WPForms Pro to version 1.10.1.2 or later. As a temporary mitigation, restrict access to the `ajax chunk upload finalize()` function.

**Name of the Vulnerable Software and Affected Versions** SAML Single Sign On – SSO Login plugin for WordPress versions prior to 5.4.4 **Description** An authentication bypass exists due to SAML Signature Algorithm Confusion. The issue occurs because the `Mo SAML Utilities::mo saml cast key()` function reads the `SignatureMethod` attribute directly from the attacker-controlled `SAMLResponse` parameter instead of using the locally configured algorithm. This allows the plugin to treat the Identity Provider's RSA public key as an HMAC-SHA1 shared secret to validate a forged signature. Consequently, unauthenticated attackers can forge SAML assertions for any account, including administrators, to obtain authentication cookies and achieve full account takeover. **Recommendations** Update the plugin to a version newer than 5.4.3.

**Name of the Vulnerable Software and Affected Versions** TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress versions prior to 3.6.14 **Description** Insufficient file path validation in the `delete converted image size()` function allows authenticated attackers with author-level access or higher to delete arbitrary files on the server. This can be achieved by injecting a server file path into the `convert.path` field of the `tiny compress images` post meta on an attachment owned by the attacker and then triggering the attachment deletion. Deleting critical files, such as `wp-config.php`, can lead to remote code execution. **Recommendations** Update the plugin to version 3.6.14 or later.

**Name of the Vulnerable Software and Affected Versions** Page Builder by SiteOrigin versions prior to 2.34.4 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. This happens because the `panels data` parameter is stored as post meta, bypassing the `wp kses` fallback—a WordPress function used to filter HTML—which allows unsanitized `WP Widget Custom HTML` content to be rendered on the frontend when a user accesses the affected page. **Recommendations** Update Page Builder by SiteOrigin to version 2.34.4 or later. As a temporary mitigation, restrict the `panels data` parameter or limit user permissions to prevent Contributor-level users from editing pages.