Luc Huynh

**Name of the Vulnerable Software and Affected Versions** FormCraft versions prior to 3.9.15 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when accessed by a user. The issue stems from a server-side gap where composite matrix sub-field keys, such as `field2 0` and `field2 1`, bypass the sanitization loop and are stored raw via the `$wpdb->insert()` function. On the client side, DOMPurify is only triggered for string values, while matrix values are received as arrays, bypassing the check before being injected into the DOM. A second vector exists where array-typed field values are processed by `htmlentities()` upon submission but are subsequently reversed by `html entity decode()` in `formcraft-main.php` at lines 2608 and 2122, restoring the payload before storage and rendering. **Recommendations** Update FormCraft to version 3.9.15 or later.

**Name of the Vulnerable Software and Affected Versions** ARforms versions prior to 7.2.2 **Description** The ARforms plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts through the `password` field, which then execute when a user visits the affected page. **Recommendations** Update ARforms to version 7.2.2 or later. As a temporary mitigation, restrict or disable the use of the `password` field within the plugin until the update is applied.

**Name of the Vulnerable Software and Affected Versions** WP Cost Estimation & Payment Forms Builder (E&P Forms) versions prior to 10.5.98 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts through the `customerInfos` parameter, which execute when a user accesses the affected page. **Recommendations** Update the plugin to version 10.5.98 or later. As a temporary mitigation, restrict or sanitize the input provided to the `customerInfos` parameter.

**Name of the Vulnerable Software and Affected Versions** Slider Revolution versions prior to 7.0.11 **Description** The plugin is subject to sensitive information disclosure resulting from three design flaws. First, a valid backend AJAX nonce `revslider actions` is leaked to all authenticated users, including those with Subscriber roles, via the `admin footer` hook. Second, the `wordpress.create.image from url` action is included in the `$user allowed` array, which bypasses access controls intended for administrators. Third, the `create wordpress image from url()` function accepts a user-controlled `url` parameter passed to `import media()`. The `path or url exists()` function allows local filesystem paths, and the `@copy()` function moves these files into the publicly accessible `/wp-content/uploads/revslider/ai/` directory. Because the MIME type check relies on the attacker-supplied `content type` parameter and the source extension blacklist fails to block various sensitive formats such as `.sql`, `.log`, `.json`, `.bak`, `.xml`, `.csv`, `.conf`, `.yml`, `.yaml`, `.pem`, `.key`, `.crt`, `.txt`, and `.db`, authenticated attackers with Subscriber-level access can read server files by copying them to a public URL. **Recommendations** Update the plugin to a version later than 7.0.10.