Lucas Montes

**Name of the Vulnerable Software and Affected Versions** Amelia plugin for WordPress versions prior to 2.3 **Description** An authentication bypass occurs because the `AddBookingCommand` function in `Command.php` skips nonce verification, allowing unauthenticated users to submit booking data. Although the `firstName` and `lastName` variables are processed by `sanitize text field()`, this function preserves double quotes. In the administrative Calendar view, the `eventContent` callback in `redesign/dist/index.js` interpolates these names into JavaScript template literals and renders them via `innerHTML` without proper HTML entity encoding. This allows an unauthenticated attacker to inject arbitrary web scripts through the customer name fields that execute when an administrator hovers over the malicious appointment on the Calendar page. **Recommendations** Update the plugin to a version later than 2.2.

**Name of the Vulnerable Software and Affected Versions** Prevent Direct Access – Protect WordPress Files versions prior to 2.8.8.9 **Description** Insufficient token validation in the `get advance file by url()` method allows unauthenticated attackers to gain unauthorized access to protected files. The issue occurs because the method employs a SQL `LIKE` operator for token lookup without escaping wildcard characters using `$wpdb->esc like()`. By providing SQL wildcard characters, such as `%`, as the token value, an attacker can bypass the private token requirement to match any record in the plugin's file table and download protected files. **Recommendations** Update to a version newer than 2.8.8.8.

**Name of the Vulnerable Software and Affected Versions** Ninja Forms - The Contact Form Builder That Grows With You versions prior to 3.14.2 **Description** The Ninja Forms plugin for WordPress is susceptible to sensitive information disclosure. Authenticated attackers with Contributor-level access or higher can potentially access an authorization token. This token allows viewing form submissions for any form, which may include sensitive data. The issue stems from a callback function within the `blocks/bootstrap.php` file, specifically related to the `admin enqueue scripts` action handler. **Recommendations** Update Ninja Forms to version 3.14.2 or later.

**Name of the Vulnerable Software and Affected Versions** Greenshift – animation and page builder blocks plugin for WordPress versions up to and including 12.8.3 **Description** The software is susceptible to an Insecure Direct Object Reference issue. This is a result of a lack of authorization and post status validation within the `gspb el reusable load()` AJAX handler. The handler accepts a `post id` parameter and renders the content of any `wp block` post without verifying user permissions to read the post or checking its status. The nonce is exposed to unauthenticated users on any public page utilizing the `[wp reusable render]` shortcode with `ajax="1"`, allowing unauthenticated attackers to retrieve rendered HTML content from private, draft, or password-protected reusable blocks. **Recommendations** Versions prior to 12.8.4 should be updated.

**Name of the Vulnerable Software and Affected Versions** Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress versions through 8.7.4 **Description** The Blog2Social plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check on the `b2s curation draft` AJAX action. The `curationDraft()` function only verifies `current user can('read')` instead of confirming if the user has `edit post` permission for the specific post. Because the plugin provides UI access and exposes nonces to all roles, authenticated attackers with Subscriber-level access or higher can overwrite the title and content of any post or page. This is achieved by providing a target post ID through the `b2s-draft-id` parameter. **Recommendations** Update to a version beyond 8.7.4.

**Name of the Vulnerable Software and Affected Versions** Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress versions prior to 6.5.2 **Description** The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is susceptible to Server-Side Request Forgery in versions up to and including 6.5.1. This allows unauthenticated attackers to make web requests to arbitrary locations originating from the web application. Attackers can potentially query and modify information from internal services through the `PassthruLoader::load image source` function. **Recommendations** Update to version 6.5.2 or later.

**Name of the Vulnerable Software and Affected Versions** libsoup (affected versions not specified) **Description** An unsigned to signed conversion error exists in the `soup body input stream read chunked()` function. A remote attacker can exploit this by sending a malicious HTTP request when libsoup is used behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. This can lead to HTTP request smuggling, allowing the attacker to bypass security controls, poison web caches, or gain unauthorized access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Migration, Backup, Staging – WPvivid Backup & Migration versions prior to 0.9.124 **Description** An unauthenticated arbitrary file upload issue exists due to improper error handling during the RSA decryption process and a lack of path sanitization when writing uploaded files. When the plugin fails to decrypt a session key using `openssl private decrypt()`, it passes a boolean false value to the phpseclib library's AES cipher initialization. The library interprets this false value as a string of null bytes, allowing an attacker to encrypt a malicious payload using a predictable null-byte key. Furthermore, the plugin accepts filenames from the decrypted payload without sanitization, enabling directory traversal to escape the protected backup directory. This allows unauthenticated attackers to upload arbitrary PHP files to publicly accessible directories and achieve Remote Code Execution via the `wpvivid action=send to site` parameter. Approximately 800,000 WordPress sites are potentially affected, specifically those with the receive backup from another site feature enabled. **Recommendations** Update Migration, Backup, Staging – WPvivid Backup & Migration to version 0.9.124 or later. Disable the receive backup from another site feature if it is not necessary.

**Name of the Vulnerable Software and Affected Versions** Simply Schedule Appointments Booking Plugin versions prior to 1.6.9.6 **Description** The Appointment Booking Calendar – Simply Schedule Appointments Booking Plugin for WordPress is susceptible to sensitive information exposure due to the use of a hardcoded fall-back salt within the `hash()` function. This allows unauthenticated attackers to generate a valid token on sites utilizing the plugin that haven’t manually configured a salt in the `wp-config.php` file. Successful exploitation enables access to booking information, potentially allowing attackers to make modifications. **Recommendations** Update the Simply Schedule Appointments Booking Plugin to version 1.6.9.6 or later. Manually set a salt in the `wp-config.php` file to prevent the use of the hardcoded fall-back salt.

**Name of the Vulnerable Software and Affected Versions** Ninja Forms – The Contact Form Builder That Grows With You versions up to and including 3.13.2 **Description** The Ninja Forms plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. The plugin does not adequately verify user authorization before the `ninja-forms-views` REST endpoints return form metadata and submission content. This allows unauthenticated attackers to read arbitrary form definitions and submission records if they can obtain a leaked bearer token and load a page containing the Submissions Table block. A patch released in version 3.13.1 was found to be ineffective as it introduced a REST API endpoint that allowed the creation of valid bearer tokens for arbitrary form IDs. **Recommendations** Versions prior to 3.13.1 are vulnerable. Versions 3.13.1 and 3.13.2 are vulnerable. Restrict access to the `ninja-forms-views` REST API endpoints. Monitor bearer tokens for suspicious activity.

**Name of the Vulnerable Software and Affected Versions** Feedzy RSS Aggregator plugin for WordPress versions up to and including 5.1.1 **Description** The Feedzy RSS Aggregator plugin for WordPress is susceptible to a Blind Server-Side Request Forgery (SSRF) issue. This allows unauthenticated attackers to initiate web requests to arbitrary locations from the web application. Exploitation can lead to querying and modification of information from internal services. **Recommendations** Update to version 5.1.2.

**Name of the Vulnerable Software and Affected Versions** LearnPress – WordPress LMS Plugin versions prior to 4.2.9.5 **Description** The LearnPress – WordPress LMS Plugin for WordPress is affected by a sensitive information disclosure issue. Missing capability checks in the REST endpoint `/wp-json/lp/v1/load content via ajax` allow arbitrary callback execution of admin-only template methods. This enables unauthenticated attackers to retrieve sensitive educational content, including admin curriculum HTML, quiz questions with correct answers, and course materials, by supplying valid numeric IDs to the REST API endpoint. The vulnerable parameter is the numeric ID supplied to the `/wp-json/lp/v1/load content via ajax` endpoint. **Recommendations** Versions prior to 4.2.9.5 should be updated.

**Name of the Vulnerable Software and Affected Versions** Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links plugin for WordPress versions through 1.2.5 **Description** The plugin is susceptible to unauthorized post modification because of insufficient authorization checks. The plugin registers a REST API endpoint that verifies a broad capability (`aioseo blc broken links page`) granted to contributor-level users, without validating the user’s permission to act on the specific post. This allows authenticated attackers with contributor access or higher to delete arbitrary posts using the **API endpoint** `/wp-json/aioseoBrokenLinkChecker/v1/post`. The **vulnerable parameter** is the post identifier used in the DELETE request. **Recommendations** Update the Broken Link Checker by AIOSEO plugin to a version beyond 1.2.5.

**Name of the Vulnerable Software and Affected Versions** Envira Photo Gallery versions up to and including 1.11.0 **Description** The Envira Photo Gallery plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check on the `/envira-convert/v1/bulk-convert` API endpoint. Authenticated attackers with contributor-level access or higher can convert galleries to Envira galleries. The vulnerable parameter is not specified. **Recommendations** Update Envira Photo Gallery to a version newer than 1.11.0.

**Name of the Vulnerable Software and Affected Versions** ElementInvader Addons for Elementor versions prior to 1.4.1 **Description** The ElementInvader Addons for Elementor WordPress plugin is affected by a missing authorization check. An unauthenticated user can send arbitrary emails to arbitrary addresses through the `elementinvader addons for elementor forms send form` action. **Recommendations** Update ElementInvader Addons for Elementor to version 1.4.1 or later.

**Name of the Vulnerable Software and Affected Versions** GenerateBlocks plugin for WordPress versions through 2.1.1 **Description** The GenerateBlocks plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check within the `get option rest` function. Authenticated attackers with contributor-level access or higher can read arbitrary WordPress options. This includes sensitive information such as SMTP credentials and API keys stored by other plugins. **Recommendations** Update the GenerateBlocks plugin to a version later than 2.1.1.

**Name of the Vulnerable Software and Affected Versions** Product Filter by WBW versions up to and including 3.0.0 **Description** The Product Filter by WBW plugin for WordPress has a flaw where data can be modified without authorization. This is due to a missing capability check on the 'approveNotice' action. Unauthenticated attackers can potentially update the plugin’s settings. **Recommendations** Update the Product Filter by WBW plugin to a version later than 3.0.0.

**Name of the Vulnerable Software and Affected Versions** Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress versions up to and including 5.1.0 **Description** The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is susceptible to Server-Side Request Forgery. This allows authenticated attackers with Subscriber-level access or higher to make web requests to arbitrary locations from the web application. This can be used to query information from internal services via the `feedzy sanitize feeds` function. **Recommendations** Update Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress to a version later than 5.1.0.

**Name of the Vulnerable Software and Affected Versions** LearnPress – WordPress LMS Plugin versions up to and including 4.2.9.2 **Description** The LearnPress – WordPress LMS Plugin is susceptible to data modification due to absent capability checks on Admin Tools REST endpoints. These endpoints are registered with ` return true` as the permission callback, allowing unauthenticated attackers to perform destructive database operations. Specifically, attackers can drop indexes on any table, including WordPress core tables like `wp options`, create duplicate configuration entries, and degrade site performance. This is achievable through the `/wp-json/lp/v1/admin/tools/create-indexs` endpoint by providing table names. **Recommendations** Update to version 4.2.9.4 or later.

**Name of the Vulnerable Software and Affected Versions** WPC Smart Quick View for WooCommerce plugin versions through 4.2.5 **Description** The WPC Smart Quick View for WooCommerce plugin for WordPress has an information exposure issue. Insufficient restrictions on posts included via the `woosq quickview` API endpoint allows unauthenticated attackers to extract data from password-protected, private, or draft products that they should not have access to. **Recommendations** Update the WPC Smart Quick View for WooCommerce plugin to a version later than 4.2.5.