Marcin Dudek

The SEO Plugin by Squirrly SEO plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check within the `sq ajax uninstall` function. Authenticated attackers with Subscriber-level access or higher can disconnect the site from Squirrly's cloud service.

The Razorpay for WooCommerce plugin for WordPress is susceptible to unauthorized data modification. A missing capability check within the `getCouponList()` function, stemming from the `checkAuthCredentials()` permission callback consistently returning true, bypasses authentication. This allows unauthenticated attackers to alter billing and shipping contact details (email and phone) of any WooCommerce order, given knowledge or a guess of the order ID.

The SlimStat Analytics plugin for WordPress is susceptible to a time-based SQL Injection issue. This is due to inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries, specifically through the `args` parameter. Authenticated attackers with Subscriber-level access or higher can inject additional SQL queries into existing ones, potentially extracting sensitive information from the database.

The Fluent Forms plugin for WordPress is affected by a missing authorization issue. Capability checks are absent on the `fluentform ai create form` AJAX action, allowing authenticated attackers with Subscriber-level access or higher to create arbitrary forms through the AI builder.

The PixelYourSite plugin for WordPress is susceptible to sensitive information disclosure through publicly exposed log files. An unauthenticated attacker may be able to view potentially sensitive information contained within these logs when the "Meta API logs" setting is enabled. The issue was addressed with a partial patch in version 11.1.5 and a full patch in version 11.1.5.1.

The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is susceptible to Remote Code Execution due to a missing capability check within the `WooCommerce Delivery Notes::update` function, the presence of PHP enabled in Dompdf, and a lack of proper escaping in the `template.php` file. This combination allows unauthenticated attackers to potentially execute code on the server. The `WooCommerce Delivery Notes::update` function is a key component involved in the issue.

The PostX plugin for WordPress is affected by a flaw that allows unauthorized access to data. A missing capability check on the `/ultp/v2/get dynamic content/` REST API endpoint allows unauthenticated attackers to retrieve sensitive user metadata, including password hashes.

The plugin exposes its admin embed endpoint at `/wp-json/ssa/v1/embed-inner-admin` without authentication. This exposure leaks plugin settings, including staff names, business names, and configuration data not publicly displayed on the booking form. Unauthenticated attackers can extract private business configuration. In premium versions with integrations configured, this may also expose sensitive data including API keys for external services.

The plugin is susceptible to unauthorized data modification because of a missing capability check on the `/webp-converter/v1/regenerate-attachment` REST endpoint. This allows authenticated attackers with Subscriber-level access or higher to delete optimized WebP/AVIF variants for any attachment. The affected API endpoint is `/webp-converter/v1/regenerate-attachment`.

The Ninja Forms plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. The plugin does not adequately verify user authorization before the `ninja-forms-views` REST endpoints return form metadata and submission content. This allows unauthenticated attackers to read arbitrary form definitions and submission records if they can obtain a leaked bearer token and load a page containing the Submissions Table block. A patch released in version 3.13.1 was found to be ineffective as it introduced a REST API endpoint that allowed the creation of valid bearer tokens for arbitrary form IDs.

The Booking Calendar plugin for WordPress is susceptible to a time-based blind SQL injection. This occurs due to insufficient escaping of the `dates to check` parameter and inadequate preparation of existing SQL queries. This allows unauthenticated attackers to append additional SQL queries, potentially extracting sensitive information from the database. The vulnerable parameter is `dates to check`.

The OneSignal – Web Push Notifications plugin for WordPress is susceptible to unauthorized modification of data. This occurs because of a missing capability check when handling settings, allowing attackers to directly modify the OneSignal App ID, REST API key, and notification behavior through POST requests without authentication. The plugin processes POST requests without verifying user capabilities or nonces.

The software is susceptible to a time-based blind SQL Injection issue via the `opid` parameter. This is due to inadequate input sanitization and insufficient query preparation. An unauthenticated attacker can inject additional SQL queries into existing database queries, potentially extracting sensitive information.

The Advanced Custom Fields: Extended plugin for WordPress has a flaw that allows for Remote Code Execution (RCE). This is due to the `prepare form()` function accepting user input and passing it through `call user func array()`. This allows unauthenticated attackers to execute arbitrary code on the server, potentially enabling them to inject backdoors or create new administrative user accounts. Approximately 100,000 WordPress sites are estimated to be affected. Attackers can exploit this by sending a specially crafted request to the server. The `prepare form()` function is the point of entry for this issue.

The Welcart e-Commerce plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check on the `usces export` action. An unauthenticated attacker can access configured payment credentials (such as PayPal API secrets), business contact details, mail templates, and other operational settings tied to the store.

The issue is related to the TEL-STER TelWin SCADA WebInterface, where external input could be used to construct paths to files and directories without properly neutralizing special elements within the pathname. This could allow an unauthenticated attacker to read files on the system. The vulnerability is associated with incorrect restriction of the directory path name with limited access.

The issue concerns a cross-site scripting vulnerability that could allow an unauthenticated remote attacker to inject malicious JavaScript code.

The issue allows an unauthenticated remote attacker to execute commands with root privileges on the operation system due to code injection.

The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator.

The issue allows an attacker to upload or transfer files of dangerous types to the WebHMI portal. These files may be automatically processed within the product's environment, potentially leading to arbitrary code execution. The vulnerability is related to the lack of restrictions on file uploads.