Matthew Rollings

Insufficient sanitization and escaping of Google review content fetched from the Serp API allows unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). An attacker can submit a malicious review to a business's Google listing, which is then executed in the browser of any visitor, including administrators, when they view a WordPress page displaying the reviews for that specific Place ID via the Google Reviews widget.

An unauthenticated Stored Cross-Site Scripting (XSS) issue exists due to a predictable replacement hash used during the HTML minification process and the abuse of a regular expression. This allows an attacker to inject arbitrary HTML attributes into the final HTML output by anticipating the placeholder format.

Insufficient sanitization of content within a custom shortcode used in the email-encoding feature allows unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). This enables the injection of arbitrary web scripts into approved comments, which are then executed when any user, including administrators, views the post.

The FV Flowplayer Video Player plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping of comment text. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user visits the affected page. Successful exploitation depends on the administrator enabling the non-default `parse comments` setting (Parse Vimeo and YouTube links) and requires a submitted comment to be approved by an administrator before the payload is delivered.

Improper handling of email replacement allows unauthenticated users to perform Stored Cross-Site Scripting (XSS) attacks. This issue occurs due to unsafe handling of email replacement output and improper input validation or output encoding, which allows attacker-controlled content to be persisted and rendered as a script. An attacker can remotely inject crafted payloads during the email replacement process that are later served to visitors or administrators. This can lead to arbitrary JavaScript execution in the victim's browser, potentially resulting in administrative session hijacking, malicious redirects, and site takeover.

The plugin is subject to arbitrary file reading through the Draw SVG widget. This allows authenticated attackers with Contributor-level access or higher to read arbitrary files on the server, potentially exposing sensitive information.

The Email Encoder WordPress plugin fails to escape email addresses retrieved via user input. This allows unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server and executed in the browser of users who view the affected page.

Remote Code Execution is possible via the Display Logic feature. The issue arises because the plugin uses the `eval()` function on user-supplied Display Logic expressions with an insufficient blocklist/allowlist that can be bypassed using `array map` with string concatenation. Additionally, there is a lack of authorization enforcement on the `extended widget opts block` attribute. This allows authenticated attackers with Contributor-level access or higher to execute arbitrary code on the server.

Improper handling of email replacement allows unauthenticated users to perform Stored Cross-Site Scripting (XSS) attacks when the email encoder setting is enabled. Stored XSS occurs when a malicious script is permanently stored on the target server, which is then served to other users.

Unauthenticated Stored Cross-Site Scripting (XSS) is possible due to a predictable replacement hash used during the HTML minification process and the abuse of a regular expression. This allows an attacker to anticipate the placeholder format and inject arbitrary HTML attributes into the final HTML output.

The Autoptimize plugin for WordPress is susceptible to Stored Cross-Site Scripting through the lazy-loading image processing. This is caused by an overly permissive regular expression in the `add lazyload` function. The regular expression replaces all instances of `ssrc=` in image tags without restriction to the actual attribute. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. Attackers can achieve this by creating an image tag where the `src` URL contains a space followed by `src=`, which breaks the HTML structure and promotes text inside attribute values into executable HTML attributes.

The software contains a flaw in its regex replacement rules that allows for an Unauthenticated Stored-XSS attack. This occurs when a malicious link is posted as a comment, and then approved with lightbox for comments enabled. The issue allows an attacker to inject malicious code that will be executed when other users view the comment.

The CubeWP plugin for WordPress has an information exposure issue. Insufficient restrictions on the search feature in the `class-cubewp-search-ajax-hooks.php` file allows unauthenticated attackers to access data from password-protected, private, or draft posts that they should not be able to view. The vulnerable search feature allows extraction of sensitive information.

The Brizy – Page Builder plugin for WordPress is susceptible to sensitive information disclosure. Authenticated attackers with Contributor-level access or higher can extract sensitive data, including email addresses and hashed passwords of administrators, through the `get users()` function.

The a3 Lazy Load plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping of user-supplied attributes. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page.

The Royal Elementor Addons and Templates plugin for WordPress is susceptible to Stored Cross-Site Scripting. The issue is due to insufficient input sanitization and output escaping related to the `item['field id']` variable. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page.

The software contains a Stored Cross-Site Scripting issue due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. The issue is present through the 'api' and 'type' parameters.

The kallyas theme for WordPress is susceptible to Stored Cross-Site Scripting through multiple shortcodes. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page.

The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress allows an attacker with Contributor-level permissions to upload malicious files. This occurs when importing recipes via CSV, specifically by providing a remote URL during the import process. Successful exploitation can lead to Remote Code Execution (RCE). The vulnerability involves arbitrary file uploads, enabling the attacker to upload a PHP file. The vulnerable component is the CSV import functionality.

The kallyas theme for WordPress is susceptible to Remote Code Execution through the `TH PhpCode` pagebuilder widget. The issue arises because the theme does not restrict access to the code editor widget for users who are not administrators. This allows authenticated attackers with Contributor-level access or higher to execute code on the server. The `TH PhpCode` widget is the specific component involved in this issue.