Mdr

An authorization issue exists in Pie Register that allows exploiting incorrectly configured access control security levels.

An authorization bypass exists in N-Media Frontend File Manager’s nmedia-user-file-uploader due to incorrectly configured access control security levels. This allows for exploitation through user-controlled keys.

A flaw exists in Leap13 Premium Addons for Elementor that could allow unauthorized retrieval of sensitive data. The issue involves the exposure of sensitive system information to an unauthorized control sphere.

A flaw exists in UserElements Ultimate Member Widgets for Elementor that allows the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data.

The issue is related to Stored Cross-Site Scripting via svg upload due to insufficient input sanitization and output escaping. This allows authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure revslider can be extended to authors.

The issue is related to Stored Cross-Site Scripting via the `button link` parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.