Michael Mazzolini

**Name of the Vulnerable Software and Affected Versions** Link Whisper Free versions prior to 0.9.1 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute whenever a user accesses the affected page. The issue is triggered via the `user id` parameter. **Recommendations** Update to a version later than 0.9.0. As a temporary workaround, restrict or avoid using the `user id` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Rank Math SEO versions prior to 1.0.272 **Description** The Rank Math SEO plugin for WordPress allows unauthorized access because the `update site editor homepage()` function lacks a capability check. This allows unauthenticated attackers to modify various plugin settings, such as the homepage title, meta description, breadcrumbs label, and social media metadata. Such modifications can negatively impact SEO rankings and enable the display of malicious content on all site pages where breadcrumbs are implemented. **Recommendations** Update the plugin to version 1.0.272 or later. As a temporary workaround, restrict access to the `update site editor homepage()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Royal Addons for Elementor versions prior to 1.7.1049 **Description** The Royal Addons for Elementor plugin for WordPress has a flaw that allows arbitrary file upload. This is caused by inadequate file type validation, specifically failing to properly sanitize files named `main.php`. This allows authenticated attackers with author-level access or higher to upload arbitrary files to the server, potentially leading to remote code execution. **Recommendations** Update Royal Addons for Elementor to a version later than 1.7.1049.

**Name of the Vulnerable Software and Affected Versions** Aruba HiSpeed Cache versions up to and including 3.0.2 **Description** The Aruba HiSpeed Cache plugin for WordPress is susceptible to Reflected Cross-Site Scripting through the `dbstatus` parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. Successful exploitation requires tricking a user into performing an action, such as clicking a malicious link, which then executes the injected script. **Recommendations** Update Aruba HiSpeed Cache to a version later than 3.0.2.

**Name of the Vulnerable Software and Affected Versions** Aruba HiSpeed Cache versions up to and including 3.0.2 **Description** The Aruba HiSpeed Cache plugin for WordPress is susceptible to unauthorized data modification because of absent capability checks in several functions. This allows unauthenticated attackers to alter the plugin’s configuration, activate or deactivate features, and control WordPress cron jobs or debug mode. **Recommendations** Update Aruba HiSpeed Cache to a version later than 3.0.2.

**Name of the Vulnerable Software and Affected Versions** WP Maps – Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters plugin for WordPress versions prior to 4.8.7 **Description** The WP Maps plugin for WordPress is susceptible to a Local File Inclusion issue. This allows authenticated attackers with Subscriber-level access or higher to include and execute arbitrary .html files on the server. Successful exploitation could lead to bypassing access controls, obtaining sensitive data, or achieving code execution if .html files containing PHP code can be uploaded and included. The vulnerable function is `fc load template()`. **Recommendations** Update the WP Maps – Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters plugin to version 4.8.7 or later.

**Name of the Vulnerable Software and Affected Versions** BuddyPress plugin for WordPress versions prior to 14.3.4 **Description** The BuddyPress plugin for WordPress is susceptible to arbitrary shortcode execution. This occurs because the software does not properly validate input before running the `do shortcode` function. This allows unauthenticated attackers to execute arbitrary shortcodes. **Recommendations** Update the BuddyPress plugin to version 14.3.4 or later.

**Name of the Vulnerable Software and Affected Versions** All-in-One Video Gallery plugin for WordPress versions prior to 4.5.8 **Description** The All-in-One Video Gallery plugin for WordPress is susceptible to arbitrary file upload due to inadequate file type validation when handling VTT files. This allows attackers to bypass sanitization by using double extension files, potentially leading to remote code execution. The issue affects authenticated attackers with author-level access or higher. The vulnerability stems from the plugin’s acceptance of files as valid VTT files without proper checks, enabling the upload of arbitrary files to the server. **Recommendations** Update the All-in-One Video Gallery plugin to version 4.5.8 or later.

**Name of the Vulnerable Software and Affected Versions** Supreme Modules Lite versions prior to 2.5.63 **Description** The Supreme Modules Lite plugin for WordPress is susceptible to arbitrary file upload due to inadequate file type validation. The plugin incorrectly identifies JSON files, permitting files with double extensions to bypass sanitization. This allows authenticated attackers with author-level access or higher to upload arbitrary files to the server, potentially leading to remote code execution. **Recommendations** Update Supreme Modules Lite to version 2.5.63 or later.

**Name of the Vulnerable Software and Affected Versions** Filter & Grids plugin for WordPress versions prior to 3.2.1 **Description** The Filter & Grids plugin for WordPress is susceptible to SQL Injection through the `phrase` parameter. Insufficient input validation and inadequate SQL query preparation allow unauthenticated attackers to inject additional SQL queries, potentially extracting sensitive information from the database. This issue is confirmed to affect MariaDB databases, causing syntax errors in MySQL. **Recommendations** Update the Filter & Grids plugin to version 3.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** WordPress Starter Templates versions up to and including 4.4.41 **Description** The Starter Templates plugin for WordPress is susceptible to arbitrary file upload due to inadequate file type validation when handling WXR files. This allows files with double extensions to bypass sanitization, enabling authenticated attackers with author-level access or higher to upload arbitrary files to the server. Successful exploitation may lead to remote code execution. **Recommendations** Update the Starter Templates plugin to a version newer than 4.4.41.

**Name of the Vulnerable Software and Affected Versions** Demo Importer Plus plugin for WordPress versions up to and including 2.0.6 **Description** The Demo Importer Plus plugin for WordPress is susceptible to arbitrary file upload due to inadequate file type validation when processing WXR files. This allows attackers to bypass sanitization by using double extension files, potentially leading to remote code execution. The issue affects authenticated attackers with author-level access or higher. **Recommendations** Versions prior to and including 2.0.6 should have file upload access restricted. Monitor file uploads for suspicious activity.

**Name of the Vulnerable Software and Affected Versions** Code Snippets versions prior to 3.9.1 **Description** The Code Snippets plugin for WordPress is susceptible to PHP Code Injection in versions up to and including 3.9.1. This occurs because the plugin utilizes `extract()` on shortcode attributes controlled by attackers within the `evaluate shortcode from flat file` method. This can overwrite the `filepath` variable, which is then used with `require once`. Authenticated attackers with Contributor-level access or higher can execute arbitrary PHP code on the server through the `[code snippet]` shortcode. This requires an administrator to enable the "Enable file-based execution" setting and create at least one active Content snippet. The `extract()` function is used to import variables from an array into the current scope. **Recommendations** Update Code Snippets to version 3.9.1 or later.

**Name of the Vulnerable Software and Affected Versions** Enable SVG, WebP, and ICO Upload plugin for WordPress versions up to and including 1.1.2 **Description** The Enable SVG, WebP, and ICO Upload plugin for WordPress is susceptible to arbitrary file upload due to insufficient file type validation when handling ICO files. This allows attackers to bypass sanitization by using double extensions and appropriate magic bytes, potentially enabling the upload of malicious files. Successful exploitation could lead to remote code execution on the affected server. The issue affects authenticated attackers with author-level access or higher. **Recommendations** Update the Enable SVG, WebP, and ICO Upload plugin to a version later than 1.1.2.

**Name of the Vulnerable Software and Affected Versions** WP Project Manager plugin for WordPress versions prior to 2.6.27 **Description** The WP Project Manager plugin for WordPress is susceptible to a time-based SQL Injection issue. This is due to inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries, specifically affecting the `completed at operator` parameter. Authenticated attackers with Subscriber-level access or higher can inject additional SQL queries into existing queries to extract sensitive information from the database. **Recommendations** Update the WP Project Manager plugin to version 2.6.27 or later.

**Name of the Vulnerable Software and Affected Versions** The Events Calendar plugin for WordPress versions through 6.15.9 **Description** The Events Calendar plugin for WordPress has an information disclosure issue. The `sysinfo` REST endpoint performs a weak comparison between the provided key and the stored opt-in key. This allows unauthenticated attackers to obtain the full system report when the "Yes, automatically share my system information with The Events Calendar support team" setting is enabled. The vulnerable endpoint is `/sysinfo`. The issue arises from the comparison of the `key` parameter. **Recommendations** Versions prior to 6.15.9 are affected.

**Name of the Vulnerable Software and Affected Versions** ShopLentor versions prior to 3.2.6 **Description** The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is susceptible to Local File Inclusion in versions up to and including 3.2.5. This allows unauthenticated attackers to include and execute arbitrary .php files on the server through the `load template` function. Successful exploitation could lead to bypassing access controls, obtaining sensitive data, or achieving code execution if .php file uploads are permitted. **Recommendations** Update ShopLentor to version 3.2.6 or later.

**Name of the Vulnerable Software and Affected Versions** Advanced Ads – Ad Manager & AdSense plugin for WordPress versions prior to 2.0.13 **Description** The Advanced Ads – Ad Manager & AdSense plugin for WordPress is susceptible to Remote Code Execution through the `select one()` function. The issue stems from insufficient restrictions on access to an AJAX endpoint and a lack of limitations on the functions that can be called. This allows unauthenticated attackers to execute arbitrary functions starting with 'get the ', such as `get the excerpt`, potentially leading to information disclosure. The vulnerable endpoint is an AJAX endpoint. The vulnerable parameter is not specified. **Recommendations** Update Advanced Ads – Ad Manager & AdSense plugin for WordPress to version 2.0.13 or later.

**Name of the Vulnerable Software and Affected Versions** Product Filter by WBW versions up to and including 2.9.7 **Description** The Product Filter by WBW plugin for WordPress is susceptible to SQL Injection via the `filtersDataBackend` parameter. Insufficient input validation and inadequate SQL query preparation allow attackers to inject additional SQL queries, potentially extracting sensitive information from the database. **Recommendations** Update Product Filter by WBW to a version later than 2.9.7

**Name of the Vulnerable Software and Affected Versions** Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions plugin for WordPress versions up to and including 8.3.1 **Description** The Stripe Payment Forms plugin for WordPress is susceptible to SQL Injection due to inadequate input validation and query preparation. Specifically, the `wpfs-form-name` parameter is not properly sanitized, allowing attackers to inject malicious SQL code. This could enable unauthorized access to sensitive database information. **Recommendations** Update the Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions plugin to a version later than 8.3.1.