Michael Mazzolini

Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute whenever a user accesses the affected page. The issue is triggered via the `user id` parameter.

The Rank Math SEO plugin for WordPress allows unauthorized access because the `update site editor homepage()` function lacks a capability check. This allows unauthenticated attackers to modify various plugin settings, such as the homepage title, meta description, breadcrumbs label, and social media metadata. Such modifications can negatively impact SEO rankings and enable the display of malicious content on all site pages where breadcrumbs are implemented.

The Royal Addons for Elementor plugin for WordPress has a flaw that allows arbitrary file upload. This is caused by inadequate file type validation, specifically failing to properly sanitize files named `main.php`. This allows authenticated attackers with author-level access or higher to upload arbitrary files to the server, potentially leading to remote code execution.

The Aruba HiSpeed Cache plugin for WordPress is susceptible to unauthorized data modification because of absent capability checks in several functions. This allows unauthenticated attackers to alter the plugin’s configuration, activate or deactivate features, and control WordPress cron jobs or debug mode.

The Aruba HiSpeed Cache plugin for WordPress is susceptible to Reflected Cross-Site Scripting through the `dbstatus` parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. Successful exploitation requires tricking a user into performing an action, such as clicking a malicious link, which then executes the injected script.

The WP Maps plugin for WordPress is susceptible to a Local File Inclusion issue. This allows authenticated attackers with Subscriber-level access or higher to include and execute arbitrary .html files on the server. Successful exploitation could lead to bypassing access controls, obtaining sensitive data, or achieving code execution if .html files containing PHP code can be uploaded and included. The vulnerable function is `fc load template()`.

The BuddyPress plugin for WordPress is susceptible to arbitrary shortcode execution. This occurs because the software does not properly validate input before running the `do shortcode` function. This allows unauthenticated attackers to execute arbitrary shortcodes.

The Supreme Modules Lite plugin for WordPress is susceptible to arbitrary file upload due to inadequate file type validation. The plugin incorrectly identifies JSON files, permitting files with double extensions to bypass sanitization. This allows authenticated attackers with author-level access or higher to upload arbitrary files to the server, potentially leading to remote code execution.

The All-in-One Video Gallery plugin for WordPress is susceptible to arbitrary file upload due to inadequate file type validation when handling VTT files. This allows attackers to bypass sanitization by using double extension files, potentially leading to remote code execution. The issue affects authenticated attackers with author-level access or higher. The vulnerability stems from the plugin’s acceptance of files as valid VTT files without proper checks, enabling the upload of arbitrary files to the server.

The Filter & Grids plugin for WordPress is susceptible to SQL Injection through the `phrase` parameter. Insufficient input validation and inadequate SQL query preparation allow unauthenticated attackers to inject additional SQL queries, potentially extracting sensitive information from the database. This issue is confirmed to affect MariaDB databases, causing syntax errors in MySQL.

The Starter Templates plugin for WordPress is susceptible to arbitrary file upload due to inadequate file type validation when handling WXR files. This allows files with double extensions to bypass sanitization, enabling authenticated attackers with author-level access or higher to upload arbitrary files to the server. Successful exploitation may lead to remote code execution.

The Demo Importer Plus plugin for WordPress is susceptible to arbitrary file upload due to inadequate file type validation when processing WXR files. This allows attackers to bypass sanitization by using double extension files, potentially leading to remote code execution. The issue affects authenticated attackers with author-level access or higher.

The Code Snippets plugin for WordPress is susceptible to PHP Code Injection in versions up to and including 3.9.1. This occurs because the plugin utilizes `extract()` on shortcode attributes controlled by attackers within the `evaluate shortcode from flat file` method. This can overwrite the `filepath` variable, which is then used with `require once`. Authenticated attackers with Contributor-level access or higher can execute arbitrary PHP code on the server through the `[code snippet]` shortcode. This requires an administrator to enable the "Enable file-based execution" setting and create at least one active Content snippet. The `extract()` function is used to import variables from an array into the current scope.

The Enable SVG, WebP, and ICO Upload plugin for WordPress is susceptible to arbitrary file upload due to insufficient file type validation when handling ICO files. This allows attackers to bypass sanitization by using double extensions and appropriate magic bytes, potentially enabling the upload of malicious files. Successful exploitation could lead to remote code execution on the affected server. The issue affects authenticated attackers with author-level access or higher.

The WP Project Manager plugin for WordPress is susceptible to a time-based SQL Injection issue. This is due to inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries, specifically affecting the `completed at operator` parameter. Authenticated attackers with Subscriber-level access or higher can inject additional SQL queries into existing queries to extract sensitive information from the database.

The Events Calendar plugin for WordPress has an information disclosure issue. The `sysinfo` REST endpoint performs a weak comparison between the provided key and the stored opt-in key. This allows unauthenticated attackers to obtain the full system report when the "Yes, automatically share my system information with The Events Calendar support team" setting is enabled. The vulnerable endpoint is `/sysinfo`. The issue arises from the comparison of the `key` parameter.

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is susceptible to Local File Inclusion in versions up to and including 3.2.5. This allows unauthenticated attackers to include and execute arbitrary .php files on the server through the `load template` function. Successful exploitation could lead to bypassing access controls, obtaining sensitive data, or achieving code execution if .php file uploads are permitted.

The Advanced Ads – Ad Manager & AdSense plugin for WordPress is susceptible to Remote Code Execution through the `select one()` function. The issue stems from insufficient restrictions on access to an AJAX endpoint and a lack of limitations on the functions that can be called. This allows unauthenticated attackers to execute arbitrary functions starting with 'get the ', such as `get the excerpt`, potentially leading to information disclosure. The vulnerable endpoint is an AJAX endpoint. The vulnerable parameter is not specified.

The Stripe Payment Forms plugin for WordPress is susceptible to SQL Injection due to inadequate input validation and query preparation. Specifically, the `wpfs-form-name` parameter is not properly sanitized, allowing attackers to inject malicious SQL code. This could enable unauthorized access to sensitive database information.

The wpForo Forum plugin for WordPress is susceptible to error-based or time-based SQL Injection through the `get members()` function. This is due to a lack of integer validation on the `offset` and `row count` parameters. The function uses `esc sql()` to interpolate `row count` into a 'LIMIT offset,row count' clause, instead of ensuring numeric values. MySQL 5.x allows a 'PROCEDURE ANALYSE' clause after a LIMIT clause, which unauthenticated attackers controlling `row count` can exploit to append a stored-procedure call. This enables error-based or time-based blind SQL injection, potentially allowing extraction of sensitive information from the database.