Muhammad Yudha

**Name of the Vulnerable Software and Affected Versions** CM Business Directory versions prior to 1.5.8 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs when arbitrary web scripts are injected into pages via business address meta fields, which then execute when a user accesses the affected page. Because the payload is stored in post meta instead of post content, the WordPress `unfiltered html` capability restriction is bypassed. The affected variables include `cmbd address`, `cmbd cityTown`, `cmbd stateCounty`, `cmbd postalcode`, `cmbd region`, and `cmbd country`. **Recommendations** Update to a version newer than 1.5.7. Restrict the use of the `cmbd address`, `cmbd cityTown`, `cmbd stateCounty`, `cmbd postalcode`, `cmbd region`, and `cmbd country` fields to trusted users only.

**Name of the Vulnerable Software and Affected Versions** WP Photo Album Plus versions prior to 9.1.13.006 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. An attacker can inject arbitrary web scripts into pages by embedding a malicious `[photo]` shortcode in a post submitted for review. These scripts execute when an administrator or any other user views the affected page. The issue is triggered via the `subtext` parameter. **Recommendations** Update WP Photo Album Plus to version 9.1.13.006 or later.

**Name of the Vulnerable Software and Affected Versions** Event Organiser versions prior to 3.13.0 **Description** The Event Organiser plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the `eo events` shortcode accepts attacker-controlled `no events` content and renders it in event list templates without proper output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page. **Recommendations** Update the plugin to a version later than 3.12.9.

**Name of the Vulnerable Software and Affected Versions** FV Flowplayer Video Player versions prior to 7.5.51.722 **Description** Stored Cross-Site Scripting (XSS) occurs due to insufficient input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the `align` attribute of the `video player` shortcode. These scripts execute whenever a user visits the affected page. **Recommendations** Update to a version newer than 7.5.51.7212. As a temporary mitigation, restrict the ability of users with contributor-level access to edit pages or use the `video player` shortcode.

**Name of the Vulnerable Software and Affected Versions** Featured Image versions prior to 2.2 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access and above can inject arbitrary web scripts into pages, which execute when a user accesses the affected page. **Recommendations** Update to a version newer than 2.1.

**Name of the Vulnerable Software and Affected Versions** Canvas plugin for WordPress versions prior to 2.5.3 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts via the `tag` parameter. These scripts execute whenever a user accesses the affected page. **Recommendations** Update the plugin to a version later than 2.5.2. As a temporary workaround, restrict access to the `tag` parameter for users with contributor-level permissions.

**Name of the Vulnerable Software and Affected Versions** Simple Divi Shortcode versions prior to 1.3 **Description** The Simple Divi Shortcode plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the `showmodule shortcode()` function fails to properly sanitize input and escape output when handling the `id` parameter of the `[showmodule]` shortcode. The `id` attribute is concatenated directly into a dynamically constructed shortcode string without using `esc attr()` or other escaping methods, allowing an attacker to break the attribute context and inject arbitrary HTML. Authenticated attackers with contributor-level access or higher can inject malicious web scripts into pages, which then execute when a user visits the affected page. **Recommendations** Update to a version later than 1.2. As a temporary workaround, restrict the use of the `id` parameter within the `[showmodule]` shortcode or limit user permissions to prevent contributors from editing pages with this shortcode.

**Name of the Vulnerable Software and Affected Versions** Shariff Wrapper versions prior to 4.6.21 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. The issue exists within the `headline` parameter of the `[shariff]` shortcode. It occurs because the plugin utilizes a custom `wp kses` implementation with permissive HTML tags and subsequently performs a `str replace` operation that injects HTML after sanitization. This sequence allows the introduction of event handlers through the `%total` placeholder in the style attribute, enabling the execution of arbitrary web scripts when a user visits an affected page. **Recommendations** Update Shariff Wrapper to version 4.6.21 or later. Avoid using the `headline` parameter in the `[shariff]` shortcode until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Geo Mashup versions prior to 1.13.18 **Description** Improper neutralization of input during web page generation allows for stored Cross-site Scripting (XSS), a condition where malicious scripts are permanently stored on the target server and then served to other users. **Recommendations** Update to a version newer than 1.13.18.

**Name of the Vulnerable Software and Affected Versions** The Team Master – A Modern WordPress Team Showcase versions prior to 1.1.3 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via shortcode attributes, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users. **Recommendations** Update to a version newer than 1.1.2.

**Name of the Vulnerable Software and Affected Versions** Query Shortcode versions prior to 0.2.2 **Description** The Query Shortcode plugin for WordPress contains a Local File Inclusion issue within the shortcode function. Authenticated attackers with contributor-level access or higher can exploit this by using the `lens` shortcode attribute to include and execute arbitrary .php files on the server. This allows for the execution of PHP code, which can be used to bypass access controls or obtain sensitive data, particularly when .php files can be uploaded to the server. **Recommendations** Update the plugin to a version later than 0.2.1.

**Name of the Vulnerable Software and Affected Versions** Livemesh SiteOrigin Widgets versions prior to 3.9.3 **Description** Stored Cross-Site Scripting occurs via the `lsow admin ajax` AJAX action due to missing authorization checks and insufficient input sanitization. While the AJAX handler verifies a nonce, it fails to check user capabilities. This allows authenticated attackers with Subscriber-level access or higher to modify plugin settings and inject malicious scripts. These scripts execute when administrators access the plugin settings page or when any user visits the frontend. **Recommendations** Update Livemesh SiteOrigin Widgets to version 3.9.3 or later.

**Name of the Vulnerable Software and Affected Versions** Livemesh Addons for Beaver Builder versions prior to 3.9.3 **Description** Stored Cross-Site Scripting occurs via the `labb admin ajax` AJAX action due to missing authorization checks and insufficient input sanitization. While the AJAX handler verifies a nonce, it fails to check user capabilities. This allows authenticated attackers with Subscriber-level access or higher to modify plugin settings and inject malicious scripts. These scripts execute when administrators access the plugin settings page or when any user visits the frontend. **Recommendations** Update Livemesh Addons for Beaver Builder to version 3.9.3 or later.

**Name of the Vulnerable Software and Affected Versions** Instant-Quote.co Quotation Page plugin for WordPress versions prior to 1.3.5 **Description** Stored Cross-Site Scripting (XSS) occurs due to insufficient input sanitization and output escaping within shortcode attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. For example, a contributor can embed a malicious shortcode in a post submitted for review, triggering script execution when an administrator previews or views the post. **Recommendations** Update the plugin to a version newer than 1.3.4.

**Name of the Vulnerable Software and Affected Versions** iWR Tooltip versions prior to 1.1 **Description** The plugin contains a Stored Cross-Site Scripting issue within the `iwrtooltip` shortcode. The `iwr tooltip()` function fails to properly sanitize input and escape output for user-supplied attributes. Specifically, the `title` attribute is concatenated directly into an HTML attribute without using `esc attr()` or other escaping methods. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update the plugin to a version later than 1.0. As a temporary mitigation, restrict the ability of users with contributor-level access to edit pages or use the `iwrtooltip` shortcode.

**Name of the Vulnerable Software and Affected Versions** WPBakery Page Builder Addons by Livemesh versions prior to 3.9.5 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Shortcode attributes for `[lvca carousel]` and `[lvca posts carousel]` are encoded using `wp json encode()` and placed into single-quoted `data-settings` HTML attributes without the use of `esc attr()`. This allows authenticated attackers with Contributor-level access or higher to inject single quotes to break out of the attribute and execute arbitrary web scripts when a user visits the affected page. **Recommendations** Update to a version newer than 3.9.4.

**Name of the Vulnerable Software and Affected Versions** WPBakery Page Builder Addons by Livemesh versions prior to 3.9.5 **Description** Stored Cross-Site Scripting occurs via the `lvca admin ajax` AJAX action due to missing authorization checks and insufficient input sanitization. While the AJAX handler verifies a nonce, it fails to check user capabilities. This allows authenticated attackers with Subscriber-level access or higher to modify plugin settings and inject malicious scripts. These scripts execute when administrators access the plugin settings page or when any user visits the frontend. **Recommendations** Update WPBakery Page Builder Addons by Livemesh to version 3.9.5 or later.

**Name of the Vulnerable Software and Affected Versions** Formidable Kinetic versions prior to 1.1.02 **Description** Stored Cross-Site Scripting occurs via the `kinetic link` shortcode. The issue stems from insufficient input sanitization and output escaping within the `FrmKinetic::link()` function. Specifically, user-supplied shortcode attributes `window`, `class`, and `label` are concatenated directly into HTML attributes of an anchor tag. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update to a version newer than 1.1.01. As a temporary mitigation, restrict the use of the `kinetic link` shortcode or limit user permissions to prevent contributors from editing pages.

**Name of the Vulnerable Software and Affected Versions** CC Child Pages versions prior to 2.1.2 **Description** The CC Child Pages plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts through the `more` parameter. These scripts execute whenever a user visits the affected page. **Recommendations** Update the plugin to version 2.1.2 or later. As a temporary workaround, restrict access to the `more` parameter for users with Contributor-level permissions.

**Name of the Vulnerable Software and Affected Versions** Meta Field Block versions prior to 1.5.3 **Description** The Meta Field Block plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the `tagName` block attribute. These scripts execute whenever a user visits the affected page. **Recommendations** Update to a version later than 1.5.2. As a temporary workaround, restrict access to the `tagName` block attribute for users with contributor-level permissions.