Nabil Irawan

The PeproDev Branches Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

**Name of the Vulnerable Software and Affected Versions** WPFront Notification Bar versions prior to 3.5.2 **Description** Reflected Cross-Site Scripting occurs when the `write debug logs` debug-log output path reflects the raw value of the `$ SERVER['REQUEST URI']` variable through the `vprintf()` function within a `<script>` block emitted on `wp footer`. This happens without proper sanitization or escaping in the `filter()` method. Unauthenticated attackers can exploit this by tricking a user into clicking a specially crafted link to inject and execute arbitrary web scripts. **Recommendations** Update WPFront Notification Bar to version 3.5.2 or later.

**Name of the Vulnerable Software and Affected Versions** ReactPress – Create React App for WordPress versions prior to 3.4.1 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts into pages. This happens because the `permalink` parameter is processed using `sanitize url()`, which fails to prevent the fetching of remote URLs. The response body of these URLs, including script tags and event-handler attributes, is then written directly to disk using the `file put contents()` function. **Recommendations** Update ReactPress – Create React App for WordPress to version 3.4.1 or later. Avoid using the `permalink` parameter until the plugin is updated.

**Name of the Vulnerable Software and Affected Versions** RW Elephant Rental Inventory versions prior to 2.3.14 **Description** The plugin contains a missing authorization flaw. The `toggle cache()` function, which is linked to the `wp ajax toggle cache` AJAX action, does not perform a capability check or nonce verification. A nonce is a unique token used to protect against cross-site request forgery. This allows authenticated users with Subscriber-level permissions or higher to enable or disable the plugin cache by sending a POST request to the `admin-ajax` endpoint. **Recommendations** Update the plugin to version 2.3.14 or later. As a temporary mitigation, restrict access to the `toggle cache()` function.

**Name of the Vulnerable Software and Affected Versions** The Welcomizer plugin for WordPress versions prior to 2.8.2 **Description** Authenticated attackers with Subscriber-level access and above can achieve Remote Code Execution. The issue stems from missing authorization checks in the `savesection` handler of the `twiz ajax callback` AJAX action within the `twiz-ajax.php` endpoint. While the handler verifies a nonce, it fails to perform a `current user can()` capability check. Additionally, the nonce is exposed to authenticated users via the `twiz-ajax.js.php` file. This allows an attacker to inject arbitrary PHP code through the `twiz custom logic` parameter when the output choice is set to `twiz logic output`, which is then executed using the `eval()` function. **Recommendations** Update The Welcomizer plugin to version 2.8.2 or later. As a temporary mitigation, restrict access to the `twiz-ajax.php` and `twiz-ajax.js.php` files for users with low-level privileges.

**Name of the Vulnerable Software and Affected Versions** Sidebar Manager Light versions prior to 1.19 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts via the `sbm description` parameter, which execute when a user accesses an affected page. **Recommendations** Update Sidebar Manager Light to version 1.19 or later.

**Name of the Vulnerable Software and Affected Versions** Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress versions prior to 1.7.6 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. By submitting a contact form, an attacker can inject arbitrary web scripts via the `cntctfrm contact dropdown` parameter. These scripts execute within the context of an administrator's browser session when they access the message manager page at the '/wp-admin/admin.php?page=cntctfrmtdb manager' endpoint, potentially leading to the compromise of administrator-level sessions. **Recommendations** Update the plugin to version 1.7.6 or later. As a temporary mitigation, restrict access to the '/wp-admin/admin.php?page=cntctfrmtdb manager' endpoint or avoid using the `cntctfrm contact dropdown` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Checkout Custom Fields Builder for WooCommerce versions prior to 1.1.6 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can exploit this to install and activate an arbitrary plugin hosted by the attacker, leading to remote code execution on the server. When WooCommerce is inactive, the required nonce (a unique token used to prevent cross-site request forgery) is emitted inline on all admin pages accessible to subscribers, allowing them to harvest it and trigger the exploit without additional privileges. **Recommendations** Update Checkout Custom Fields Builder for WooCommerce to version 1.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Zephyr Project Manager versions prior to 3.3.206 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Custom-level access or higher can inject arbitrary web scripts into pages via the `message` parameter. These scripts execute when a user accesses the affected page. This issue is only exploitable if the 'Directly link to project' plugin setting is disabled. **Recommendations** Update the plugin to a version newer than 3.3.205. Enable the 'Directly link to project' setting to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** TrueBooker versions prior to 1.2.7 **Description** The plugin is susceptible to account takeover because the `add front user update()` AJAX handler is accessible to unauthenticated users. The handler accepts an arbitrary `truebooker wp user id` value and passes it to the `wp update user()` function without verifying the user's authentication or ownership of the account. This allows an unauthenticated attacker to change the email address of any WordPress user, including administrators, by providing the target user ID and a controlled email address. Subsequently, the attacker can utilize the standard WordPress password reset process to gain full control of the account. **Recommendations** Update the plugin to a version later than 1.2.6. As a temporary mitigation, restrict access to the `add front user update()` AJAX handler.

**Name of the Vulnerable Software and Affected Versions** Astro Booking Engine versions prior to 1.4.1 **Description** The Astro Booking Engine plugin for WordPress contains a Cross-Site Request Forgery (CSRF) flaw. This occurs because the options deletion functionality lacks nonce validation—a security mechanism used to ensure that a request was intentionally sent by the user. Consequently, an unauthenticated attacker can delete all plugin settings by tricking a site administrator into clicking a malicious link. **Recommendations** Update the plugin to a version later than 1.4.0.

**Name of the Vulnerable Software and Affected Versions** Theme Editor plugin for WordPress versions prior to 3.2 **Description** The plugin is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into executing unwanted actions on a web application. This occurs due to missing nonce validation—a security measure used to ensure that a request was intentionally sent by the user—on the `ms update` AJAX action. Unauthenticated attackers can exploit this to modify child theme CSS styles by tricking an administrator into clicking a malicious link. **Recommendations** Update the Theme Editor plugin for WordPress to version 3.2 or later. As a temporary mitigation, restrict access to the `ms update` AJAX action.

**Name of the Vulnerable Software and Affected Versions** Database Collation Fix versions prior to 1.2.11 **Description** The Database Collation Fix plugin for WordPress contains a time-based SQL Injection flaw. This occurs because the plugin fails to properly escape the `force-collation-algorithm` parameter and lacks sufficient preparation of the SQL query. Unauthenticated attackers can exploit this to append malicious SQL queries and extract sensitive information from the database. Successful exploitation requires a `trigger.txt` file to be present in the plugin directory (`/wp-content/plugins/database-collation-fix/trigger.txt`), which typically happens during DesktopServer integration events like site creation, copy, import, move, export, or deploy. **Recommendations** Update the plugin to a version newer than 1.2.10. Avoid using the `force-collation-algorithm` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** WP Fast Total Search – The Power of Indexed Search versions prior to 1.80.281 **Description** An unauthenticated SQL Injection exists due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. This allows attackers to append additional SQL queries to existing ones to extract sensitive information from the database via the `form data[s]` parameter. **Recommendations** Update WP Fast Total Search – The Power of Indexed Search to a version newer than 1.80.280. Avoid using the `form data[s]` parameter until the plugin is updated.

**Name of the Vulnerable Software and Affected Versions** Hide My WP Lite versions prior to 1.4 **Description** An arbitrary file read issue exists when the `elementor assets filter()` function processes the `he wrapper js` and `he wrapper css` query parameters. The function concatenates user-supplied input directly onto ABSPATH and passes it to `file get contents()` without path traversal validation, allow-list, realpath containment, or extension checks. Although the output is processed by `wp kses post()`, which filters HTML tags, it does not prevent the disclosure of arbitrary file contents. This allows unauthenticated attackers to read sensitive files on the server, such as wp-config. This issue requires the Elementor plugin to be installed and the 'Hide Elementor' feature to be enabled. **Recommendations** Update Hide My WP Lite to a version later than 1.3. As a temporary workaround, disable the 'Hide Elementor' feature to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Block, Suspend, Report for BuddyPress versions prior to 3.6.5 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the `link` parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users. **Recommendations** Update to a version newer than 3.6.4. Avoid using the `link` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Widget Logic Visual versions prior to 1.53 **Description** Authenticated attackers with subscriber-level access and above can achieve remote code execution on the server. The issue occurs during the `widget-logic-update-conditional-tags` AJAX action due to a missing capability check and nonce verification in the `widget logic visual check visibility()` function. Additionally, the `nwlv[cod-tag]` parameter is insufficiently sanitized before being stored and later processed by an `eval()` call, which executes the provided code. **Recommendations** Update the plugin to a version newer than 1.52. As a temporary mitigation, restrict access to the `widget-logic-update-conditional-tags` AJAX action or limit user permissions to prevent subscribers from accessing widget settings.

**Name of the Vulnerable Software and Affected Versions** Backstage - Customizer Demo Access versions prior to 1.4.3 **Description** This issue allows unauthenticated attackers to achieve privilege escalation. The plugin assigns the `manage options` capability to the `backstage customizer user` demo role, which provides permissions exceeding what is required for Customizer-only demo access. Consequently, attackers can navigate beyond the Customizer and modify arbitrary WordPress options, such as the `default role` variable. **Recommendations** Update Backstage - Customizer Demo Access to a version newer than 1.4.2.

**Name of the Vulnerable Software and Affected Versions** Jssor Slider by jssor.com versions prior to 3.1.25 **Description** The plugin is subject to Directory Traversal, a flaw that allows an attacker to access files and directories that are stored outside the web root folder. Unauthenticated attackers can exploit this by using the `url` parameter to read arbitrary files on the server, potentially exposing sensitive information. **Recommendations** Update the plugin to a version newer than 3.1.24. Avoid using the `url` parameter in the affected plugin until the update is applied.

**Name of the Vulnerable Software and Affected Versions** WP-BusinessDirectory versions prior to 4.0.2 **Description** Unauthenticated attackers can delete arbitrary files on the server due to insufficient path validation in the `remove()` method of the `JBusinessDirectoryControllerUpload` class. The 'task=upload.remove' endpoint is accessible without authentication. By providing a ` filename` parameter containing path traversal sequences (../) and setting the ` path type` parameter to `2`, an attacker can bypass directory restrictions and trigger the `unlink()` function on critical files, such as `wp-config.php` or `wp-config-backup.php`. **Recommendations** Update WP-BusinessDirectory to version 4.0.2 or later. Restrict access to the 'task=upload.remove' endpoint to prevent unauthenticated requests. Avoid using the ` filename` parameter in the 'task=upload.remove' endpoint until the software is updated.