Naiches

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.

**Name of the Vulnerable Software and Affected Versions** The Testimonials Widget WordPress plugin versions prior to 4.0.5 **Description** The plugin fails to perform capability or ownership checks when processing the front-end testimonial submission form. This allows unauthenticated users to create arbitrary posts or modify existing ones, including the ability to overwrite the title, content, and author. **Recommendations** Update the plugin to version 4.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** Testimonials Widget WordPress plugin versions prior to 4.0.5 **Description** The plugin fails to validate a user-supplied URL before fetching it server-side and storing the response as a public file. This allows unauthenticated users to perform a Server-Side Request Forgery (SSRF), where the server is forced to make requests to internal services and expose the responses. **Recommendations** Update the Testimonials Widget WordPress plugin to version 4.0.5 or later.