Nguyen Truong

The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters (interval, format, emailTo) in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level privileges and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The REST endpoint is registered without a permission callback and only validates a nonce without checking user capabilities.

**Name of the Vulnerable Software and Affected Versions** Unlimited Elements for Elementor versions prior to 2.0.8 **Description** Insufficient input sanitization and the use of deprecated escaping functions combined with direct string concatenation in SQL query construction allow authenticated attackers with Contributor-level access and above to inject arbitrary SQL commands and extract sensitive information from the database. The issue occurs in the 'get cat addons' AJAX action via the `data[filter search]` parameter. The `normalizeAjaxInputData()` function calls `stripslashes()` on user input, which removes protection from the `wp magic quotes()` function. The `filter search` parameter is then processed using the deprecated `wpdb-> escape()` function and concatenated into a LIKE clause without prepared statements. **Recommendations** Update to a version later than 2.0.7. Avoid using the `data[filter search]` parameter in the 'get cat addons' AJAX action until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Ona theme for WordPress versions prior to 1.27 **Description** Server-Side Request Forgery (SSRF) exists in the `ona activate child theme()` function. This allows authenticated attackers with administrator-level access or higher to initiate web requests to arbitrary locations from the web application, which can be used to query and modify information from internal services. **Recommendations** Update to a version later than 1.26. As a temporary workaround, restrict access to the `ona activate child theme()` function.

**Name of the Vulnerable Software and Affected Versions** Lucky Wheel Giveaway plugin for WordPress versions prior to 1.0.23 **Description** The Lucky Wheel Giveaway plugin for WordPress is susceptible to Remote Code Execution. This is due to the use of PHP’s `eval()` function on user-controlled input without sufficient validation or sanitization. An authenticated attacker with Administrator-level access or higher can execute code on the server through the `conditional tags` parameter. **Recommendations** Update the Lucky Wheel Giveaway plugin to version 1.0.23 or later.

**Name of the Vulnerable Software and Affected Versions** Flat Shipping Rate by City for WooCommerce plugin for WordPress versions up to and including 1.0.3 **Description** The software is susceptible to a time-based SQL Injection issue through the `cities` parameter. Insufficient input sanitization and inadequate SQL query preparation allow authenticated attackers with Shop Manager-level access or higher to inject additional SQL queries into existing database queries. This can potentially lead to the extraction of sensitive information from the database. **Recommendations** Versions prior to and including 1.0.3 should be updated to a newer, secure version if available. As a temporary workaround, restrict access to the `cities` parameter.

**Name of the Vulnerable Software and Affected Versions** Lucky Wheel for WooCommerce – Spin a Sale plugin for WordPress versions up to and including 1.1.13 **Description** The software contains a PHP Code Injection issue stemming from the use of `eval()` to process user-provided input from the 'Conditional Tags' setting without sufficient validation or sanitization. This allows authenticated attackers with Administrator-level access or higher to execute arbitrary PHP code on the server. In WordPress multisite setups, Site Administrators can execute arbitrary code, which is not expected behavior given that plugin/theme file editing is typically restricted for non-Super Admins. **Recommendations** Update Lucky Wheel for WooCommerce – Spin a Sale plugin for WordPress to a version later than 1.1.13.

Name of the Vulnerable Software and Affected Versions: Import any XML, CSV or Excel File to WordPress plugin versions through 3.9.3 Description: The Import any XML, CSV or Excel File to WordPress plugin for WordPress is susceptible to arbitrary file uploads due to the absence of file type validation during the import process. This allows authenticated attackers with Administrator-level access or higher to upload potentially harmful files, such as `.phar` files, to the server. Successful exploitation may lead to remote code execution. Recommendations: Update to a version beyond 3.9.3.