Nguyen Van Khanh

**Name of the Vulnerable Software and Affected Versions** WP Editor WordPress plugin version 1.2.6 and earlier **Description** The issue is related to an authenticated blind SQL injection problem. It occurs because the plugin does not properly sanitise or validate its setting fields, allowing an arbitrary parameter to be used when saving settings. This can be exploited by an admin or higher-privileged user. **Recommendations** For WP Editor WordPress plugin version 1.2.6 and earlier, update to version 1.2.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the settings save functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Asset CleanUp: Page Speed Booster plugin versions <= 1.3.8.4 **Description** The issue is related to an Authenticated Reflected Cross-Site Scripting (XSS) vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website, potentially leading to unauthorized actions. The vulnerability requires authentication with admin or higher privileges, indicating it needs access to sensitive areas of the website. **Recommendations** For Asset CleanUp: Page Speed Booster plugin versions <= 1.3.8.4, update to a version higher than 1.3.8.4 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Phil Baker's Age Gate plugin versions prior to 2.18.0 **Description** The issue is related to an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. This means that an attacker can inject malicious scripts into the website without needing authentication, and these scripts will be stored and executed when other users access the site. **Recommendations** For versions prior to 2.18.0, update to version 2.18.0 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress versions prior to 7.1.12 Description: The issue arises from the lack of sanitization of the `result id` GET parameter on pages with the [qsm result] shortcode without an id attribute. This leads to an SQL injection, allowing unauthorized access to the DBMS. The vulnerability can be exploited by authors or even unauthenticated users if the shortcode is embedded on a public page or post. Recommendations: For versions prior to 7.1.12, update to version 7.1.12 or later to resolve the issue. As a temporary workaround, consider disabling the use of the [qsm result] shortcode without an id attribute until a patch is available. Restrict access to pages or posts with the vulnerable shortcode to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Theme Editor WordPress plugin versions prior to 2.6 Description: The issue allows administrators to download arbitrary files on the web server, such as /etc/passwd, due to a lack of validation of the GET file parameter before it is passed to the download file() function. Recommendations: For Theme Editor WordPress plugin versions prior to 2.6, update to version 2.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the download file() function until a patch is available. Avoid using the `file` parameter in affected API endpoints until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Advanced Database Cleaner plugin versions prior to 3.0.2 Description: The issue arises from unvalidated input in the Advanced Database Cleaner plugin, leading to SQL injection. This allows high privilege users, such as administrators, to perform SQL attacks. Recommendations: For versions prior to 3.0.2, update to version 3.0.2 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Modern Events Calendar Lite WordPress plugin versions prior to 5.16.6 Description: The issue concerns unvalidated input in the Modern Events Calendar Lite WordPress plugin, which did not sanitize the `mec[post id]` POST parameter in the "mec fes form" AJAX action. This leads to an authenticated SQL Injection issue when logged in as an author or higher. Recommendations: For versions prior to 5.16.6, update to version 5.16.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the "mec fes form" AJAX action for users with author or higher privileges until the update is applied. Avoid using the `mec[post id]` parameter in the affected AJAX endpoint until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: 301 Redirects - Easy Redirect Manager WordPress plugin versions prior to 2.51 Description: The issue arises from unvalidated input in the 301 Redirects - Easy Redirect Manager WordPress plugin. Specifically, versions before 2.51 did not sanitize the `Redirect From` column when importing a CSV file. This oversight allows high privilege users to perform SQL injections. Recommendations: For versions prior to 2.51, update to version 2.51 or later to resolve the issue. As a temporary workaround, consider restricting the import of CSV files or sanitizing the `Redirect From` column manually until a patch is applied. Avoid using the `Redirect From` column in the affected plugin until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: AccessPress Social Icons plugin versions prior to 1.8.1 Description: The issue is related to unvalidated input in the AccessPress Social Icons plugin, which did not sanitize its widget attribute. This allowed accounts with post permission, such as authors, to perform SQL injections. Recommendations: For AccessPress Social Icons plugin versions prior to 1.8.1, update to version 1.8.1 or later to resolve the issue. As a temporary workaround, consider restricting post permission to trusted users until the update is applied.

Name of the Vulnerable Software and Affected Versions: Modern Events Calendar Lite WordPress plugin versions prior to 5.16.5 Description: The issue is related to a lack of authorization checks in the plugin, which did not properly restrict access to export files. This allowed unauthenticated users to export all events data in formats such as CSV or XML. Recommendations: For versions prior to 5.16.5, update to version 5.16.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the export functionality until a patch is applied.

Name of the Vulnerable Software and Affected Versions: Modern Events Calendar Lite WordPress plugin versions prior to 5.16.5 Description: The issue is related to unvalidated input and lack of output encoding in the plugin. Specifically, the `mic comment` field, also known as 'Notes on time', is not properly sanitised when adding or editing an event. This allows users with privileges as low as author to add events containing a Cross-Site Scripting payload, which is triggered when viewing the event in the frontend. Recommendations: For versions prior to 5.16.5, update to version 5.16.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the event editing feature to higher-privileged users until the update is applied. Additionally, avoid using the `mic comment` field in events until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin versions prior to 1.6.0 Description: The issue allows high privilege users (admin+) to upload arbitrary files, including PHP ones, due to the plugin not ensuring that imported files are of the SGBP format and extension. This can lead to remote code execution (RCE). Recommendations: For WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin versions prior to 1.6.0, update to version 1.6.0 or later to resolve the issue. As a temporary workaround, consider restricting the upload functionality to prevent high privilege users from uploading arbitrary files until a patch is applied.

Name of the Vulnerable Software and Affected Versions: Modern Events Calendar Lite versions prior to 5.16.5 Description: The issue allows for arbitrary file upload due to improper checking of imported files. An administrator can upload PHP files by using the 'text/csv' content-type in the request. This can lead to remote code execution. The uploaded file is typically stored in the default /uploads/ directory. There have been real-world incidents where this issue was exploited, including a capture-the-flag challenge where the vulnerability was used for remote code execution. Recommendations: For versions prior to 5.16.5, update to version 5.16.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the file upload functionality to minimize the risk of exploitation. Additionally, restrict access to the /uploads/ directory to prevent execution of uploaded PHP files.