Nishiv

Name of the Vulnerable Software and Affected Versions: Omnipress plugin for WordPress versions up to, and including, 1.5.4 Description: The issue allows authenticated attackers with Contributor-level access and above to extract data from password-protected, private, or draft posts that they should not have access to, due to insufficient restrictions on which posts can be included via the megamenu block. Recommendations: For Omnipress plugin for WordPress versions up to, and including, 1.5.4, update to a version later than 1.5.4 to resolve the issue. As a temporary workaround, consider restricting access to the megamenu block to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress versions up to, and including, 1.9.8 Description: The issue allows authenticated attackers with Contributor-level access and above to extract data from private posts they should not have access to due to insufficient restrictions on which posts can be included. This is possible via the `pagelayer builder posts shortcode` function. Recommendations: For versions up to, and including, 1.9.8, update to a version that includes a fix for this issue to prevent information exposure. As a temporary workaround, consider restricting access to the `pagelayer builder posts shortcode` function until a patch is available.

The issue allows authenticated attackers with Contributor-level access or higher to extract sensitive data from private, pending, scheduled, password-protected, draft, and trashed posts through the `qubely get content` function. This enables the exposure of confidential information.

The issue is related to Stored Cross-Site Scripting via the "Icon List" Block due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue allows authenticated attackers with Contributor-level access and above to extract sensitive data, including the content of private posts and pages, via the page content block.

The issue allows authenticated attackers with Contributor-level access and above to extract sensitive data, including the content of private, draft, and scheduled posts and pages, via the `get image description` function.

The issue is related to Stored Cross-Site Scripting via the "Table Of Content" Block, specifically in the `markerView` attribute, due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the `align` and `UniqueID` parameters due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the `titleTag` parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue allows authenticated attackers with Contributor-level access and above to extract data from private posts they should not have access to due to insufficient restrictions on which posts can be included via the 'bsb-slider' shortcode.

The issue is related to Stored Cross-Site Scripting via the Image Accordion widget due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages, which will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the 'posts-slider-block' block. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting in the "Kona: Instagram for Gutenberg" Block, specifically in the `align` attribute, due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the `Accordion` widget due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the `anchor` parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue concerns insufficient restrictions on which templates can be included through the render function, allowing authenticated attackers with Contributor-level access and above to extract data from private or draft templates they should not have access to.

The issue allows authenticated attackers with Contributor-level access and above, and permissions granted by an Administrator, to include and execute arbitrary PHP files on the server via the `style` parameter. This enables the execution of any PHP code in those files, which can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The issue is limited to PHP files in a Windows environment.

The issue allows authenticated attackers with Contributor-level access and above to extract sensitive private, pending, and draft Elementor template data. This is possible due to the `render` function in `modules/content-switcher/widgets/content-switcher.php`.

The issue allows authenticated attackers with Contributor-level access and above to extract sensitive private, pending, and draft Elementor template data via the render function in includes/widgets/canvas-menu/canvas-menu.php. This makes it possible to access sensitive information.

The issue is related to a missing capability check on the `wp mailplus clear logs` function, which allows authenticated attackers with Subscriber-level access and above to delete the plugin's log files, resulting in unauthorized loss of data.