Nishiv

Name of the Vulnerable Software and Affected Versions: Omnipress plugin for WordPress versions up to, and including, 1.5.4 Description: The issue allows authenticated attackers with Contributor-level access and above to extract data from password-protected, private, or draft posts that they should not have access to, due to insufficient restrictions on which posts can be included via the megamenu block. Recommendations: For Omnipress plugin for WordPress versions up to, and including, 1.5.4, update to a version later than 1.5.4 to resolve the issue. As a temporary workaround, consider restricting access to the megamenu block to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress versions up to, and including, 1.9.8 Description: The issue allows authenticated attackers with Contributor-level access and above to extract data from private posts they should not have access to due to insufficient restrictions on which posts can be included. This is possible via the `pagelayer builder posts shortcode` function. Recommendations: For versions up to, and including, 1.9.8, update to a version that includes a fix for this issue to prevent information exposure. As a temporary workaround, consider restricting access to the `pagelayer builder posts shortcode` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Qubely – Advanced Gutenberg Blocks plugin for WordPress versions up to and including 1.8.13 **Description** The issue allows authenticated attackers with Contributor-level access or higher to extract sensitive data from private, pending, scheduled, password-protected, draft, and trashed posts through the `qubely get content` function. This enables the exposure of confidential information. **Recommendations** For Qubely – Advanced Gutenberg Blocks plugin for WordPress versions up to and including 1.8.13, update to a version higher than 1.8.13 to resolve the issue. As a temporary workaround, consider restricting access to the `qubely get content` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin for WordPress versions up to, and including, 1.5.0 **Description** The issue is related to Stored Cross-Site Scripting via the "Icon List" Block due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 1.5.0, update to a version that addresses the insufficient input sanitization and output escaping issue to prevent Stored Cross-Site Scripting attacks.

**Name of the Vulnerable Software and Affected Versions** VK Blocks plugin for WordPress versions up to, and including, 1.94.2.2 **Description** The issue allows authenticated attackers with Contributor-level access and above to extract sensitive data, including the content of private posts and pages, via the page content block. **Recommendations** For VK Blocks plugin for WordPress versions up to, and including, 1.94.2.2, update to a version that contains a fix for this issue to prevent sensitive information exposure.

**Name of the Vulnerable Software and Affected Versions** GenerateBlocks plugin for WordPress versions prior to 1.9.2 **Description** The issue allows authenticated attackers with Contributor-level access and above to extract sensitive data, including the content of private, draft, and scheduled posts and pages, via the `get image description` function. **Recommendations** For versions prior to 1.9.2, update to version 1.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the `get image description` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** aBlocks - WordPress Gutenberg Blocks plugin versions up to and including 1.6.1 **Description** The issue is related to Stored Cross-Site Scripting via the "Table Of Content" Block, specifically in the `markerView` attribute, due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to and including 1.6.1, update to a version higher than 1.6.1 to resolve the issue. As a temporary workaround, consider restricting access to the "Table Of Content" Block to minimize the risk of exploitation. Avoid using the `markerView` attribute in the affected block until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Qubely – Advanced Gutenberg Blocks plugin for WordPress versions up to, and including, 1.8.12 **Description** The issue is related to Stored Cross-Site Scripting via the `align` and `UniqueID` parameters due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 1.8.12, update to a version higher than 1.8.12 to resolve the issue. As a temporary workaround, consider restricting access to the `align` and `UniqueID` parameters to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Rise Blocks – A Complete Gutenberg Page Builder plugin for WordPress versions up to, and including, 3.6 **Description** The issue is related to Stored Cross-Site Scripting via the `titleTag` parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 3.6, update to a version that includes proper input sanitization and output escaping for the `titleTag` parameter to prevent Stored Cross-Site Scripting attacks. As a temporary workaround, consider restricting access to the `titleTag` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The B Slider- Gutenberg Slider Block for WP plugin for WordPress versions up to, and including, 1.9.5 **Description** The issue allows authenticated attackers with Contributor-level access and above to extract data from private posts they should not have access to due to insufficient restrictions on which posts can be included via the 'bsb-slider' shortcode. **Recommendations** For versions up to, and including, 1.9.5, update to a version later than 1.9.5 to resolve the issue. As a temporary workaround, consider restricting access to the 'bsb-slider' shortcode to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** aThemes Addons for Elementor plugin for WordPress versions up to, and including, 1.0.12 **Description** The issue is related to Stored Cross-Site Scripting via the Image Accordion widget due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages, which will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 1.0.12, update to a version that addresses the insufficient input sanitization and output escaping issue. As a temporary workaround, consider restricting access to the Image Accordion widget to minimize the risk of exploitation. Additionally, limiting Contributor-level access and above can help reduce the potential attack surface until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Gosign – Posts Slider Block plugin for WordPress versions up to, and including, 1.1.0 **Description** The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the 'posts-slider-block' block. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page. **Recommendations** For versions up to, and including, 1.1.0, update to a version that addresses the insufficient input sanitization and output escaping issue. As a temporary workaround, consider restricting access to the 'posts-slider-block' block to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Kona Gallery Block plugin for WordPress versions up to, and including, 1.7 **Description** The issue is related to Stored Cross-Site Scripting in the "Kona: Instagram for Gutenberg" Block, specifically in the `align` attribute, due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 1.7, update to a version that addresses the insufficient input sanitization and output escaping issue. As a temporary workaround, consider restricting access to the "Kona: Instagram for Gutenberg" Block to minimize the risk of exploitation. Avoid using the `align` attribute in the affected Block until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** All Bootstrap Blocks plugin for WordPress versions up to and including 1.3.26 **Description** The issue is related to Stored Cross-Site Scripting via the `Accordion` widget due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page. **Recommendations** For versions up to and including 1.3.26, update to a version higher than 1.3.26 to resolve the issue. As a temporary workaround, consider restricting access to the `Accordion` widget to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Plethora Plugins Tabs + Accordions plugin for WordPress versions up to, and including, 1.1.8 **Description** The issue is related to Stored Cross-Site Scripting via the `anchor` parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 1.1.8, update to a version higher than 1.1.8 to resolve the issue. As a temporary workaround, consider restricting access to the `anchor` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements plugin for WordPress versions up to, and including, 2.2.1 **Description** The issue concerns insufficient restrictions on which templates can be included through the render function, allowing authenticated attackers with Contributor-level access and above to extract data from private or draft templates they should not have access to. **Recommendations** For versions up to, and including, 2.2.1, consider updating to a version newer than 2.2.1 to resolve the issue. As a temporary workaround, consider restricting access to the render function to minimize the risk of exploitation. Restrict access to private or draft templates to prevent unauthorized data extraction until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Classic Addons – WPBakery Page Builder plugin for WordPress versions up to, and including, 3.0 **Description** The issue allows authenticated attackers with Contributor-level access and above, and permissions granted by an Administrator, to include and execute arbitrary PHP files on the server via the `style` parameter. This enables the execution of any PHP code in those files, which can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The issue is limited to PHP files in a Windows environment. **Recommendations** For Classic Addons – WPBakery Page Builder plugin for WordPress versions up to, and including, 3.0, consider disabling the `style` parameter to prevent the inclusion and execution of arbitrary PHP files until a patch is available. Restrict access to the plugin's functionality to minimize the risk of exploitation, especially for users with Contributor-level access and above.

**Name of the Vulnerable Software and Affected Versions** The Sky Addons for Elementor plugin for WordPress versions up to, and including, 2.6.1 **Description** The issue allows authenticated attackers with Contributor-level access and above to extract sensitive private, pending, and draft Elementor template data. This is possible due to the `render` function in `modules/content-switcher/widgets/content-switcher.php`. **Recommendations** For versions up to, and including, 2.6.1, update to a version later than 2.6.1 to resolve the issue. As a temporary workaround, consider restricting access to the `render` function in `modules/content-switcher/widgets/content-switcher.php` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The News Kit Elementor Addons plugin for WordPress version 1.2.1 and earlier **Description** The issue allows authenticated attackers with Contributor-level access and above to extract sensitive private, pending, and draft Elementor template data via the render function in includes/widgets/canvas-menu/canvas-menu.php. This makes it possible to access sensitive information. **Recommendations** For versions 1.2.1 and earlier, consider disabling the render function in includes/widgets/canvas-menu/canvas-menu.php as a temporary workaround until a patch is available. Restrict access to the canvas-menu.php file to minimize the risk of exploitation. Avoid using the render function in the affected plugin until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** SendGrid for WordPress plugin versions up to, and including, 1.4 **Description** The issue is related to a missing capability check on the `wp mailplus clear logs` function, which allows authenticated attackers with Subscriber-level access and above to delete the plugin's log files, resulting in unauthorized loss of data. **Recommendations** For SendGrid for WordPress plugin versions up to, and including, 1.4, consider disabling the `wp mailplus clear logs` function until a patch is available to prevent unauthorized deletion of log files.