Nizar Yart

Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through 1.5.6.

Missing Authorization vulnerability in WebberZone Contextual Related Posts contextual-related-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contextual Related Posts: from n/a through 4.5.3.

Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Blocks, Patterns & Theme Designer superb-blocks allows Cross Site Request Forgery.This issue affects Superb Addons: Blocks, Patterns & Theme Designer: from n/a through 4.2.4.

A Path Traversal issue exists due to missing ownership validation on attachment IDs provided via the media-field upload preset JSON. This allows authenticated users with subscriber-level access and above to reference attachments they did not upload. By supplying a manipulated attachment ID, an attacker can trigger the media cleanup routine to treat the file as a prior upload belonging to the current submission, resulting in the deletion of arbitrary media attachments.

Incorrectly configured access control security levels allow authenticated attackers with subscriber-level access and above to perform unauthorized actions. This occurs due to a missing capability check in a function.

An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions.

Kali Forms contains a missing authorization issue resulting from a missing capability check in a function. This allows unauthenticated attackers to exploit incorrectly configured access control security levels to perform unauthorized actions.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages, which execute when a user accesses the affected page.