Peerapat Samatathanyakorn

Insufficient input sanitization and output escaping allow authenticated attackers with Author-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs through the upload of SVG files, enabling the injection of arbitrary web scripts that execute when a user accesses the uploaded file.

The PQ Addons – Creative Elementor Widgets plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to inadequate input sanitization and output escaping on the `html tag` parameter within the PQ Section Title widget. Authenticated attackers with contributor-level access or higher can inject malicious web scripts into pages. These scripts will execute when a user accesses the compromised page.

The Library Management System plugin for WordPress is susceptible to SQL Injection due to inadequate input validation and query preparation. Specifically, the `bid` parameter is not properly sanitized, allowing attackers to inject malicious SQL code. This can enable unauthenticated attackers to extract sensitive information from the database by appending additional SQL queries to existing ones.

The WP Customer Reviews plugin for WordPress is susceptible to Reflected Cross-Site Scripting. This is due to inadequate input sanitization and output escaping of the `wpcr3 fname` parameter. An unauthenticated attacker can inject arbitrary web scripts into pages, which will execute if a user is tricked into performing an action, such as clicking a malicious link.

The midi-Synth plugin for WordPress is susceptible to arbitrary file uploads because of a lack of validation for file types and extensions within the 'export' AJAX action. This allows unauthenticated attackers to upload files to the affected server. Successful exploitation, which requires obtaining a valid nonce, could potentially lead to remote code execution. The nonce is exposed in frontend JavaScript, making it easily accessible to attackers. **API Endpoint:** '/export' **Vulnerable Parameter:** No specific parameters are mentioned, but the issue relates to file uploads handled by the 'export' AJAX action. **Vulnerable Function:** The 'export' AJAX action is vulnerable.

The TableMaster for Elementor plugin for WordPress is susceptible to Server-Side Request Forgery. This occurs because the plugin does not limit the URLs that can be accessed when importing CSV data from a URL using the Data Table widget. Authenticated attackers with Author-level access or higher can make web requests to arbitrary locations, including localhost and internal network services. Sensitive files, such as `wp-config.php`, can be read through the `csv url` parameter.

The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is susceptible to time-based SQL Injection. This is due to inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries. Specifically, the `fields` parameter is vulnerable. This allows unauthenticated attackers to append additional SQL queries to existing ones, potentially extracting sensitive information from the database.

The Interactions – Create Interactive Experiences in the Block Editor plugin for WordPress contains a Stored Cross-Site Scripting issue. This is due to insufficient input sanitization and output escaping in event selectors. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

The DK PDF – WordPress PDF Generator plugin for WordPress is susceptible to Server-Side Request Forgery. This allows authenticated attackers with author-level access or higher to make web requests to arbitrary locations from the web application. Exploitation can lead to querying and modifying information from internal services via the `addContentToMpdf` function.

The SearchWiz plugin for WordPress is susceptible to Stored Cross-Site Scripting through post titles displayed in search results. The issue arises because the plugin utilizes `esc attr()` instead of `esc html()` when displaying post titles, allowing authenticated attackers with contributor-level access or higher to inject malicious web scripts into post titles. These scripts execute when a user performs a search and views the resulting page. The vulnerable component is the handling of post titles in search results.

The plugin is susceptible to Stored Cross-Site Scripting through its shortcode due to inadequate input sanitization and output escaping of user-supplied attributes. This allows authenticated attackers with contributor-level access or higher to inject malicious web scripts into pages. These scripts will execute when a user accesses the compromised page.

The Image Photo Gallery Final Tiles Grid plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to inadequate input sanitization and output escaping in the 'Custom scripts' setting. Authenticated attackers with Author-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page.

The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is susceptible to unauthorized data modification. A missing capability check within the `add images to gallery callback()` function allows authenticated attackers with Author-level access or higher to add images to Modula galleries belonging to other users.

The Eyewear prescription form plugin for WordPress is susceptible to a missing authorization issue. This stems from a lack of proper capability checks on the RemoveItems AJAX action. This allows attackers to delete arbitrary WooCommerce product categories, and their child categories, by manipulating the `catIds` parameter.

The WPNakama plugin for WordPress is susceptible to time-based SQL Injection through the `order by` parameter. Insufficient escaping of user-supplied input and inadequate preparation of existing SQL queries allow unauthenticated attackers to inject additional SQL queries, potentially extracting sensitive information from the database. The vulnerable parameter is `order by`.

The WPMasterToolKit plugin for WordPress allows authenticated attackers with Contributor-level access or above to execute arbitrary PHP code on the server. This is possible because the plugin permits Author-level users to create and execute PHP code through the Code Snippets feature without sufficient capability checks. Successful exploitation can lead to remote code execution, privilege escalation, and complete site compromise.

The Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters plugin for WordPress does not properly verify user authorization to perform actions. This allows authenticated attackers with subscriber-level access or higher to modify the plugin’s global accessibility settings.

The Thai Lottery Widget plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `thailottery` shortcode. Insufficient input sanitization and output escaping on the `width` and `height` shortcode attributes allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page.

The QODE Wishlist for WooCommerce plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. This flaw stems from a lack of validation on a user-controlled key within the `qode wishlist for woocommerce wishlist table item callback` function. This allows unauthenticated attackers to modify the public view of any wishlist.

The Progress Bar Blocks for Gutenberg plugin for WordPress is susceptible to Stored Cross-Site Scripting through SVG File uploads. Insufficient input sanitization and output escaping allow authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the SVG file.