Pierre Rudloff

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API.

**Name of the Vulnerable Software and Affected Versions** Disable Login Page versions 0.0.0 through 1.1.4 **Description** An authentication bypass exists because the module fails to invalidate relevant caches when login page access restrictions are enabled. This allows previously cached responses for the `/user/login` endpoint to remain accessible, enabling an attacker to bypass the functionality intended to restrict access to the login page. **Recommendations** Clear the system caches after enabling login page access restrictions to ensure that cached responses for the `/user/login` endpoint are invalidated.

**Name of the Vulnerable Software and Affected Versions** Drupal Slick Carousel versions 0.0.0 through 2.1.0 **Description** Improper neutralization of input during web page generation in the Slick UI sub-module allows for Stored Cross-site Scripting (XSS). The issue occurs because the module does not sufficiently validate user input within Slick option sets that contain HTML for carousel buttons. **Recommendations** Update Drupal Slick Carousel to version 8.x-2.1 or later.

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit posts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of protected pages and posts without knowing the password.

**Name of the Vulnerable Software and Affected Versions** Drupal Entity Browser versions 0.0.0 through 2.16.0 **Description** Stored cross-site scripting (XSS) occurs because the module does not sufficiently sanitize tab titles. This allows an attacker to insert HTML with specific attributes on a page displaying an entity browser. Cross-site scripting is a flaw where malicious scripts are injected into trusted websites. **Recommendations** Update Drupal Entity Browser to a version later than 2.16.0.

**Name of the Vulnerable Software and Affected Versions** Element Pack Addons for Elementor versions prior to 8.7.13 **Description** Insufficient sanitization of option values passed through data attributes allows users with contributor-level access or higher to perform a Cross-Site Scripting (XSS) attack. This occurs when a bundled front-end library re-parses and renders these values in the browser, enabling the injection of arbitrary JavaScript that executes in the session of any visitor viewing the affected content. **Recommendations** Update Element Pack Addons for Elementor to version 8.7.13 or later.

**Name of the Vulnerable Software and Affected Versions** Lightbox with PhotoSwipe versions prior to 5.9.0 **Description** Insufficient sanitization and escaping of a link data attribute before it is rendered into the image lightbox caption allows users with author-level access and above, who lack the `unfiltered html` capability, to perform a stored cross-site scripting attack. This occurs when a visitor or administrator opens the lightbox, executing the stored JavaScript in their browser. **Recommendations** Update to version 5.9.0 or later.

**Name of the Vulnerable Software and Affected Versions** PhotoSwipe WordPress plugin versions prior to 4.1.1.2 **Description** The plugin uses the `title` attribute of author-supplied link markup as a lightbox caption, which is written into the page DOM without escaping. Since the `title` attribute bypasses the post-content sanitization for users without the `unfiltered html` capability, an authenticated user with Author-level access can store a JavaScript payload. This payload executes in the browser of any visitor, including administrators, who clicks the link. **Recommendations** Update the PhotoSwipe WordPress plugin to version 4.1.1.2 or later.

**Name of the Vulnerable Software and Affected Versions** Disable Login Page versions *.* **Description** A security issue exists in the Disable Login Page project. The project is currently marked as unsupported, and the maintainer has not provided a fix for this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal Email Login OTP versions *.* **Description** A security issue exists in the Drupal Email Login OTP project. The project is currently marked as unsupported, and the maintainer has not provided a fix for this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal core versions 0.0.0 through 11.3.14 Drupal core versions 11.4.0 through 11.4.4 **Description** Drupal core contains a cross-site scripting (XSS) issue due to improper neutralization of input during web page generation. The XSS filter does not sufficiently sanitize certain attributes from the integrated HTMX JavaScript library, allowing an attacker to execute malicious scripts if they can insert HTML with specific attributes. **Recommendations** Update Drupal core to a version later than 11.3.14. Update Drupal core to a version later than 11.4.4.

**Name of the Vulnerable Software and Affected Versions** Ray Enterprise Translation versions 0.0.0 through 4.0.4 Ray Enterprise Translation versions 4.1.0 through 4.1.4 Ray Enterprise Translation versions 11.0.0 through 11.0.4 **Description** Cross-Site Request Forgery (CSRF) occurs when a module fails to protect state-changing administrative routes. This allows an attacker to trick a privileged user into visiting a crafted page to trigger unauthorized actions, such as updating callback settings, uploading or downloading translations, or changing translation state. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal Siteimprove Analytics versions 0.0.0 through 2.0.1 **Description** Improper neutralization of input during web page generation allows Cross-Site Scripting (XSS). The module fails to sufficiently sanitize the Siteimprove Analytics identification code when inserting the JavaScript tracking code. Exploitation requires the attacker to possess a role with the `administer siteimprove analytics` permission. **Recommendations** Update Drupal Siteimprove Analytics to a version later than 2.0.1.

**Name of the Vulnerable Software and Affected Versions** Drupal Login Disable versions 0.0.0 through 2.1.4 **Description** The Login Disable module, which restricts site access by requiring a secret key on the login form, does not sufficiently protect the form from brute force attacks. An attacker could potentially bypass this protection by guessing the secret key, depending on its length. This issue is partially mitigated because the attacker still requires a valid username and password to gain access. **Recommendations** Update Drupal Login Disable to a version newer than 2.1.4 to enable flood control that blocks excessive authentication attempts.

**Name of the Vulnerable Software and Affected Versions** YOOtheme Pro versions prior to 5.0.35 **Description** The bundled front-end framework fails to prevent certain HTML attributes, which are permitted by the `wp kses post()` function, from being treated as markup. This allows users with the Author role to execute Stored Cross-Site Scripting (XSS) attacks in the browser of any user who views the affected post. **Recommendations** Update YOOtheme Pro to version 5.0.35 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal Colorbox versions 0.0.0 through 2.2.0 **Description** Improper neutralization of input during web page generation allows Cross-Site Scripting (XSS), where malicious JavaScript can be injected into the page. This occurs because the module, which integrates with the Colorbox JavaScript library to display content in an overlay, does not sufficiently protect against injection in certain scenarios. Exploitation requires the attacker to possess a role that permits the entry of HTML content. **Recommendations** Update Drupal Colorbox to a version later than 2.2.0.

**Name of the Vulnerable Software and Affected Versions** Drupal Salesforce Suite versions 0.0.0 through 5.1.3 **Description** A Cross-Site Request Forgery (CSRF) issue exists where the software fails to properly validate the OAuth handshake during interactive authentication. This allows an attacker to hijack the authorization token and bind the site to an attacker-controlled Salesforce account. This issue requires the `salesforce oauth` submodule to be enabled and an active `salesforce oauth` authorization profile to be in use. **Recommendations** Update Drupal Salesforce Suite to version 6.0.x or later. As a temporary mitigation, disable the `salesforce oauth` submodule or switch to the `salesforce jwt` authentication plugin.

**Name of the Vulnerable Software and Affected Versions** Drupal Paragraphs versions 0.0.0 through 1.21.0 **Description** A missing authorization issue in the Paragraphs Library module allows forceful browsing. The module does not sufficiently restrict access to unpublished library items within lists. This occurs when the `paragraphs library` module is active and an attacker can access a list of library items, such as a view or a field providing autocomplete suggestions. **Recommendations** Update Drupal Paragraphs to a version later than 1.21.0. As a temporary mitigation, restrict access to the `paragraphs library` module or disable views and autocomplete fields that list library items.

The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image load error messages, allowing authenticated attackers with Author-level access or above to perform Stored Cross-Site Scripting attacks against any visiting user.

**Name of the Vulnerable Software and Affected Versions** Drupal Tagify versions 0.0.0 through 1.2.52 **Description** Stored Cross-site Scripting (XSS) occurs because the module fails to properly sanitize the name of parent taxonomy terms when rendering suggestions in the Tagify dropdown. This allows an attacker with permissions to create or edit taxonomy terms in a vocabulary to execute arbitrary JavaScript within the context of a user session. **Recommendations** Update Drupal Tagify to a version later than 1.2.52.