Prism

**Name of the Vulnerable Software and Affected Versions** Kali Forms — Contact Form & Drag-and-Drop Builder versions prior to 2.4.19 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. Attackers can inject arbitrary web scripts through the `digitalSignature` field value. These scripts execute whenever a user accesses the affected page. The attack is possible because the required form-submission nonce is publicly available on any page containing the form shortcode. **Recommendations** As a temporary workaround, disable or replace the plugin until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.0.14 **Description** The plugin contains a Directory Traversal flaw, which occurs when an application fails to properly sanitize user-supplied input used to construct a file path, allowing access to files or directories outside the intended folder. Authenticated attackers with editor-level access or higher can exploit this via the `family` parameter to delete arbitrary directories on the server, potentially leading to data loss and service unavailability. **Recommendations** Update the plugin to version 6.0.14 or later. Avoid using the `family` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Catch Themes Demo Import versions prior to 3.4 **Description** An authorization flaw exists where the `catch themes demo import activate plugin()` function, triggered during `admin init` when the `activate plugin` GET parameter is present, executes `Plugin Upgrader::install()` to download and install a plugin from WordPress.org before verifying if the user has the `activate plugins` capability. This allows authenticated users with subscriber-level access or higher to install the hardcoded 'essential-content-types' plugin. **Recommendations** Update to version 3.4 or later. As a temporary mitigation, restrict access to the `activate plugin` parameter in the `admin init` process.

**Name of the Vulnerable Software and Affected Versions** ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce versions prior to 1.17.7 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows authenticated attackers with subscriber-level access or higher to create arbitrary company locations within the ERP database. **Recommendations** Update to a version newer than 1.17.6.

**Name of the Vulnerable Software and Affected Versions** MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions versions prior to 5.0.10 **Description** An issue exists where insufficient escaping of user-supplied input and lack of query preparation allow authenticated attackers with subscriber-level access and above to perform SQL Injection. This occurs via the `order by` parameter in the transactions endpoint. Attackers can append additional SQL queries to extract sensitive information from the database. This is particularly exploitable when the store approval setting is configured to automatically approve store owners, as any logged-in user can self-register as a store owner via the public Stores REST endpoint to obtain the necessary `edit stores` capability. **Recommendations** Update MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions to version 5.0.10 or later. Restrict the use of the `order by` parameter in the transactions endpoint as a temporary mitigation. Disable the automatic approval of store owners in the plugin settings to prevent unauthorized users from obtaining the `edit stores` capability.

**Name of the Vulnerable Software and Affected Versions** MxChat – AI Chatbot & Content Generation for WordPress versions prior to 3.2.11 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the admin settings. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts into pages. These scripts execute whenever a user accesses the affected page. This issue specifically impacts multi-site installations and environments where `unfiltered html` has been disabled. **Recommendations** Update to a version newer than 3.2.10.

**Name of the Vulnerable Software and Affected Versions** Easy Accordion – AI-Powered FAQ & Accordion Blocks versions prior to 3.1.7 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the `align` block attribute, which execute when a user visits the affected page. **Recommendations** Update to a version newer than 3.1.6.

**Name of the Vulnerable Software and Affected Versions** Advance Product Search- Voice & Ajax Search for WooCommerce versions prior to 1.4.5 **Description** An issue exists where unauthenticated attackers can append additional SQL queries to existing ones to extract sensitive information from the database. This occurs due to insufficient escaping of user-supplied parameters and a lack of sufficient preparation of the SQL query. The flaw is triggered via the 's' and `match` parameters in the search functionality. **Recommendations** Update Advance Product Search- Voice & Ajax Search for WooCommerce to version 1.4.5 or later. As a temporary mitigation, restrict access to the search functionality that utilizes the `s` and `match` parameters.

**Name of the Vulnerable Software and Affected Versions** SEO Booster versions prior to 7.3.2 **Description** An issue exists where authenticated attackers with administrator-level access and above can perform a time-based SQL Injection. This occurs because the `orderby` parameter is not sufficiently escaped and the SQL query is not properly prepared. Although `esc sql()` and `sanitize text field()` are used, they do not neutralize SQL keywords, commas, parentheses, or subquery syntax within an unquoted ORDER BY context, allowing the clause to be controlled by the attacker to extract sensitive information from the database. **Recommendations** Update SEO Booster to version 7.3.2 or later. As a temporary mitigation, restrict administrator-level access to the plugin settings to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SEO Booster versions prior to 7.3.2 **Description** An issue exists where insufficient escaping of user-supplied input and lack of proper preparation of SQL queries allow authenticated attackers with administrator-level access and above to perform SQL Injection. By manipulating the `sort field` parameter, an attacker can append additional SQL queries to extract sensitive information from the database. **Recommendations** Update to a version newer than 7.3.1. As a temporary mitigation, restrict access to the functionality utilizing the `sort field` parameter.

**Name of the Vulnerable Software and Affected Versions** WP Hotel Booking versions prior to 2.3.3 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user into clicking a link containing a malicious script injected via the `check in date` parameter, which then executes in the user's browser. **Recommendations** Update WP Hotel Booking to version 2.3.3 or later. As a temporary mitigation, restrict or sanitize the input received by the `check in date` parameter.

**Name of the Vulnerable Software and Affected Versions** Product Feed Manager For WooCommerce versions prior to 7.6.2 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user into clicking a link containing a malicious script injected via the `s` search parameter. Reflected Cross-Site Scripting is a type of attack where a script is reflected off a web application to the user's browser. **Recommendations** Update to version 7.6.2 or later. As a temporary mitigation, restrict access to the search functionality utilizing the `s` parameter.

**Name of the Vulnerable Software and Affected Versions** ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form versions prior to 3.5.2 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the `number` and `group` shortcode attributes, which execute when a user visits the affected page. **Recommendations** Update to version 3.5.2 or later.

**Name of the Vulnerable Software and Affected Versions** Themify Builder versions prior to 7.7.8 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can overwrite or delete generated CSS stylesheet files for arbitrary posts, including private and draft posts belonging to other users, and modify plugin-scoped font options. This is facilitated by the `tf nonce` CSRF nonce, which is exposed on public front-end builder pages via `wp localize script`, allowing any authenticated user to obtain it. **Recommendations** Update Themify Builder to version 7.7.8 or later.

**Name of the Vulnerable Software and Affected Versions** Quiz Master Next versions prior to 11.2.1 **Description** An issue exists where authenticated attackers with Author-level access or higher can perform a second-order SQL Injection. This occurs because the `qsm ajax save pages()` AJAX handler does not sufficiently escape the `pages` parameter, and the `qsm options questions tab content()` function fails to use `$wpdb->prepare()` or integer casting when interpolating stored page IDs into an IN() clause. An attacker can plant a SQL payload that executes when any user, including an administrator, views the Questions tab of a quiz, potentially allowing the extraction of sensitive database information. **Recommendations** Update to a version newer than 11.2.0.

**Name of the Vulnerable Software and Affected Versions** WPBot – AI ChatBot for Live Support, Lead Generation, AI Services versions prior to 8.5.7 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can trigger the arbitrary re-embedding of stored RAG (Retrieval-Augmented Generation) documents. This process modifies the `rag documents` table and results in the unauthorized consumption of the site owner's paid third-party AI API credits from providers such as OpenAI, Gemini, OpenRouter, or xAI. **Recommendations** Update WPBot – AI ChatBot for Live Support, Lead Generation, AI Services to version 8.5.7 or later.

**Name of the Vulnerable Software and Affected Versions** Customize My Account for WooCommerce – Live My Account Customizer versions prior to 4.4.15 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with shop manager-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the `row type` parameter, which then execute when a user accesses the affected page. **Recommendations** Update the plugin to version 4.4.15 or later. As a temporary mitigation, restrict access to the `row type` parameter for users with shop manager-level permissions.

**Name of the Vulnerable Software and Affected Versions** Delicious Recipes versions prior to 1.10.3 **Description** Stored Cross-Site Scripting occurs via the 'steps' block attribute. The issue stems from insufficient input sanitization and output escaping within the `wrap direction text()` function. Specifically, the function interpolates the user-supplied `href` value from nested link nodes (`$node['props']['href']`) directly into an anchor tag using `sprintf()` without applying `esc url()` or performing URL scheme validation. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts, such as javascript: URIs, into pages. These scripts execute when a user, such as an editor or administrator, previews the pending post and clicks the malicious link. **Recommendations** Update Delicious Recipes to version 1.10.3 or later. As a temporary mitigation, restrict users with Contributor-level access from editing the 'steps' block attribute.

**Name of the Vulnerable Software and Affected Versions** The Cache Purger versions prior to 2.3.21 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can permanently truncate the cache-purge audit log located at `wp-content/purge.log`, resulting in the destruction of the entire audit history. This is possible because the `tcp log purge` nonce is rendered in the admin bar on frontend pages, providing all authenticated users with the necessary token to trigger the deletion. **Recommendations** Update to a version later than 2.3.20.

**Name of the Vulnerable Software and Affected Versions** WP TripAdvisor Review Slider versions prior to 14.7 **Description** Insufficient escaping of user-supplied input and lack of proper preparation in SQL queries allow authenticated attackers with administrator-level access and above to perform a generic SQL Injection. By manipulating the `filtersource` parameter, an attacker can append additional SQL queries to extract sensitive information from the database. **Recommendations** Update WP TripAdvisor Review Slider to version 14.7 or later. As a temporary mitigation, restrict access to the administrative functions that utilize the `filtersource` parameter.