Prism

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows authenticated attackers with subscriber-level access or higher to create arbitrary company locations within the ERP database.

The plugin contains a Directory Traversal flaw, which occurs when an application fails to properly sanitize user-supplied input used to construct a file path, allowing access to files or directories outside the intended folder. Authenticated attackers with editor-level access or higher can exploit this via the `family` parameter to delete arbitrary directories on the server, potentially leading to data loss and service unavailability.

Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the `number` and `group` shortcode attributes, which execute when a user visits the affected page.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. Attackers can inject arbitrary web scripts through the `digitalSignature` field value. These scripts execute whenever a user accesses the affected page. The attack is possible because the required form-submission nonce is publicly available on any page containing the form shortcode.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user into clicking a link containing a malicious script injected via the `check in date` parameter, which then executes in the user's browser.

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can trigger the arbitrary re-embedding of stored RAG (Retrieval-Augmented Generation) documents. This process modifies the `rag documents` table and results in the unauthorized consumption of the site owner's paid third-party AI API credits from providers such as OpenAI, Gemini, OpenRouter, or xAI.

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can permanently truncate the cache-purge audit log located at `wp-content/purge.log`, resulting in the destruction of the entire audit history. This is possible because the `tcp log purge` nonce is rendered in the admin bar on frontend pages, providing all authenticated users with the necessary token to trigger the deletion.

Insufficient escaping of user-supplied input and lack of proper preparation in SQL queries allow authenticated attackers with administrator-level access and above to perform a generic SQL Injection. By manipulating the `filtersource` parameter, an attacker can append additional SQL queries to extract sensitive information from the database.

An issue exists where authenticated attackers with administrator-level access and above can perform a time-based SQL Injection. This occurs because the `orderby` parameter is not sufficiently escaped and the SQL query is not properly prepared. Although `esc sql()` and `sanitize text field()` are used, they do not neutralize SQL keywords, commas, parentheses, or subquery syntax within an unquoted ORDER BY context, allowing the clause to be controlled by the attacker to extract sensitive information from the database.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user into clicking a link containing a malicious script injected via the `s` search parameter. Reflected Cross-Site Scripting is a type of attack where a script is reflected off a web application to the user's browser.

An issue exists where authenticated attackers with Author-level access or higher can perform a second-order SQL Injection. This occurs because the `qsm ajax save pages()` AJAX handler does not sufficiently escape the `pages` parameter, and the `qsm options questions tab content()` function fails to use `$wpdb->prepare()` or integer casting when interpolating stored page IDs into an IN() clause. An attacker can plant a SQL payload that executes when any user, including an administrator, views the Questions tab of a quiz, potentially allowing the extraction of sensitive database information.

Insufficient input sanitization and output escaping allow authenticated attackers with shop manager-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the `row type` parameter, which then execute when a user accesses the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the `price wrapper` shortcode attribute. These scripts execute when a user visits the affected page, provided the victim has the referenced ticket ID in their cart cookie, meaning the payload only triggers for users who previously added that specific ticket to their cart.

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can overwrite or delete generated CSS stylesheet files for arbitrary posts, including private and draft posts belonging to other users, and modify plugin-scoped font options. This is facilitated by the `tf nonce` CSRF nonce, which is exposed on public front-end builder pages via `wp localize script`, allowing any authenticated user to obtain it.

An issue exists where insufficient escaping of user-supplied input and lack of proper preparation of SQL queries allow authenticated attackers with administrator-level access and above to perform SQL Injection. By manipulating the `sort field` parameter, an attacker can append additional SQL queries to extract sensitive information from the database.

An issue exists where authenticated attackers with custom-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of user-supplied data and a lack of proper preparation of the SQL query. By manipulating the `s` parameter, an attacker can append additional SQL queries to extract sensitive information from the database.

An issue exists where unauthenticated attackers can append additional SQL queries to existing ones to extract sensitive information from the database. This occurs due to insufficient escaping of user-supplied parameters and a lack of sufficient preparation of the SQL query. The flaw is triggered via the 's' and `match` parameters in the search functionality.

Stored Cross-Site Scripting occurs via the 'steps' block attribute. The issue stems from insufficient input sanitization and output escaping within the `wrap direction text()` function. Specifically, the function interpolates the user-supplied `href` value from nested link nodes (`$node['props']['href']`) directly into an anchor tag using `sprintf()` without applying `esc url()` or performing URL scheme validation. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts, such as javascript: URIs, into pages. These scripts execute when a user, such as an editor or administrator, previews the pending post and clicks the malicious link.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the admin settings. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts into pages. These scripts execute whenever a user accesses the affected page. This issue specifically impacts multi-site installations and environments where `unfiltered html` has been disabled.

An issue exists where insufficient escaping of user-supplied input and lack of query preparation allow authenticated attackers with subscriber-level access and above to perform SQL Injection. This occurs via the `order by` parameter in the transactions endpoint. Attackers can append additional SQL queries to extract sensitive information from the database. This is particularly exploitable when the store approval setting is configured to automatically approve store owners, as any logged-in user can self-register as a store owner via the public Stores REST endpoint to obtain the necessary `edit stores` capability.