Quốc Huy

The plugin fails to properly verify if a user is authorized to perform specific actions. This missing authorization allows authenticated attackers with Contributor-level access or higher to read all Contact Form 7 submission data by utilizing the `acf7db` shortcode.

Incorrect Authorization exists due to an operator precedence bug in the post-type guard within the `trash table bulk()` and `restore table bulk()` functions, which prevents the guard from executing. This is combined with a permission callback that verifies plugin role membership but fails to perform per-post-type or ownership checks. Consequently, authenticated users with subscriber-level access or higher can trash or restore any post, page, or custom post type on the site by providing arbitrary post IDs via the `ids` parameter.

An authorization bypass exists due to the `duplicate post permissions()` permission callback verifying only the `duplicate posts` capability while failing to check for `publish posts` or other status-gated capabilities. This allows authenticated users with Contributor-level access or higher to create duplicate posts with `future` (scheduled for auto-publishing) or `private` status, thereby bypassing editorial review. Furthermore, the REST endpoint fails to enforce administrator-configured restrictions on post-type duplication, enabling the duplication of post types that were explicitly disabled.

Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via shortcode attributes, enabling the injection of arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. The issue can be triggered even before a post is published, as the payload executes when an administrator views a post submitted for pending review.

Stored DOM Cross-Site Scripting occurs due to insufficient sanitization of the `href` attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in the `inc/fancybox-2.php` file. The `this.href` variable is concatenated directly into an HTML string without escaping, which allows a stored `href` containing entity-encoded double-quotes to break out of the data attribute and inject arbitrary event handlers into the Document Object Model (DOM). Authenticated attackers with contributor-level access and above can use this to inject arbitrary web scripts into pages that execute when a user clicks a malicious PDF link.

Insufficient input sanitization in the `blocksy sanitize post meta options()` function allows authenticated attackers with contributor-level access or higher to store serialized PHP object strings in post meta. The function only blocks values containing '<' or '>', failing to prevent the injection of serialized objects. When the V200 database migration occurs, the `SearchReplacer::run recursively()` function unconditionally deserializes all string values using `@unserialize()` without restricting allowed classes. This process can trigger the `RaiiPattern:: destruct()` function of an injected `BlocksyRaiiPattern` object, leading to remote code execution by executing arbitrary PHP callables via `call user func()`. This issue is accessible via the 'blocksy meta' REST API field.

The plugin is susceptible to unauthorized email sending because the `send test email()` function lacks a proper capability check. This allows authenticated users with Subscriber-level permissions or higher to send test emails to any arbitrary address from the server.

Name of the Vulnerable Software and Affected Versions Optimole – Optimize Images plugin for WordPress versions through 4.2.2 Description The Optimole – Optimize Images plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is caused by inadequate input sanitization and output escaping of the `s` parameter (srcset descriptor) within the unauthenticated /wp-json/optimole/v1/optimizations REST endpoint. The endpoint employs HMAC signature and timestamp validation, but these values are exposed in the frontend HTML. The plugin utilizes sanitize text field() which strips HTML tags but does not escape double quotes, and the poisoned descriptor is stored in transients and injected into the srcset attribute without proper escaping. Recommendations Update to a version beyond 4.2.2

Name of the Vulnerable Software and Affected Versions Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress versions through 1.4.9 Description The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is susceptible to unauthorized data access. This is due to a missing capability check within the `entries shortcode()` function. Authenticated attackers with Contributor-level access or higher can extract all form submissions, including sensitive information such as names, email addresses, and phone numbers. Recommendations Versions prior to 1.5.0 should be updated.

The Download Manager plugin for WordPress is susceptible to unauthorized data access. A missing capability check on the `reviewUserStatus()` function allows authenticated attackers with Subscriber-level access or higher to retrieve sensitive user information. This information includes email addresses, display names, and registration dates.

The Royal Addons for Elementor plugin for WordPress is susceptible to Information Exposure due to insufficient restrictions on post inclusion within the `get main query args()` function. This allows unauthenticated attackers to extract contents from non-public custom post types, including Contact Form 7 submissions and WooCommerce coupons.

The GetGenie plugin for WordPress is susceptible to an Insecure Direct Object Reference issue due to missing validation on a user-controlled key within the `action` function. This allows authenticated attackers with Author-level access or higher to modify post metadata for any post. The lack of input sanitization, combined with this issue, can lead to Stored Cross-Site Scripting when a user with higher privileges, such as an Administrator, views the "Competitor" tab in the GetGenie sidebar of an affected post. The vulnerable parameter is a user-controlled key used in the `action` function.

The WP ULike plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `[wp ulike likers box]` shortcode `template` attribute. This occurs because `html entity decode()` is used on shortcode attributes without proper output sanitization, bypassing WordPress’s `wp kses post()` content filtering. Authenticated attackers with Contributor-level access or higher can inject malicious web scripts into pages. These scripts will execute when a user accesses the affected page, but only if the post has at least one like. The vulnerable parameter is `template`.

The Greenshift plugin for WordPress is susceptible to exposure of sensitive information. This occurs due to the automated Settings Backup being stored in a publicly accessible file, allowing unauthenticated attackers to extract data. Compromised data includes API keys for OpenAI, Claude, Google Maps, Gemini, DeepSeek, and Cloudflare Turnstile.

The WP-Members Membership Plugin for WordPress is susceptible to SQL Injection through the `order by` attribute of the [wpmem user membership posts] shortcode. This is caused by inadequate escaping of user-supplied parameters and insufficient preparation of the existing SQL query. Authenticated attackers with Contributor-level access or higher can append additional SQL queries to existing queries, potentially allowing them to extract sensitive information from the database.

The Blocksy theme for WordPress is susceptible to Stored Cross-Site Scripting through the `blocksy meta` metadata fields. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. The vulnerable parameter is `blocksy meta`.

The WP Mail Logging plugin for WordPress is susceptible to PHP Object Injection in versions up to and including 1.15.0. This occurs due to the deserialization of untrusted input from the email log message field. The `BaseModel` class constructor uses `maybe unserialize()` on database properties without proper validation, allowing attackers to inject a PHP Object through a double-serialized payload. This payload can be submitted through any public-facing form that sends email, such as Contact Form 7. When an administrator views the logged email, the malicious payload is deserialized. The impact of this issue is limited unless another plugin or theme containing a PHP Object Payload (POP) chain is installed, which could allow actions like file deletion, data retrieval, or code execution.

The software is susceptible to an Insecure Direct Object Reference (IDOR) issue. The `/wp-json/wp-recipe-maker/v1/integrations/instacart` API endpoint has a permission check set to always return true, and lacks authorization checks on the `recipeId` parameter provided by the user. This allows unauthenticated attackers to modify arbitrary post metadata (`wprm instacart combinations`) using the `recipeId` parameter.

The WP Accessibility plugin for WordPress is susceptible to Stored DOM-Based Cross-Site Scripting through the 'alt' attribute of images processed by the "Long Description UI" feature. The issue arises because the plugin’s JavaScript retrieves the alt attribute using `getAttribute()` and concatenates it into `innerHTML` and `insertAdjacentHTML` calls without sufficient sanitization or escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. Exploitation requires the "Long Description UI" setting to be enabled and set to "Link to description."

The software contains a flaw due to insufficient verification of data authenticity. The plugin decrypts and trusts attacker-controlled `email data` in an unauthenticated AJAX handler without cryptographic authenticity guarantees. This allows attackers to manipulate form email routing and redirection values, potentially triggering unauthorized email relay and redirection via the `email data` parameter. The affected component is an AJAX handler.