Rafie Muhammad

**Name of the Vulnerable Software and Affected Versions** Visitors Traffic Real Time Statistics Pro versions prior to 11.23 **Description** Unauthenticated stored Cross-Site Scripting (XSS) occurs when the plugin fails to sanitize the `page title` parameter within the `ahcpro track visitor` AJAX action. This action is accessible to logged-out users via `wp ajax nopriv ahcpro track visitor`, allowing raw input to be stored in the database. When an administrator accesses the plugin dashboard, the 'Traffic by Title' DataTable renders this stored value as innerHTML without output escaping, which enables the execution of arbitrary JavaScript within the administrator's session. **Recommendations** Update to a version newer than 11.22. As a temporary workaround, restrict access to the `ahcpro track visitor` AJAX action to prevent unauthenticated users from submitting data via the `page title` parameter.

**Name of the Vulnerable Software and Affected Versions** JetAppointment versions prior to 2.5.2.2 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the `friendlyTime` parameter at the `jet engine form booking submit` endpoint. The injected payload is stored in the `wp jet appointments meta` table and executes in the administrator's browser when the appointment details popup is opened within the WordPress admin panel. **Recommendations** Update to a version newer than 2.5.2.1. Avoid using the `friendlyTime` parameter in the `jet engine form booking submit` endpoint until the update is applied.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.

**Name of the Vulnerable Software and Affected Versions** ConvertPlus versions prior to 3.6.4 **Description** The plugin is susceptible to deserialization of untrusted data through the `style` parameter of the `cp display preview modal` AJAX action. The issue occurs because the nonce guard is bypassed when the `cp admin page nonce` parameter is omitted, and no capability check is performed on the callback. Additionally, the `sanitize text field()` function fails to strip shortcode delimiters from the `$style` value before it is processed by `do shortcode()`. This allows authenticated attackers with Subscriber-level access or higher to inject a `[smile modal]` invocation, leading the `smile modal popup()` function to pass base64-decoded bytes to `maybe unserialize()` without `allowed classes` restrictions. This enables the injection of PHP objects. While no POP chain (a sequence of gadgets used to execute arbitrary code during deserialization) is present in the software itself, the presence of a POP chain in another installed plugin or theme could allow attackers to delete arbitrary files, retrieve sensitive data, or execute code. **Recommendations** Update the plugin to a version newer than 3.6.3. As a temporary mitigation, restrict access to the `cp display preview modal` AJAX action or avoid using the `style` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** WP Multi Store Locator Pro versions prior to 4.5.2 **Description** An issue exists where unauthenticated attackers can perform SQL Injection by appending additional queries to existing ones to extract sensitive database information. This occurs because the `store locatore search radius` parameter is not sufficiently escaped or prepared before being used in a SQL query. The flaw is located within a numeric, unquoted SQL context, which bypasses the `wp magic quotes()` protection. Additionally, the AJAX handler `wp ajax nopriv make search request` lacks nonce or capability checks, allowing the endpoint to be accessed without authentication. **Recommendations** Update to a version newer than 4.5.1. As a temporary mitigation, restrict access to the `wp ajax nopriv make search request` handler or avoid using the `store locatore search radius` parameter.

**Name of the Vulnerable Software and Affected Versions** WordPress versions 4.7 through 7.1 **Description** An unauthenticated stored cross-site scripting (XSS) issue, dubbed Comment2Shell, exists in the WordPress core. The flaw occurs in the `wpautop()` function, which converts line breaks into paragraphs. An attacker can submit a crafted comment containing a line break within the `cite` attribute of a `blockquote` tag. While this input passes the `wp kses()` filter, a subsequent reformatting step during page display uses an incorrect regular expression that inserts a paragraph tag inside the quote, transforming the text into an active `onfocus` event handler triggered by an `autofocus` script. This XSS executes automatically upon page load without user interaction. If a logged-in administrator views the affected page, the script can abuse the administrator's session to read a plugin installer nonce and upload a malicious PHP plugin, resulting in remote code execution (RCE) on the server. There is currently no evidence of real-world exploitation. **Recommendations** Update WordPress to version 7.1.1 or the corresponding patched version for the specific branch (e.g., 4.7.36). Disable comments site-wide as a temporary mitigation. Enforce strict Content Security Policy (CSP) headers to block inline scripts. Ensure administrator users do not browse the front-end of the site while logged in.

**Name of the Vulnerable Software and Affected Versions** MyHome Core versions prior to 4.4.6 **Description** An authentication bypass exists in the MyHome Core plugin for WordPress. The issue stems from missing authorization in the `send link()` AJAX handler and improper token validation within the `activate()` function. These flaws allow an unauthenticated attacker to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie, potentially granting administrative access. Exploitation is possible when the MyHome theme is configured in legacy/WPBakery mode with frontend registration and confirmation emails enabled, provided the target account does not have the `myhome agent confirmed` user meta set. **Recommendations** Update MyHome Core to a version newer than 4.4.5. As a temporary mitigation, disable frontend registration. Restrict access to the `send link()` AJAX handler and the `activate()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** All-in-One WP Migration Unlimited Extension versions prior to 2.85 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user-supplied attributes, combined with missing authorization checks in the `settings()` function. Authenticated attackers with Subscriber-level access or higher can inject arbitrary web scripts via the `ai1wm backups path` parameter. These scripts execute when an administrator accesses the plugin settings page. **Recommendations** Update All-in-One WP Migration Unlimited Extension to version 2.85 or later.

**Name of the Vulnerable Software and Affected Versions** Classified Listing - Mobile Number Verification versions prior to 1.6.1 **Description** An authentication bypass exists due to missing server-side Firebase OTP validation within the `process otp login()` function. This allows unauthenticated attackers to authenticate as any user registered in the plugin's phone table by submitting an arbitrary OTP code and `UID` through the Firebase OTP login flow. Exploitation is possible if OTP login is enabled with Firebase as the verification gateway and the attacker knows or guesses the target account's registered phone number. This can lead to the takeover of administrator accounts if they have a registered phone number. **Recommendations** Update to a version newer than 1.6.0. As a temporary mitigation, disable OTP login or switch the verification gateway from Firebase to another provider.

**Name of the Vulnerable Software and Affected Versions** Formidable Charts versions prior to 2.0.2 **Description** An issue exists that allows unauthenticated attackers to perform Directory Traversal, a method used to access files and directories that are stored outside the web root folder. By manipulating the `frm graph` parameter, an attacker can read arbitrary files on the server, potentially exposing sensitive information. This requires Formidable Forms Lite, Formidable Forms Pro, and Formidable Charts to be active, and the `wp-content/uploads/frm-charts/` directory must exist, which typically occurs after an image-format chart is rendered. **Recommendations** Update to version 2.0.2 or later. Restrict access to the `frm graph` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Formidable Digital Signatures versions prior to 3.0.7 **Description** Insufficient file path validation in the `delete file()` function allows unauthenticated attackers to delete files on the server. This occurs during the standard entry-creation POST flow on forms that accept anonymous submissions by providing a controlled filename in the `item meta[field id][content]` parameter and the `delete saved image` flag. **Recommendations** Update Formidable Digital Signatures to version 3.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** WooCommerce - Social Login versions prior to 2.8.8 **Description** An authentication bypass exists in the Apple login handler. The issue occurs because the plugin accepts the Apple `id token` and decodes only its base64 payload without verifying the JSON Web Token (JWT) signature against Apple's public keys or validating the issuer, audience, or expiry claims. Additionally, the security nonce required to initiate the login flow is publicly exposed to unauthenticated users via a localized JavaScript object on the login page. This allows unauthenticated attackers to gain access to any existing WordPress account, including administrator accounts, by providing a forged `id token` containing the target user's email address, which is then used to issue an authenticated session without role exclusion. **Recommendations** Update to a version newer than 2.8.7.

**Name of the Vulnerable Software and Affected Versions** WP Foodbakery versions prior to 4.10 **Description** The WP Foodbakery plugin for WordPress contains a flaw allowing authenticated users with subscriber-level access or higher to delete arbitrary files on the server. This occurs due to insufficient file path validation within the `delete locations backup file callback()` function, specifically when processing the `delete locations backup file` AJAX action. Deleting critical files, such as `wp-config.php`, can lead to remote code execution. **Recommendations** Update the plugin to a version later than 4.9. As a temporary mitigation, restrict access to the `delete locations backup file callback()` function for users with subscriber-level permissions.

**Name of the Vulnerable Software and Affected Versions** Eventer versions prior to 4.4.3 **Description** The plugin implements an insecure password reset mechanism. When a password reset is requested, a plaintext copy of the reset key is stored in the `eventer verification code` user meta field within the `wp usermeta` table. An attacker who obtains this plaintext key can use the plugin's custom reset action to change the password of any user account, including those with administrator privileges. This issue is particularly critical when combined with other flaws that allow the extraction of data from the database. The password reset function is only operational on PHP versions up to 7.4. **Recommendations** Update the plugin to a version newer than 4.4.2. Restrict access to the `eventer verification code` user meta field to prevent unauthorized extraction of reset keys.

**Name of the Vulnerable Software and Affected Versions** Eventer versions prior to 4.4.3 **Description** The Eventer plugin for WordPress contains a time-based SQL Injection flaw. This occurs because the plugin fails to properly escape the `code` parameter and lacks sufficient preparation of the SQL query. Unauthenticated attackers can exploit this by appending additional SQL queries to existing ones, allowing the extraction of sensitive information from the database. **Recommendations** Update the plugin to a version newer than 4.4.2. As a temporary mitigation, restrict access to the functionality utilizing the `code` parameter.

**Name of the Vulnerable Software and Affected Versions** Shopify versions prior to 1.0.1 **Description** The Shopify plugin for WordPress allows authenticated attackers with contributor-level access or higher to perform Local File Inclusion (LFI), a process where an application is tricked into including files from the local file system. This allows the inclusion and execution of arbitrary files on the server, enabling the execution of PHP code contained within those files. This flaw can be leveraged to bypass access controls or obtain sensitive data, particularly when images or other safe file types are uploaded and subsequently included. **Recommendations** Update to a version newer than 1.0.0.

**Name of the Vulnerable Software and Affected Versions** Motors versions prior to 5.6.81 **Description** An unauthenticated broken access control issue exists, allowing unauthorized users to bypass access restrictions. **Recommendations** Update to a version newer than 5.6.80.

**Name of the Vulnerable Software and Affected Versions** JetEngine versions prior to 3.8.10.3 **Description** The JetEngine plugin for WordPress contains a flaw where insufficient escaping of user-supplied parameters and lack of proper preparation of SQL queries allow unauthenticated attackers to append additional SQL queries. This can be used to extract sensitive information from the database. **Recommendations** Update JetEngine to a version newer than 3.8.10.2.

**Name of the Vulnerable Software and Affected Versions** MasterStudy LMS Pro Plus versions prior to 4.8.21 **Description** The MasterStudy LMS Pro Plus plugin for WordPress contains a generic SQL Injection flaw. This issue occurs because the `columns` parameter is not properly escaped and the SQL query is not sufficiently prepared. Authenticated attackers with instructor-level access or higher can append additional SQL queries to existing ones to extract sensitive information from the database. **Recommendations** Update the plugin to a version later than 4.8.20. As a temporary workaround, restrict access to the `columns` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.0.7 **Description** Insufficient file path validation and a missing capability check in the `downloadZIP()` function allow unauthenticated attackers to read and delete arbitrary files. This action is limited to the WordPress uploads base directory. **Recommendations** Update to a version later than 6.0.6. As a temporary workaround, consider disabling the `downloadZIP()` function until the update is applied.