Rafie Muhammad

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wm backups path' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combined with missing authorization checks on the settings() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the plugin settings page. The vulnerability was partially patched in version 2.84.

**Name of the Vulnerable Software and Affected Versions** Classified Listing - Mobile Number Verification versions prior to 1.6.1 **Description** An authentication bypass exists due to missing server-side Firebase OTP validation within the `process otp login()` function. This allows unauthenticated attackers to authenticate as any user registered in the plugin's phone table by submitting an arbitrary OTP code and `UID` through the Firebase OTP login flow. Exploitation is possible if OTP login is enabled with Firebase as the verification gateway and the attacker knows or guesses the target account's registered phone number. This can lead to the takeover of administrator accounts if they have a registered phone number. **Recommendations** Update to a version newer than 1.6.0. As a temporary mitigation, disable OTP login or switch the verification gateway from Firebase to another provider.

The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.0.1 via the 'frm graph' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires Formidable Forms Lite, Formidable Forms Pro, and Formidable Charts to be active and requires the wp-content/uploads/frm-charts/ directory to exist, normally after an image-format chart is rendered.

The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the delete file function in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to delete files on the server by supplying an attacker-controlled filename in the item meta[field id][content] parameter alongside the delete saved image flag during the standard entry-creation POST flow on any form that accepts anonymous submissions.

**Name of the Vulnerable Software and Affected Versions** WooCommerce - Social Login versions prior to 2.8.8 **Description** An authentication bypass exists in the Apple login handler. The issue occurs because the plugin accepts the Apple `id token` and decodes only its base64 payload without verifying the JSON Web Token (JWT) signature against Apple's public keys or validating the issuer, audience, or expiry claims. Additionally, the security nonce required to initiate the login flow is publicly exposed to unauthenticated users via a localized JavaScript object on the login page. This allows unauthenticated attackers to gain access to any existing WordPress account, including administrator accounts, by providing a forged `id token` containing the target user's email address, which is then used to issue an authenticated session without role exclusion. **Recommendations** Update to a version newer than 2.8.7.

**Name of the Vulnerable Software and Affected Versions** WP Foodbakery versions prior to 4.10 **Description** The WP Foodbakery plugin for WordPress contains a flaw allowing authenticated users with subscriber-level access or higher to delete arbitrary files on the server. This occurs due to insufficient file path validation within the `delete locations backup file callback()` function, specifically when processing the `delete locations backup file` AJAX action. Deleting critical files, such as `wp-config.php`, can lead to remote code execution. **Recommendations** Update the plugin to a version later than 4.9. As a temporary mitigation, restrict access to the `delete locations backup file callback()` function for users with subscriber-level permissions.

**Name of the Vulnerable Software and Affected Versions** Eventer versions prior to 4.4.3 **Description** The plugin implements an insecure password reset mechanism. When a password reset is requested, a plaintext copy of the reset key is stored in the `eventer verification code` user meta field within the `wp usermeta` table. An attacker who obtains this plaintext key can use the plugin's custom reset action to change the password of any user account, including those with administrator privileges. This issue is particularly critical when combined with other flaws that allow the extraction of data from the database. The password reset function is only operational on PHP versions up to 7.4. **Recommendations** Update the plugin to a version newer than 4.4.2. Restrict access to the `eventer verification code` user meta field to prevent unauthorized extraction of reset keys.

**Name of the Vulnerable Software and Affected Versions** Eventer versions prior to 4.4.3 **Description** The Eventer plugin for WordPress contains a time-based SQL Injection flaw. This occurs because the plugin fails to properly escape the `code` parameter and lacks sufficient preparation of the SQL query. Unauthenticated attackers can exploit this by appending additional SQL queries to existing ones, allowing the extraction of sensitive information from the database. **Recommendations** Update the plugin to a version newer than 4.4.2. As a temporary mitigation, restrict access to the functionality utilizing the `code` parameter.

**Name of the Vulnerable Software and Affected Versions** Motors versions prior to 5.6.81 **Description** An unauthenticated broken access control issue exists, allowing unauthorized users to bypass access restrictions. **Recommendations** Update to a version newer than 5.6.80.

**Name of the Vulnerable Software and Affected Versions** Shopify versions prior to 1.0.1 **Description** The Shopify plugin for WordPress allows authenticated attackers with contributor-level access or higher to perform Local File Inclusion (LFI), a process where an application is tricked into including files from the local file system. This allows the inclusion and execution of arbitrary files on the server, enabling the execution of PHP code contained within those files. This flaw can be leveraged to bypass access controls or obtain sensitive data, particularly when images or other safe file types are uploaded and subsequently included. **Recommendations** Update to a version newer than 1.0.0.

**Name of the Vulnerable Software and Affected Versions** JetEngine versions prior to 3.8.10.3 **Description** The JetEngine plugin for WordPress contains a flaw where insufficient escaping of user-supplied parameters and lack of proper preparation of SQL queries allow unauthenticated attackers to append additional SQL queries. This can be used to extract sensitive information from the database. **Recommendations** Update JetEngine to a version newer than 3.8.10.2.

**Name of the Vulnerable Software and Affected Versions** MasterStudy LMS Pro Plus versions prior to 4.8.21 **Description** The MasterStudy LMS Pro Plus plugin for WordPress contains a generic SQL Injection flaw. This issue occurs because the `columns` parameter is not properly escaped and the SQL query is not sufficiently prepared. Authenticated attackers with instructor-level access or higher can append additional SQL queries to existing ones to extract sensitive information from the database. **Recommendations** Update the plugin to a version later than 4.8.20. As a temporary workaround, restrict access to the `columns` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.0.7 **Description** Insufficient file path validation and a missing capability check in the `downloadZIP()` function allow unauthenticated attackers to read and delete arbitrary files. This action is limited to the WordPress uploads base directory. **Recommendations** Update to a version later than 6.0.6. As a temporary workaround, consider disabling the `downloadZIP()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Avada Builder versions prior to 3.15.2 **Description** The Avada Builder plugin for WordPress contains a time-based SQL Injection, a technique where an attacker sends queries that cause the database to pause for a specific duration to determine if a condition is true. This occurs via the 'product order' parameter due to insufficient escaping of user-supplied data and lack of proper preparation of the SQL query. Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database. This issue only affects sites where WooCommerce was previously installed and subsequently deactivated. Approximately 1 million sites are estimated to be at risk. **Recommendations** Update to a version newer than 3.15.1.

**Name of the Vulnerable Software and Affected Versions** Avada Builder versions prior to 3.15.3 **Description** An arbitrary file read issue exists in the Avada Builder plugin for WordPress. Authenticated attackers with Subscriber-level access or higher can read arbitrary files on the server, potentially exposing sensitive information. This is possible through the `fusion get svg from file()` function using the `custom svg` parameter within the 'fusion section separator' shortcode. **Recommendations** Update to version 3.15.3. As a temporary workaround, restrict access to the `fusion get svg from file()` function or the `custom svg` parameter in the 'fusion section separator' shortcode.

**Name of the Vulnerable Software and Affected Versions** sizam RH Frontend Publishing Pro versions through 4.3.2 **Description** The software contains a flaw related to improper input handling during web page generation, which allows for Reflected Cross-site Scripting (XSS). This means that malicious scripts can be injected into web pages viewed by users. The vulnerability exists due to insufficient sanitization of user-supplied input. The affected component is rh-frontend. **Recommendations** Update to a version newer than 4.3.2.

**Name of the Vulnerable Software and Affected Versions** ListingPro versions prior to 2.9.9 **Description** The ListingPro plugin contains a flaw related to improper input handling during web page generation, specifically a Reflected Cross-Site Scripting (XSS) issue. This allows for the injection of malicious scripts into web pages. The vulnerability exists due to insufficient sanitization of user-supplied input. The affected component is the listingpro-plugin. **Recommendations** Update ListingPro to version 2.9.9 or later.

**Name of the Vulnerable Software and Affected Versions** PixFort pixfort Core versions through 3.2.22 **Description** A missing authorization issue exists in PixFort pixfort Core pixfort-core, allowing exploitation of incorrectly configured access control security levels. **Recommendations** Update PixFort pixfort Core to a version later than 3.2.22.

**Name of the Vulnerable Software and Affected Versions** PixFort pixfort Core versions through 3.2.22 **Description** A flaw exists in PixFort pixfort Core that allows for Reflected Cross-site Scripting (XSS). This issue arises from improper handling of user-supplied input when generating web pages. The vulnerability could potentially allow an attacker to inject malicious scripts into web pages viewed by other users. The affected component is `pixfort-core`. **Recommendations** Update PixFort pixfort Core to a version later than 3.2.22.

**Name of the Vulnerable Software and Affected Versions** AndonDesign UDesign versions through 4.14.0 **Description** The software contains a flaw due to improper input handling during web page creation, which allows for Reflected Cross-site Scripting (XSS). This means that malicious scripts can be injected into web pages viewed by users. The vulnerability allows an attacker to inject arbitrary web scripts or HTML. The affected component is not specified. **Recommendations** Update to a version later than 4.14.0.