Ramuel Gall

The issue is related to Reflected Cross-Site Scripting via multiple parameters due to insufficient input sanitization and output escaping. This allows authenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. It specifically affects users with older browsers that lack proper URL encoding support.

The issue is related to a missing capability check on the `wp ajax route url()` function called via a nopriv AJAX action. This allows unauthenticated attackers to call the function and perform various actions, including including random templates and injecting malicious web scripts.

The WP Lead Plus X plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform administrative actions, such as adding pages to the site and/or replacing site content with malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

The issue is related to insufficient capability checking on various AJAX actions, allowing unauthenticated attackers to perform unauthorized actions. These actions include importing data, uploading arbitrary files, deleting arbitrary files, and more.

The issue is related to Stored Cross-Site Scripting via the `customTag` attribute due to insufficient input sanitization and output escaping. This allows authenticated attackers with access to the Bricks Builder to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The risk increases when Bricks Builder access is granted to lower-privileged users.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `addon enable disable` function. This allows unauthenticated attackers to enable or disable addons via a forged request if they can trick a site administrator into performing an action such as clicking on a link.

The issue is related to insufficient input sanitization and output escaping on tag names, allowing authenticated users with editor-level permissions or greater to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page, even when 'unfiltered html' has been disabled.

The issue is due to missing or incorrect nonce validation on the `save settings` function, making it possible for unauthenticated attackers to modify the theme's settings. This includes enabling a setting that allows lower-privileged users, such as contributors, to perform code execution via a forged request, granted they can trick a site administrator into performing an action like clicking on a link.

The issue is related to insufficient file type validation, allowing unauthenticated visitors to perform a "double extension" attack. This enables the upload of files containing a malicious extension but ending with a benign extension, potentially making remote code execution possible in some configurations.

The issue is due to missing or incorrect nonce validation on the `reset settings` function, making it possible for unauthenticated attackers to reset the theme's settings via a forged request. This can happen if an attacker can trick a site administrator into performing an action such as clicking on a link.

The issue is related to a weak password reset mechanism, allowing unauthenticated attackers to reset the password of arbitrary users by guessing a 4-digit numeric reset code. This enables account takeover.

The issue is related to Stored Cross-Site Scripting via the "wp ajax import widget data" parameter AJAX action due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Cyr to Lat plugin for WordPress is vulnerable to authenticated SQL Injection via the `ctl sanitize title` function due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This potentially allows authenticated users with the ability to add or modify terms or tags to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The issue is related to a missing capability check when changing plugin settings, which allows unauthenticated attackers to modify the plugin's settings. This could potentially lead to unauthorized changes to the plugin's configuration.

The issue concerns PHAR deserialization via the `zbscrmcsvimpf` parameter in the `zeroBSCRM CSVImporterLitehtml app` function. Although a nonce check is performed, steps 2 and 3 of this check do not take action upon failure, leading to a `file exists` check on the `zbscrmcsvimpf` value. If a phar:// archive is provided, its contents are deserialized, allowing an object to be injected into the execution stream. This enables an unauthenticated attacker to achieve object injection if they can upload a phar archive and trick an administrator into performing a specific action.

The issue allows unauthorized modification of site options due to a missing capability check on the `fpd update options` function. This makes it possible for authenticated attackers with subscriber-level permissions to modify site options, including setting the default role to administrator, which can allow privilege escalation.

The issue allows unauthorized access to data and modification of plugin settings due to a missing capability check on multiple AJAX functions. This makes it possible for authenticated attackers with subscriber-level permissions to modify plugin settings, including retrieving arbitrary order information or creating/updating/deleting products, orders, or other sensitive information not associated with their own account.

The issue allows unauthenticated attackers to inject arbitrary web scripts in pages via the `log` parameter when logging in to the site. This makes it possible for attackers to execute scripts whenever a user accesses an injected page.

The issue allows authenticated attackers with subscriber-level capabilities or above to obtain sensitive information about arbitrary form submissions, including the submitter's first name, via the `mf first name` shortcode.

The issue allows authenticated attackers with subscriber-level permissions and above to obtain sensitive information about the site configuration as disclosed by the WordPress health check via the "/health" REST route due to improper authorization.