Ryan Zegar

The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users.

**Name of the Vulnerable Software and Affected Versions** Multi Step Form plugin for WordPress versions up to, and including, 1.7.23 **Description** The issue is related to a missing capability check on the `fw upload file` AJAX action, which allows unauthenticated attackers to upload limited file types, such as images. This makes it possible for attackers to upload files without proper authorization. **Recommendations** For versions up to, and including, 1.7.23, update to a version that includes a fix for the missing capability check on the `fw upload file` AJAX action. As a temporary workaround, consider disabling the `fw upload file` AJAX action until a patch is available. Restrict access to the `fw upload file` AJAX endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MAS Elementor plugin for WordPress versions up to, and including, 1.1.7 **Description** The issue is related to Stored Cross-Site Scripting via SVG file uploads, which is possible due to insufficient input sanitization and output escaping. This allows authenticated attackers with Author-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. **Recommendations** For MAS Elementor plugin for WordPress versions up to, and including, 1.1.7, update to a version higher than 1.1.7 to resolve the issue. As a temporary workaround, consider restricting access to SVG file uploads for users with Author-level access and above until a patch is available. Avoid using the MAS Elementor plugin for WordPress with versions up to, and including, 1.1.7 for uploading SVG files until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** ClickDesigns plugin for WordPress versions up to, and including, 1.8.0 **Description** The issue allows unauthorized modification of data due to a missing capability check on the `clickdesigns add api` and the `clickdesigns remove api` functions. This makes it possible for unauthenticated attackers to modify or remove the plugin's API key. **Recommendations** For versions up to, and including, 1.8.0, update to a version that includes a fix for the missing capability check in the `clickdesigns add api` and `clickdesigns remove api` functions. As a temporary workaround, consider disabling the `clickdesigns add api` and `clickdesigns remove api` functions until a patch is available. Restrict access to the API key to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: WP SVG Images plugin for WordPress versions up to, and including, 4.2 Description: The issue is related to Stored Cross-Site Scripting via the `type` parameter due to insufficient input sanitization. This allows authenticated attackers with Author-level access and above, who have permissions to upload sanitized files, to bypass SVG sanitization and inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page. Recommendations: For WP SVG Images plugin for WordPress versions up to, and including, 4.2, update to a version higher than 4.2 to resolve the issue. As a temporary workaround, consider restricting access to the `type` parameter to minimize the risk of exploitation.