Skyv3Il

**Name of the Vulnerable Software and Affected Versions** Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI versions prior to 3.5.3 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with delegated form management access can activate any already-installed WordPress plugins, including those previously deactivated or known to be vulnerable, without possessing the core `activate plugins` capability. This exploitation is possible for users assigned delegated capabilities such as `manage everest forms`, `everest forms create forms`, or `everest forms view forms`. The process involves using nonces emitted on admin pages accessible to these delegated users to interact with AJAX handlers. **Recommendations** Update to a version newer than 3.5.2.

**Name of the Vulnerable Software and Affected Versions** Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution versions prior to 5.4.13 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages. Execution happens when a user accesses the injected page. Successful exploitation requires the attacker to control a domain with an origin string that is a leading prefix of the target site's backend URL and requires an authenticated WordPress administrator to visit the attacker-controlled page while the File Manager admin screen is open. The issue is triggered via the `soundFile` parameter. **Recommendations** Update Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution to version 5.4.13 or later. Avoid using the `soundFile` parameter until the plugin is updated.

**Name of the Vulnerable Software and Affected Versions** GiveWP – Donation Plugin and Fundraising Platform versions prior to 4.16.4 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with give worker-level access and above to perform Stored Cross-Site Scripting. The issue occurs when the `twitter message` Sequoia Template Setting is used, allowing the injection of arbitrary web scripts. These scripts execute when a donor clicks the Share on Twitter button on the Sequoia donation confirmation view, as the unescaped `twitter message` value is evaluated within a JavaScript template literal. **Recommendations** Update GiveWP – Donation Plugin and Fundraising Platform to version 4.16.4 or later.

**Name of the Vulnerable Software and Affected Versions** ProfilePress versions prior to 4.16.19 **Description** An arbitrary file upload issue exists in the `allowed mime types()` function. The plugin unconditionally registers an `upload mimes` filter that adds executable file extensions such as .exe, .apk, and .msi to the global WordPress MIME allowlist. Because this filter is registered globally on every request and not limited to digital-product upload contexts, authenticated attackers with author-level access or higher can upload executable files, potentially leading to remote code execution. **Recommendations** Update to a version newer than 4.16.18.

**Name of the Vulnerable Software and Affected Versions** Tutor LMS – eLearning and online course solution plugin for WordPress versions prior to 3.9.14 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access and above can inject arbitrary web scripts through the Lesson Attachment Title, which execute when a user accesses the affected page. **Recommendations** Update the plugin to version 3.9.14 or later.