Stealthcopter

**Name of the Vulnerable Software and Affected Versions** Graphene versions prior to 2.9.5 **Description** The Graphene theme for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level access or higher can inject arbitrary web scripts through the `Current location` and `Author profile image URL` profile fields. These scripts execute automatically when a user visits the affected page. **Recommendations** Update Graphene to version 2.9.5 or later.

**Name of the Vulnerable Software and Affected Versions** LiteSpeed Cache versions prior to 7.8 **Description** The LiteSpeed Cache plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because of a flawed regular expression used to strip `width` and `height` attributes from images when the Lazy Load Images and Add Missing Sizes features are active. Authenticated attackers with Author-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page. **Recommendations** Update the plugin to version 7.8 or later. As a temporary mitigation, disable the Lazy Load Images and Add Missing Sizes features.

**Name of the Vulnerable Software and Affected Versions** Speed Optimizer versions prior to 7.8.1 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs via image tag attributes, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users. This issue is only exploitable if the Lazy Load Media option is enabled in the plugin settings. **Recommendations** Update to a version newer than 7.8.0. Disable the Lazy Load Media option in the plugin settings as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** ProfilePress versions prior to 4.16.20 **Description** Authenticated attackers with subscriber-level access and above can execute arbitrary shortcodes. This occurs because the software fails to properly validate values before executing the `do shortcode()` function. The issue persists despite partial mitigations using `strip shortcodes()` on `[profile-first-name]` and `[profile-last-name]`, as these can be bypassed via the `[profile-display-name format="first last names"]` render path, the `[profile-bio]` render path, or the double-bracket escape sequence `[[tag]]`. **Recommendations** Update to a version newer than 4.16.19.

**Name of the Vulnerable Software and Affected Versions** Crocoblock JetEngine versions through 3.7.2 **Description** A flaw exists in Crocoblock JetEngine that allows for Remote Code Inclusion due to improper control of code generation. This issue, identified as a 'Code Injection', could potentially allow an attacker to execute arbitrary code. **Recommendations** Update Crocoblock JetEngine to a version newer than 3.7.2.

**Name of the Vulnerable Software and Affected Versions** MapSVG versions through 8.7.3 **Description** The software contains a flaw that permits unrestricted file uploads of dangerous types. This allows for the upload of a web shell to a web server. The issue grants attackers webshell capabilities with minimal authentication. **Recommendations** Versions prior to 8.7.3 should be updated.

**Name of the Vulnerable Software and Affected Versions** WP Rocket versions through 3.19.4 **Description** A flaw exists in WP Rocket that allows for Stored Cross-Site Scripting (XSS). This issue is due to improper neutralization of input during web page generation. An attacker could potentially inject malicious scripts into web pages viewed by other users. The vulnerability affects the WP Rocket plugin. **Recommendations** Update WP Rocket to a version later than 3.19.4.

**Name of the Vulnerable Software and Affected Versions** CrocoBlock JetEngine versions through 3.7.3 **Description** A Stored Cross-site Scripting (XSS) issue exists in CrocoBlock JetEngine. This allows for the injection of malicious scripts into web pages. The issue is due to improper neutralization of input during web page generation. The vulnerability affects the `jet-engine` component. **Recommendations** Update CrocoBlock JetEngine to a version newer than 3.7.3.

Name of the Vulnerable Software and Affected Versions: Crocoblock JetProductGallery versions through 2.2.0.2 Description: Improper neutralization of input during web page generation allows for Stored Cross-site Scripting (XSS). This issue enables malicious actors to inject scripts into web pages viewed by other users. Recommendations: Update Crocoblock JetProductGallery to a version later than 2.2.0.2.

Name of the Vulnerable Software and Affected Versions: Crocoblock JetElements For Elementor versions through 2.7.9 Description: Improper neutralization of input during web page generation allows for Stored Cross-site Scripting (XSS). Recommendations: Update Crocoblock JetElements For Elementor to a version later than 2.7.9.

Name of the Vulnerable Software and Affected Versions: wpbakery Templatera versions through 2.3.0 Description: Improper neutralization of input during web page generation allows for DOM-Based Cross-Site Scripting (XSS). Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Rentsyst versions through 2.0.100 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, leading to Reflected Cross-site Scripting (XSS). Recommendations: Update Rentsyst to a version later than 2.0.100.

**Name of the Vulnerable Software and Affected Versions** CrocoBlock JetReviews versions through 3.0.0 **Description** A flaw exists in CrocoBlock JetReviews that allows for PHP Local File Inclusion due to improper control of filename for include/require statements. This issue is related to a PHP Remote File Inclusion vulnerability. **Recommendations** Update JetReviews to a version newer than 3.0.0.

**Name of the Vulnerable Software and Affected Versions** CrocoBlock JetElements For Elementor versions through 2.7.8 **Description** A flaw exists in CrocoBlock JetElements For Elementor that allows for Stored Cross-Site Scripting (XSS). This issue is due to improper neutralization of input during web page generation. Successful exploitation could allow an attacker to inject malicious scripts into web pages viewed by other users. The vulnerability affects the `jet-elements` component. **Recommendations** Update CrocoBlock JetElements For Elementor to a version later than 2.7.8.

**Name of the Vulnerable Software and Affected Versions** CrocoBlock JetBlog versions through 2.4.4.1 **Description** A flaw exists in CrocoBlock JetBlog that allows for Stored Cross-site Scripting (XSS). This issue arises from improper neutralization of input during web page generation. An attacker could potentially inject malicious scripts into web pages viewed by other users. The vulnerable component is `jet-blog`. **Recommendations** Update CrocoBlock JetBlog to a version later than 2.4.4.1.

**Name of the Vulnerable Software and Affected Versions** CrocoBlock JetWooBuilder versions through 2.1.20.1 **Description** A flaw exists in CrocoBlock JetWooBuilder that allows for Stored Cross-site Scripting (XSS). This issue is due to improper neutralization of input during web page generation. Successful exploitation could allow an attacker to inject malicious scripts into web pages viewed by other users. The vulnerable component is `jet-woo-builder`. **Recommendations** Update JetWooBuilder to a version later than 2.1.20.1.

Name of the Vulnerable Software and Affected Versions: Crocoblock JetEngine versions through 3.7.1.2 Description: A Stored Cross-site Scripting (XSS) issue exists in Crocoblock JetEngine due to improper neutralization of input during web page generation. This allows an attacker to inject malicious scripts into web pages viewed by other users. Recommendations: Update Crocoblock JetEngine to a version later than 3.7.1.2.

Name of the Vulnerable Software and Affected Versions: Crocoblock JetTabs versions through 2.2.9.1 Description: The software contains a DOM-Based Cross-site Scripting (XSS) issue due to improper neutralization of input during web page generation. Recommendations: Update Crocoblock JetTabs to a version later than 2.2.9.1.

**Name of the Vulnerable Software and Affected Versions** CrocoBlock JetSearch versions through 3.5.10 **Description** The software contains a flaw due to improper neutralization of input during web page generation, leading to a Reflected Cross-Site Scripting (XSS) condition. This allows an attacker to inject malicious scripts into web pages viewed by other users. The affected component is `jet-search`. **Recommendations** Update to a version later than 3.5.10.

**Name of the Vulnerable Software and Affected Versions** CrocoBlock JetBlog versions through 2.4.4 **Description** The software contains a flaw due to improper neutralization of input during web page generation, specifically a Reflected Cross-site Scripting (XSS) issue. This allows for the injection of malicious scripts into web pages. The affected component is `jet-blog`. **Recommendations** Update CrocoBlock JetBlog to a version later than 2.4.4.